Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
206s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:36
Static task
static1
Behavioral task
behavioral1
Sample
bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe
Resource
win10v2004-20220901-en
General
-
Target
bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe
-
Size
72KB
-
MD5
9c505202eb99119296afbb600e9274d6
-
SHA1
1fe1f186aa636a4872bf737af82703ef1e16293e
-
SHA256
bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd
-
SHA512
54e0d0c96aa42213c5e0b08f920eeba67cacdbb1f4bbfb9da982abb9c7a68f4d48b1a5b319a8dcc727a36e5cd567c0ea2e866c4e022b2bc837293e07c9ffa206
-
SSDEEP
384:N6wayA+1mwnA353BXR+oGfPmfm4MlcTGXdhjwroyY2rebV5O6KgxWb/83BXR+oG2:NpQNwC3BESe4Vqth+0V5vKlE3BEJwRrT
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 52 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Executes dropped EXE 59 IoCs
pid Process 564 backup.exe 432 backup.exe 1168 backup.exe 1788 backup.exe 1384 System Restore.exe 1932 backup.exe 1448 backup.exe 668 backup.exe 1580 backup.exe 1328 backup.exe 1336 backup.exe 1228 backup.exe 1660 backup.exe 1796 backup.exe 1552 backup.exe 1260 backup.exe 1592 backup.exe 2028 data.exe 528 backup.exe 332 backup.exe 1908 data.exe 1868 data.exe 1788 update.exe 1396 backup.exe 1780 backup.exe 1172 backup.exe 1248 backup.exe 1340 backup.exe 1328 backup.exe 300 backup.exe 1092 backup.exe 956 backup.exe 836 backup.exe 1100 backup.exe 1624 backup.exe 1064 backup.exe 1732 backup.exe 1604 backup.exe 1792 backup.exe 1996 backup.exe 292 backup.exe 520 update.exe 1008 backup.exe 1908 backup.exe 1940 backup.exe 1384 backup.exe 344 backup.exe 1808 backup.exe 1408 backup.exe 432 backup.exe 1316 backup.exe 1980 backup.exe 1368 backup.exe 1560 update.exe 1828 update.exe 1832 update.exe 1968 backup.exe 1760 backup.exe 1540 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 668 backup.exe 668 backup.exe 1580 backup.exe 1580 backup.exe 668 backup.exe 668 backup.exe 1336 backup.exe 1336 backup.exe 1228 backup.exe 1228 backup.exe 1336 backup.exe 1336 backup.exe 1796 backup.exe 1796 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1552 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1788 update.exe 1788 update.exe 1788 update.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1592 backup.exe 1796 backup.exe 1592 backup.exe 668 backup.exe 1592 backup.exe 668 backup.exe 1552 backup.exe 1552 backup.exe 1336 backup.exe 1336 backup.exe 1796 backup.exe 668 backup.exe 1336 backup.exe -
Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Java\update.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe -
Suspicious use of SetWindowsHookEx 59 IoCs
pid Process 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 564 backup.exe 432 backup.exe 1168 backup.exe 1788 backup.exe 1384 System Restore.exe 1932 backup.exe 1448 backup.exe 668 backup.exe 1580 backup.exe 1328 backup.exe 1336 backup.exe 1228 backup.exe 1660 backup.exe 1796 backup.exe 1552 backup.exe 1260 backup.exe 1592 backup.exe 2028 data.exe 528 backup.exe 332 backup.exe 1908 data.exe 1868 data.exe 1788 update.exe 1396 backup.exe 1780 backup.exe 1172 backup.exe 1340 backup.exe 1092 backup.exe 1328 backup.exe 1248 backup.exe 300 backup.exe 836 backup.exe 1064 backup.exe 1624 backup.exe 956 backup.exe 1100 backup.exe 1604 backup.exe 1996 backup.exe 1792 backup.exe 292 backup.exe 1940 backup.exe 344 backup.exe 1008 backup.exe 1408 backup.exe 1808 backup.exe 520 update.exe 1384 backup.exe 1316 backup.exe 432 backup.exe 1868 backup.exe 1908 backup.exe 1980 backup.exe 1560 update.exe 1368 backup.exe 1760 backup.exe 1832 update.exe 1828 update.exe 1968 