Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
132s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:48
Static task
static1
Behavioral task
behavioral1
Sample
faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe
Resource
win10v2004-20220812-en
General
-
Target
faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe
-
Size
72KB
-
MD5
f3845ade037db07b19e1d99b59cef686
-
SHA1
7cf58f1185f9643877952d99a49140abe7be10f8
-
SHA256
faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19
-
SHA512
adaac92e3d96807be288f2207ae0651036f8d6ccf430860db8fcf0d7779cb7ce1664ea316fb274156f8b1463d91b1a52c9c2644b5d5b08d228a06c886f42899e
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2x:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrt
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1172 backup.exe 904 backup.exe 1360 backup.exe 568 backup.exe 1504 backup.exe 2020 update.exe 1492 backup.exe 1632 System Restore.exe 1116 backup.exe 552 backup.exe 1728 backup.exe 804 backup.exe 1648 backup.exe 1164 backup.exe 1736 backup.exe 1340 backup.exe 1600 backup.exe 1768 backup.exe 572 backup.exe 776 backup.exe 1868 backup.exe 1036 backup.exe 1872 backup.exe 684 backup.exe 1092 backup.exe 844 backup.exe 1580 backup.exe 1624 backup.exe 1748 backup.exe 392 backup.exe 1892 backup.exe 1812 backup.exe 552 backup.exe 1344 backup.exe 1792 backup.exe 624 backup.exe 836 backup.exe 1756 backup.exe 384 backup.exe 1488 backup.exe 956 backup.exe 1404 backup.exe 2000 backup.exe 1880 backup.exe 576 backup.exe 572 backup.exe 2028 update.exe 588 update.exe 1200 System Restore.exe 1504 backup.exe 1400 backup.exe 108 backup.exe 1668 backup.exe 1876 backup.exe 840 backup.exe 1744 data.exe 900 backup.exe 896 backup.exe 1760 backup.exe 1612 backup.exe 2036 System Restore.exe 1768 backup.exe 776 backup.exe 1352 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 2020 update.exe 2020 update.exe 2020 update.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1492 backup.exe 1492 backup.exe 1116 backup.exe 1116 backup.exe 1492 backup.exe 1492 backup.exe 1728 backup.exe 1728 backup.exe 804 backup.exe 804 backup.exe 1728 backup.exe 1728 backup.exe 1164 backup.exe 1164 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1736 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1600 backup.exe 1736 backup.exe 1164 backup.exe 1736 backup.exe 1164 backup.exe 1600 backup.exe 1600 backup.exe 1492 backup.exe 1492 backup.exe 1728 backup.exe 1728 backup.exe 1600 backup.exe 1164 backup.exe 1600 backup.exe 1164 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\System Restore.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe update.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\backup.exe update.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\CrashReports\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\update.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe backup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\update.exe backup.exe File opened for modification C:\Windows\addins\backup.exe update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 1172 backup.exe 904 backup.exe 1360 backup.exe 568 backup.exe 1504 backup.exe 2020 update.exe 1492 backup.exe 1632 System Restore.exe 1116 backup.exe 552 backup.exe 1728 backup.exe 804 backup.exe 1648 backup.exe 1164 backup.exe 1736 backup.exe 1340 backup.exe 1600 backup.exe 1768 backup.exe 572 backup.exe 776 backup.exe 1868 backup.exe 1036 backup.exe 1872 backup.exe 684 backup.exe 1092 backup.exe 844 backup.exe 1580 backup.exe 1748 backup.exe 1624 backup.exe 392 backup.exe 1892 backup.exe 552 backup.exe 1812 backup.exe 1344 backup.exe 624 backup.exe 1488 backup.exe 1792 backup.exe 1756 backup.exe 384 backup.exe 836 backup.exe 956 backup.exe 2000 backup.exe 1404 backup.exe 576 backup.exe 1880 backup.exe 572 backup.exe 588 update.exe 1200 System Restore.exe 2028 update.exe 1504 backup.exe 1400 backup.exe 1876 backup.exe 108 backup.exe 1668 backup.exe 840 backup.exe 896 backup.exe 1760 backup.exe 2036 System Restore.exe 1612 backup.exe 1744 data.exe 900 backup.exe 1768 backup.exe 832 update.