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1324 wrote to memory of 564 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 28 PID 1324 wrote to memory of 564 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 28 PID 1324 wrote to memory of 564 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 28 PID 1324 wrote to memory of 564 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 28 PID 1324 wrote to memory of 432 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 29 PID 1324 wrote to memory of 432 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 29 PID 1324 wrote to memory of 432 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 29 PID 1324 wrote to memory of 432 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 29 PID 1324 wrote to memory of 1168 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 30 PID 1324 wrote to memory of 1168 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 30 PID 1324 wrote to memory of 1168 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 30 PID 1324 wrote to memory of 1168 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 30 PID 1324 wrote to memory of 1788 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 31 PID 1324 wrote to memory of 1788 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 31 PID 1324 wrote to memory of 1788 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 31 PID 1324 wrote to memory of 1788 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 31 PID 1324 wrote to memory of 1384 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 32 PID 1324 wrote to memory of 1384 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 32 PID 1324 wrote to memory of 1384 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 32 PID 1324 wrote to memory of 1384 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 32 PID 1324 wrote to memory of 1932 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 33 PID 1324 wrote to memory of 1932 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 33 PID 1324 wrote to memory of 1932 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 33 PID 1324 wrote to memory of 1932 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 33 PID 1324 wrote to memory of 1448 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 34 PID 1324 wrote to memory of 1448 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 34 PID 1324 wrote to memory of 1448 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 34 PID 1324 wrote to memory of 1448 1324 bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe 34 PID 564 wrote to memory of 668 564 backup.exe 35 PID 564 wrote to memory of 668 564 backup.exe 35 PID 564 wrote to memory of 668 564 backup.exe 35 PID 564 wrote to memory of 668 564 backup.exe 35 PID 668 wrote to memory of 1580 668 backup.exe 36 PID 668 wrote to memory of 1580 668 backup.exe 36 PID 668 wrote to memory of 1580 668 backup.exe 36 PID 668 wrote to memory of 1580 668 backup.exe 36 PID 1580 wrote to memory of 1328 1580 backup.exe 37 PID 1580 wrote to memory of 1328 1580 backup.exe 37 PID 1580 wrote to memory of 1328 1580 backup.exe 37 PID 1580 wrote to memory of 1328 1580 backup.exe 37 PID 668 wrote to memory of 1336 668 backup.exe 38 PID 668 wrote to memory of 1336 668 backup.exe 38 PID 668 wrote to memory of 1336 668 backup.exe 38 PID 668 wrote to memory of 1336 668 backup.exe 38 PID 1336 wrote to memory of 1228 1336 backup.exe 39 PID 1336 wrote to memory of 1228 1336 backup.exe 39 PID 1336 wrote to memory of 1228 1336 backup.exe 39 PID 1336 wrote to memory of 1228 1336 backup.exe 39 PID 1228 wrote to memory of 1660 1228 backup.exe 40 PID 1228 wrote to memory