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 1172 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 28 PID 1284 wrote to memory of 1172 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 28 PID 1284 wrote to memory of 1172 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 28 PID 1284 wrote to memory of 1172 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 28 PID 1284 wrote to memory of 904 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 29 PID 1284 wrote to memory of 904 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 29 PID 1284 wrote to memory of 904 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 29 PID 1284 wrote to memory of 904 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 29 PID 1284 wrote to memory of 1360 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 30 PID 1284 wrote to memory of 1360 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 30 PID 1284 wrote to memory of 1360 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 30 PID 1284 wrote to memory of 1360 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 30 PID 1284 wrote to memory of 568 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 31 PID 1284 wrote to memory of 568 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 31 PID 1284 wrote to memory of 568 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 31 PID 1284 wrote to memory of 568 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 31 PID 1284 wrote to memory of 1504 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 32 PID 1284 wrote to memory of 1504 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 32 PID 1284 wrote to memory of 1504 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 32 PID 1284 wrote to memory of 1504 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 32 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1284 wrote to memory of 2020 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 33 PID 1172 wrote to memory of 1492 1172 backup.exe 34 PID 1172 wrote to memory of 1492 1172 backup.exe 34 PID 1172 wrote to memory of 1492 1172 backup.exe 34 PID 1172 wrote to memory of 1492 1172 backup.exe 34 PID 1284 wrote to memory of 1632 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 35 PID 1284 wrote to memory of 1632 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 35 PID 1284 wrote to memory of 1632 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 35 PID 1284 wrote to memory of 1632 1284 faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe 35 PID 1492 wrote to memory of 1116 1492 backup.exe 36 PID 1492 wrote to memory of 1116 1492 backup.exe 36 PID 1492 wrote to memory of 1116 1492 backup.exe 36 PID 1492 wrote to memory of 1116 1492 backup.exe 36 PID 1116 wrote to memory of 552 1116 backup.exe 37 PID 1116 wrote to memory of 552 1116 backup.exe 37 PID 1116 wrote to memory of 552 1116 backup.exe 37 PID 1116 wrote to memory of 552 1116 backup.exe 37 PID 1492 wrote to memory of 1728 1492 backup.exe 38 PID 1492 wrote to memory of 1728 1492 backup.exe 38 PID 1492 wrote to memory of 1728 1492 backup.exe 38 PID 1492 wrote to memory of 1728 1492 backup.exe 38 PID 1728 wrote to memory of 804 1728 backup.exe 39 PID 1728 wrote to memory of 804 1728 backup.exe 39 PID 1728 wrote to memory of 804 1728 backup.exe 39 PID 1728 wrote to memory of 804 1728 backup.exe 39 PID 804 wrote to memory of 1648 804 backup.exe 40 PID 804 wrote to memory of 1648 804 backup.exe 40 PID 804 wrote to memory of 1648 804 backup.exe 40 PID 804 wrote to memory of 1648 804 backup.exe 40 PID 1728 wrote to memory of 1164 1728 backup.exe 41 PID 1728 wrote to memory of 1164 1728 backup.exe 41 PID 1728 wrote to memory of 1164 1728 backup.exe 41 PID 1728 wrote to memory of 1164 1728 backup.exe 41 PID 1164 wrote to memory of 1736 1164 backup.exe 42 PID 1164 wrote to memory of 1736 1164 backup.exe 42 PID 1164 wrote to memory of 1736 1164 backup.exe 42 PID 1164 wrote to memory of 1736 1164 backup.exe 42 PID 1736 wrote to memory of 1340 1736 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe"C:\Users\Admin\AppData\Local\Temp\faaaa1f7b75d5b39df17a8b726ffb4fa2ea7100158d7ca9200871140a908cc19.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\2963082363\backup.exeC:\Users\Admin\AppData\Local\Temp\2963082363\backup.exe C:\Users\Admin\AppData\Local\Temp\2963082363\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1172 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1492 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1340
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1600 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:572
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:776
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1036
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:684
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵PID:2016
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:844 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:956
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:896
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:776
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
PID:1980
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1812 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:836
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1880
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1768 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\update.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Disables RegEdit via registry modification
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:520
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1756
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵PID:1344
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵PID:1128
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:996 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵PID:900
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵PID:1400
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵PID:1624
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1580
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1892 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1756
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1504 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1612 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:576
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:868
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1764
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:1268
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:428
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1500
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵PID:1700
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵PID:848
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:392 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:384
-
-
C:\Program Files\DVD Maker\en-US\update.exe"C:\Program Files\DVD Maker\en-US\update.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:588
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1132
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1672
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:832 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵PID:1488
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Program Files\Google\Chrome\Application\System Restore.exe"C:\Program Files\Google\Chrome\Application\System Restore.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1200 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:840 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
PID:1352
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
PID:1548
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2020
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\swiftshader\9⤵PID:572
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:836
-
-
-
-
-
C:\Program Files\Internet Explorer\update.exe"C:\Program Files\Internet Explorer\update.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1576 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1008
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵PID:764
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Drops file in Program Files directory
- System policy modification
PID:1556 -
C:\Program Files\Java\jdk1.7.0_80\backup.exe"C:\Program Files\Java\jdk1.7.0_80\backup.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵PID:576
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:1572
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1408
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1488 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1404 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:572
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:108 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1036
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1520
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1496 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵PID:1892
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵PID:2036
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\update.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1084 -
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\8⤵PID:1492
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\8⤵PID:1520
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:1900 -
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\8⤵PID:552
-
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:808 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1760
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1424
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1628 -