of 1660 1228 backup.exe 40 PID 1228 wrote to memory of 1660 1228 backup.exe 40 PID 1228 wrote to memory of 1660 1228 backup.exe 40 PID 1336 wrote to memory of 1796 1336 backup.exe 41 PID 1336 wrote to memory of 1796 1336 backup.exe 41 PID 1336 wrote to memory of 1796 1336 backup.exe 41 PID 1336 wrote to memory of 1796 1336 backup.exe 41 PID 1796 wrote to memory of 1552 1796 backup.exe 42 PID 1796 wrote to memory of 1552 1796 backup.exe 42 PID 1796 wrote to memory of 1552 1796 backup.exe 42 PID 1796 wrote to memory of 1552 1796 backup.exe 42 PID 1552 wrote to memory of 1260 1552 backup.exe 43 PID 1552 wrote to memory of 1260 1552 backup.exe 43 PID 1552 wrote to memory of 1260 1552 backup.exe 43 PID 1552 wrote to memory of 1260 1552 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe"C:\Users\Admin\AppData\Local\Temp\bdaa3c73726c99a19a31848a2af3aa01c2756e2c51ada277a4add8daa167e9cd.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\2965580551\backup.exeC:\Users\Admin\AppData\Local\Temp\2965580551\backup.exe C:\Users\Admin\AppData\Local\Temp\2965580551\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:564 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:668 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1336 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1228 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1660
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1796 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:332
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1172
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1340
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:836
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:344
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵PID:300
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1968
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Executes dropped EXE
PID:1540
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1328 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:432
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:776
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1100 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1008
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1312
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:300
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:956 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1940
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:292 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1316
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1960
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1248 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1808
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1368
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1580
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1064 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1760
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:952
-
-
-
C:\Program Files\Java\update.exe"C:\Program Files\Java\update.exe" C:\Program Files\Java\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1832
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:332
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1092 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408 -
C:\Program Files (x86)\Adobe\Reader 9.0\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1560
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1572
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1624 -
C:\Users\Admin\update.exeC:\Users\Admin\update.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520 -