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:668
-
-
C:\Program Files (x86)\Google\Policies\System Restore.exe"C:\Program Files (x86)\Google\Policies\System Restore.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:1356
-
-
-
C:\Program Files (x86)\Internet Explorer\System Restore.exe"C:\Program Files (x86)\Internet Explorer\System Restore.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:2160
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1344 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:624 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:576
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1400
-
-
C:\Users\Admin\Downloads\data.exeC:\Users\Admin\Downloads\data.exe C:\Users\Admin\Downloads\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1744
-
-
C:\Users\Admin\Favorites\update.exeC:\Users\Admin\Favorites\update.exe C:\Users\Admin\Favorites\6⤵PID:1916
-
-
C:\Users\Admin\Links\data.exeC:\Users\Admin\Links\data.exe C:\Users\Admin\Links\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:744
-
-
C:\Users\Admin\Music\update.exeC:\Users\Admin\Music\update.exe C:\Users\Admin\Music\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:532
-
-
C:\Users\Admin\Pictures\backup.exeC:\Users\Admin\Pictures\backup.exe C:\Users\Admin\Pictures\6⤵PID:896
-
-
C:\Users\Admin\Saved Games\backup.exe"C:\Users\Admin\Saved Games\backup.exe" C:\Users\Admin\Saved Games\6⤵PID:1740
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵
- Modifies visibility of file extensions in Explorer
PID:1552 -
C:\Users\Public\Documents\backup.exeC:\Users\Public\Documents\backup.exe C:\Users\Public\Documents\6⤵PID:1872
-
-
C:\Users\Public\Downloads\System Restore.exe"C:\Users\Public\Downloads\System Restore.exe" C:\Users\Public\Downloads\6⤵PID:2028
-
-
-
-
C:\Windows\update.exeC:\Windows\update.exe C:\Windows\4⤵
- Drops file in Windows directory
PID:1112 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵PID:1540
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:268
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:904
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1360
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1504
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\update.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD595ca1bb15071529c4a5c113e74773ac6
SHA1b49d07b6adb7a558c446d71fc6cf523ac83fea2b
SHA25607784fbb5281ae87433d4e2781b43575edd5180f72b474a1ca0e4cf398c2ad22
SHA512d3047b3adf1297d21d7c9af8bf962848cf20cfb6e553ead2c2fd1406f95f75873e6d653ef3ad9eec85a54d18bfd1e806564042367146a62fd410cea4c4e76268
-
Filesize
72KB
MD57f7c5d7ee93a92ed7ba300a1ec538873
SHA1ba44e76d1d5734a4fe041ff413e5759c038e6207
SHA25618c778be8c5dafd89a9d8fe5c3cde472510514f645668f7b8103af025a0c548e
SHA51251d2ea02e2d63823a89b6bcba60f5d6e516eec066013b664e86607cd3ecaaade84f0d69cc5274f4c2cb7de37d81c71c0f972707f626b050497259f02a37bd22e
-
Filesize
72KB
MD57f7c5d7ee93a92ed7ba300a1ec538873
SHA1ba44e76d1d5734a4fe041ff413e5759c038e6207
SHA25618c778be8c5dafd89a9d8fe5c3cde472510514f645668f7b8103af025a0c548e
SHA51251d2ea02e2d63823a89b6bcba60f5d6e516eec066013b664e86607cd3ecaaade84f0d69cc5274f4c2cb7de37d81c71c0f972707f626b050497259f02a37bd22e
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD574ff381f4fe334600038b383890ee835
SHA14bd5d04956c24b5dee8a53d219951d1a1a0d4578
SHA256915897d3c2ac64cd3d585350f7ccbcffdcc00ed3cadb25bbc577389b5b7e0dae
SHA51269af6dbe795a7ecc13402bb984be838602ce36fadd54bf70be96841f5ca2903f818cdb45d074364363971c12f782f1744142110240b74f1393cfabc28453dcae
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5f30ab083295b1ef9db231e0e4a024487
SHA16978a25fc6214b7f0e26147bd562d6b1116e6e64
SHA256cc24906bf28b0cb42426e18cfb448d4dbde68d41c961ee2d04ba832084a8fc1c
SHA51245dfcd4e1db9ba69f4b6ac34eacd0862b182cf1fef1c8c73178313d7b53f07fdfdf18d6edf1947f772141c5a52b4ae51a63294c12871d802277ee076d3b82316
-
Filesize
72KB
MD5f30ab083295b1ef9db231e0e4a024487
SHA16978a25fc6214b7f0e26147bd562d6b1116e6e64
SHA256cc24906bf28b0cb42426e18cfb448d4dbde68d41c961ee2d04ba832084a8fc1c
SHA51245dfcd4e1db9ba69f4b6ac34eacd0862b182cf1fef1c8c73178313d7b53f07fdfdf18d6edf1947f772141c5a52b4ae51a63294c12871d802277ee076d3b82316
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD56a9304062e43fe861aed7c2e7818bfa8
SHA1c64d4761d852460a8ed2d2b7276191801c7940fa
SHA256158d6a6a9355eab6a1f85b2d5d6af6594eddb0a680c884786d00c7ec269e2d8c
SHA5128806f5392d5e334e9b21ee7646001d71ea99995767fbd038ab8d8ff708542ff31cfa6853068240df6d9bfb90e189be80474147dd9bc57b075c7b157150f663a8
-
Filesize
72KB
MD56a9304062e43fe861aed7c2e7818bfa8
SHA1c64d4761d852460a8ed2d2b7276191801c7940fa
SHA256158d6a6a9355eab6a1f85b2d5d6af6594eddb0a680c884786d00c7ec269e2d8c
SHA5128806f5392d5e334e9b21ee7646001d71ea99995767fbd038ab8d8ff708542ff31cfa6853068240df6d9bfb90e189be80474147dd9bc57b075c7b157150f663a8
-
Filesize
72KB
MD595ca1bb15071529c4a5c113e74773ac6
SHA1b49d07b6adb7a558c446d71fc6cf523ac83fea2b
SHA25607784fbb5281ae87433d4e2781b43575edd5180f72b474a1ca0e4cf398c2ad22
SHA512d3047b3adf1297d21d7c9af8bf962848cf20cfb6e553ead2c2fd1406f95f75873e6d653ef3ad9eec85a54d18bfd1e806564042367146a62fd410cea4c4e76268
-
Filesize
72KB
MD595ca1bb15071529c4a5c113e74773ac6
SHA1b49d07b6adb7a558c446d71fc6cf523ac83fea2b
SHA25607784fbb5281ae87433d4e2781b43575edd5180f72b474a1ca0e4cf398c2ad22
SHA512d3047b3adf1297d21d7c9af8bf962848cf20cfb6e553ead2c2fd1406f95f75873e6d653ef3ad9eec85a54d18bfd1e806564042367146a62fd410cea4c4e76268
-
Filesize
72KB
MD57f7c5d7ee93a92ed7ba300a1ec538873
SHA1ba44e76d1d5734a4fe041ff413e5759c038e6207
SHA25618c778be8c5dafd89a9d8fe5c3cde472510514f645668f7b8103af025a0c548e
SHA51251d2ea02e2d63823a89b6bcba60f5d6e516eec066013b664e86607cd3ecaaade84f0d69cc5274f4c2cb7de37d81c71c0f972707f626b050497259f02a37bd22e
-
Filesize
72KB
MD57f7c5d7ee93a92ed7ba300a1ec538873
SHA1ba44e76d1d5734a4fe041ff413e5759c038e6207
SHA25618c778be8c5dafd89a9d8fe5c3cde472510514f645668f7b8103af025a0c548e
SHA51251d2ea02e2d63823a89b6bcba60f5d6e516eec066013b664e86607cd3ecaaade84f0d69cc5274f4c2cb7de37d81c71c0f972707f626b050497259f02a37bd22e
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD5b164c295d7a5b5e26667e6129f4dc45d
SHA15c6d6b9d42b7c43c377790259b37a45b127b1072
SHA2568a5216b2ff96e009f2670aed17e7a44e55f72fcd4436a64eec71b3f8a79820db
SHA512bc2cf0a169284ed7bd81c400db838859382e84b2c0f6d9754ef31d6b02488d44374b939de4457a97e5068e25da9a078cd62d719aa04f05b7d954566ca63b6b41
-
Filesize
72KB
MD574ff381f4fe334600038b383890ee835
SHA14bd5d04956c24b5dee8a53d219951d1a1a0d4578
SHA256915897d3c2ac64cd3d585350f7ccbcffdcc00ed3cadb25bbc577389b5b7e0dae
SHA51269af6dbe795a7ecc13402bb984be838602ce36fadd54bf70be96841f5ca2903f818cdb45d074364363971c12f782f1744142110240b74f1393cfabc28453dcae
-
Filesize
72KB
MD574ff381f4fe334600038b383890ee835
SHA14bd5d04956c24b5dee8a53d219951d1a1a0d4578
SHA256915897d3c2ac64cd3d585350f7ccbcffdcc00ed3cadb25bbc577389b5b7e0dae
SHA51269af6dbe795a7ecc13402bb984be838602ce36fadd54bf70be96841f5ca2903f818cdb45d074364363971c12f782f1744142110240b74f1393cfabc28453dcae
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD56da6e7780291976e31181ee4b4ebcb40
SHA1f30114cd33e9e9eaedcfca81ed3706b54989341f
SHA256306a7ce69ca48e16db4a2146a1c88d9f504e6ce11df961ba263f0e389e3a1470
SHA51264fa029682c3178c345b1381bcf17b0265f2d1ab2c6c6d8cc0b05c687933c558faf09f116581206d161231f79a1c07dc1a9230b4a5dd3cb2f593ad4dc8389a8d
-
Filesize
72KB
MD52f556a3352e951d3d3122048259bd0f6
SHA1c18ba24c7d9ac9a27e4c36b0dcf7119740372fd3
SHA2565d0412e0a7d6038ae4b632b1a5be7ce9447416747d3ae2b2acaaeac9393ff816
SHA5129546f0bded2fa11adae6c1bb4ca1f06bc141be818a30ed2c0ab51914ceb7b2b2124c800228037e2de32e69c4baa3dc588b979085bf80bc0f8ec46787e6789187
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5c13ea1ee6ae548e93f30c0c39c1154b7
SHA18338d2b13cb5c3c5f309710fede87af4e07d32be
SHA2560b22f692258c127b0f9dd2da57a346b5d173cc49b59297bdce75bd2184846dba
SHA5127d791971fb8828b34f42b9c849d15f8f4fe919ad58c34844f1e3fb4a1531047b59dbf986db6da4e3e46f6e661091c01d9a0a4bfe91de701ad2a68e939caea0ca
-
Filesize
72KB
MD5f30ab083295b1ef9db231e0e4a024487
SHA16978a25fc6214b7f0e26147bd562d6b1116e6e64
SHA256cc24906bf28b0cb42426e18cfb448d4dbde68d41c961ee2d04ba832084a8fc1c
SHA51245dfcd4e1db9ba69f4b6ac34eacd0862b182cf1fef1c8c73178313d7b53f07fdfdf18d6edf1947f772141c5a52b4ae51a63294c12871d802277ee076d3b82316
-
Filesize
72KB
MD5f30ab083295b1ef9db231e0e4a024487
SHA16978a25fc6214b7f0e26147bd562d6b1116e6e64
SHA256cc24906bf28b0cb42426e18cfb448d4dbde68d41c961ee2d04ba832084a8fc1c
SHA51245dfcd4e1db9ba69f4b6ac34eacd0862b182cf1fef1c8c73178313d7b53f07fdfdf18d6edf1947f772141c5a52b4ae51a63294c12871d802277ee076d3b82316
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD5e852f592d896a42a05b0d73a6163e7e4
SHA1b40029042775cbc1dd841036fa2aa5ce86bf62f6
SHA256976b2fc700635ef3c45dd6a5cfc1806d761e037078c528db71434adece0da15c
SHA51278a8c55d70f7134ea37b73daaf2e337e903b54cf9773bf9c6e367b6679384e25b7697bff390bbf7cf672a22955e080229fb3a818e442c4d094ed426886020720
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08
-
Filesize
72KB
MD57f1a4e79b8ba4f66d3ec23579f767283
SHA1f04ed7732f55e349d96f8ff09ad2cea45db5a914
SHA256e51b853518c13a5cea2eb3a82d339480c140d047c5ef6ff8e085f9d64d54b0fe
SHA512433e0afea713b4f6a412c501c8c63735f40ec0089718b78a3db580f554d5ea04bc119e11ac8eb4780191524d361d15e39dc06a8142e0e6acbec5e134f26cfc08