C:\Users\Admin\Contacts\update.exeC:\Users\Admin\Contacts\update.exe C:\Users\Admin\Contacts\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1780
-
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1732 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1992
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:432
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1788
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1932
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD55c6d094a44624d0168c0ace90b0fdf0a
SHA18be40b94ae30c6b7f3d7943721d6cdb6938d6224
SHA256fde812d2be4430100378a886d20cf23b6e986d34183e1f5dd901699cd1b9c4da
SHA5121e2e7b354b22b8353d57ef4c6be443e9e607f8d741128f114d8e091ef5a9bb75e9401a38c067cf508be0a309a4a81fa7b9f7e6df2b34af75a442eeade6433e3a
-
Filesize
72KB
MD51ee9d07484c6a991990358978ef8cacc
SHA1e6929ce23030b87eb1e2d30a92ac8de2a4a386b5
SHA2564d323b8eab2abdae5f9c47b81f57493d7510ac991896563e8bab0e6b382e3d2b
SHA512957d9585a60aba834bd1a729e2f03045dd0151572b86635451c39f9e393a7b8c23ef2ac78888101853474e0b6a374dc5dddc825b33900fb5896aaf633274e2e4
-
Filesize
72KB
MD51ee9d07484c6a991990358978ef8cacc
SHA1e6929ce23030b87eb1e2d30a92ac8de2a4a386b5
SHA2564d323b8eab2abdae5f9c47b81f57493d7510ac991896563e8bab0e6b382e3d2b
SHA512957d9585a60aba834bd1a729e2f03045dd0151572b86635451c39f9e393a7b8c23ef2ac78888101853474e0b6a374dc5dddc825b33900fb5896aaf633274e2e4
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD5992305bd808bd21d7951f9a98de29d49
SHA12f148abbaa9b6edd7a5beb7f10f5702dfff799a7
SHA2565dd821924750016b66ce968a17beae56fd66a72981686c86d3fb5a4c859ef23d
SHA512cb7f1b8cf143305afaee0bd9a1747834484d8b71a76f3fd9b7928b2547a6b0862cc8431e79d072440ea118c27d7d54331bbc474e851cb0a700d89b7b7a9ce4f1
-
Filesize
72KB
MD5992305bd808bd21d7951f9a98de29d49
SHA12f148abbaa9b6edd7a5beb7f10f5702dfff799a7
SHA2565dd821924750016b66ce968a17beae56fd66a72981686c86d3fb5a4c859ef23d
SHA512cb7f1b8cf143305afaee0bd9a1747834484d8b71a76f3fd9b7928b2547a6b0862cc8431e79d072440ea118c27d7d54331bbc474e851cb0a700d89b7b7a9ce4f1
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5f5fd5a7b591d9353f6188a34d538dadf
SHA14f1d752f05e7ccbf4ef08e56bed67a03d6ae6bbe
SHA25626ec8d8dae0a3518f1b410800e5399d723b87e7a833708fe969e46eca9b1bf68
SHA51201fb25c84b044501cc0f6f1d2ac3ecf4bf1f627d2e3078dc9dc30f9e9e90e2fb2974ebb01702685cefd6814c3c0a86b60ff9454b890927686cca774c844f2e31
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD58adde969158899f08044222bee65c47b
SHA1334f46d46b5bd51766a5169e86ca70d5417078f0
SHA2562d503ebf943db7f2bbae1de702759289d3f57590a8418b2a8fc1eb4b8b5845a3
SHA512de9bc74ead6b8f37b0b43d51bc77d87bfeae8a6ba8de28d439ff553ab73c2b92c0ff24fb559bcbf8d7001f522ae0a710a6de23328d42d743738e77336f99850c
-
Filesize
72KB
MD58adde969158899f08044222bee65c47b
SHA1334f46d46b5bd51766a5169e86ca70d5417078f0
SHA2562d503ebf943db7f2bbae1de702759289d3f57590a8418b2a8fc1eb4b8b5845a3
SHA512de9bc74ead6b8f37b0b43d51bc77d87bfeae8a6ba8de28d439ff553ab73c2b92c0ff24fb559bcbf8d7001f522ae0a710a6de23328d42d743738e77336f99850c
-
Filesize
72KB
MD55c6d094a44624d0168c0ace90b0fdf0a
SHA18be40b94ae30c6b7f3d7943721d6cdb6938d6224
SHA256fde812d2be4430100378a886d20cf23b6e986d34183e1f5dd901699cd1b9c4da
SHA5121e2e7b354b22b8353d57ef4c6be443e9e607f8d741128f114d8e091ef5a9bb75e9401a38c067cf508be0a309a4a81fa7b9f7e6df2b34af75a442eeade6433e3a
-
Filesize
72KB
MD55c6d094a44624d0168c0ace90b0fdf0a
SHA18be40b94ae30c6b7f3d7943721d6cdb6938d6224
SHA256fde812d2be4430100378a886d20cf23b6e986d34183e1f5dd901699cd1b9c4da
SHA5121e2e7b354b22b8353d57ef4c6be443e9e607f8d741128f114d8e091ef5a9bb75e9401a38c067cf508be0a309a4a81fa7b9f7e6df2b34af75a442eeade6433e3a
-
Filesize
72KB
MD51ee9d07484c6a991990358978ef8cacc
SHA1e6929ce23030b87eb1e2d30a92ac8de2a4a386b5
SHA2564d323b8eab2abdae5f9c47b81f57493d7510ac991896563e8bab0e6b382e3d2b
SHA512957d9585a60aba834bd1a729e2f03045dd0151572b86635451c39f9e393a7b8c23ef2ac78888101853474e0b6a374dc5dddc825b33900fb5896aaf633274e2e4
-
Filesize
72KB
MD51ee9d07484c6a991990358978ef8cacc
SHA1e6929ce23030b87eb1e2d30a92ac8de2a4a386b5
SHA2564d323b8eab2abdae5f9c47b81f57493d7510ac991896563e8bab0e6b382e3d2b
SHA512957d9585a60aba834bd1a729e2f03045dd0151572b86635451c39f9e393a7b8c23ef2ac78888101853474e0b6a374dc5dddc825b33900fb5896aaf633274e2e4
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD5e5a0874263278724470bf95d5eb2458e
SHA1393cfc24b8705c3975032c56e3b564232cbfa727
SHA256156cdd97c2e4f2144b0d4558954432edb47711facdd0fadfacc6e9513a637033
SHA512c49744c9788ea7baf299144bf012283f332ddf896e781248ad56dca10687d3c1622b03a2a9665a22d8831cdb43f78150cbc1266a419d60ba358c8382ae97c6d6
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD574829ac4bbc46bdc90af00825787088b
SHA16c2f584a6e1faea134fb279729c757eb111e0cd7
SHA2564a1ff7693b9efc7a75a5919678b3e5bb9b42244ee1179b593bc200f55c8ec42b
SHA512650dbd9aad4d0d6958a331ab7accc75250aac109446cc45ee2bb5632edf2e168b19200e96ca1abe5f8584fb726f31531afec7f487c0cd72968afc401860c6cc3
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD5d9a92e1497aa967f3098726e37ea7401
SHA101243719df2eb36098cb430d5a61ece169168c91
SHA2565c7a6eaf57d41b48fe2793c4fa61c18097a23bf645f0c0f3db4b0cb1d4685289
SHA5128f8692c520f003047456c7dd2ae853f3d5bd109f0a8b79f0aae5d0c98e4f9f1191fa4ac3bc1828a297f0b2ef1964045f42792b73251a09336080b65c4ebc26c9
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD58e43d340ca916039db2c0401a3edcef3
SHA1760b4e20488371f03bc6f904012c28639d9ab55f
SHA2568528e7abac4dc4569992df8c81d27f15d63f2c0ae30859f387a113cf8123c75c
SHA51257adc52902f834893ebf7172b02a25433d756ac5beca0420c63ead4be407cb7f4c370d3fb92a934bd7248fb78ab43963b3ab149fcae383b2a7e3ff6da2cbc63b
-
Filesize
72KB
MD5992305bd808bd21d7951f9a98de29d49
SHA12f148abbaa9b6edd7a5beb7f10f5702dfff799a7
SHA2565dd821924750016b66ce968a17beae56fd66a72981686c86d3fb5a4c859ef23d
SHA512cb7f1b8cf143305afaee0bd9a1747834484d8b71a76f3fd9b7928b2547a6b0862cc8431e79d072440ea118c27d7d54331bbc474e851cb0a700d89b7b7a9ce4f1
-
Filesize
72KB
MD5992305bd808bd21d7951f9a98de29d49
SHA12f148abbaa9b6edd7a5beb7f10f5702dfff799a7
SHA2565dd821924750016b66ce968a17beae56fd66a72981686c86d3fb5a4c859ef23d
SHA512cb7f1b8cf143305afaee0bd9a1747834484d8b71a76f3fd9b7928b2547a6b0862cc8431e79d072440ea118c27d7d54331bbc474e851cb0a700d89b7b7a9ce4f1
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\System Restore.exe
Filesize72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5f5fd5a7b591d9353f6188a34d538dadf
SHA14f1d752f05e7ccbf4ef08e56bed67a03d6ae6bbe
SHA25626ec8d8dae0a3518f1b410800e5399d723b87e7a833708fe969e46eca9b1bf68
SHA51201fb25c84b044501cc0f6f1d2ac3ecf4bf1f627d2e3078dc9dc30f9e9e90e2fb2974ebb01702685cefd6814c3c0a86b60ff9454b890927686cca774c844f2e31
-
Filesize
72KB
MD5f5fd5a7b591d9353f6188a34d538dadf
SHA14f1d752f05e7ccbf4ef08e56bed67a03d6ae6bbe
SHA25626ec8d8dae0a3518f1b410800e5399d723b87e7a833708fe969e46eca9b1bf68
SHA51201fb25c84b044501cc0f6f1d2ac3ecf4bf1f627d2e3078dc9dc30f9e9e90e2fb2974ebb01702685cefd6814c3c0a86b60ff9454b890927686cca774c844f2e31
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962
-
Filesize
72KB
MD5e1c6c3378db2989da83bfd285c8f9fe5
SHA1c021eaa34b94012a24826147cdbfcf3537536ecd
SHA2566ac9fe25834d6e1ceea8e04c5688cfd307761fc0d19ad7b80c6c2e38208515a8
SHA512e94f472f1c59ea6c67df5e163c1b18882f4d66ddd61843302784fad87a8d991323d7744b6c7bd931bb97d94665db783e8cad7716cd4300f13a8bef1c8d17d962