Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
89s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:49
Static task
static1
Behavioral task
behavioral1
Sample
efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe
Resource
win10v2004-20220901-en
General
-
Target
efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe
-
Size
72KB
-
MD5
84806eea5990042d5ead6478d790bd45
-
SHA1
5dd74b448c75a2fb3e676481e9657282f3588c69
-
SHA256
efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a
-
SHA512
e65c63b7f1194b1858f6a7757f88d93cbf286ac868798fac7c834138e2ea664739ed45af23cdc554716bb45697d615f2cd71970071254e45ee0d944e9304a449
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2k:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrY
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 50 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 59 IoCs
pid Process 1712 backup.exe 872 System Restore.exe 1660 backup.exe 900 backup.exe 1452 backup.exe 1644 backup.exe 560 data.exe 1836 backup.exe 288 data.exe 648 backup.exe 1748 backup.exe 988 backup.exe 1964 backup.exe 1084 backup.exe 1892 backup.exe 2004 backup.exe 1156 backup.exe 1508 backup.exe 1612 backup.exe 468 backup.exe 1448 backup.exe 1408 backup.exe 1888 backup.exe 832 backup.exe 1028 data.exe 560 System Restore.exe 1656 backup.exe 1768 backup.exe 580 backup.exe 768 backup.exe 288 backup.exe 1984 backup.exe 112 System Restore.exe 928 backup.exe 2024 backup.exe 1972 backup.exe 1896 backup.exe 1412 backup.exe 1220 backup.exe 952 backup.exe 752 backup.exe 876 update.exe 688 backup.exe 1608 backup.exe 572 backup.exe 1596 backup.exe 520 update.exe 984 backup.exe 1136 backup.exe 1408 backup.exe 1928 System Restore.exe 1696 backup.exe 1028 backup.exe 1648 backup.exe 1032 backup.exe 544 backup.exe 648 backup.exe 288 backup.exe 1912 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1836 backup.exe 1836 backup.exe 288 data.exe 288 data.exe 1836 backup.exe 1836 backup.exe 1748 backup.exe 1748 backup.exe 988 backup.exe 988 backup.exe 1748 backup.exe 1748 backup.exe 1084 backup.exe 1084 backup.exe 1892 backup.exe 1892 backup.exe 1892 backup.exe 1892 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 1156 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe 580 backup.exe -
Drops file in Program Files directory 51 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\update.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe -
Suspicious use of SetWindowsHookEx 58 IoCs
pid Process 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 1712 backup.exe 872 System Restore.exe 1660 backup.exe 900 backup.exe 1452 backup.exe 1644 backup.exe 560 data.exe 1836 backup.exe 288 data.exe 648 backup.exe 1748 backup.exe 988 backup.exe 1964 backup.exe 1084 backup.exe 1892 backup.exe 2004 backup.exe 1156 backup.exe 1508 backup.exe 1612 backup.exe 468 backup.exe 1448 backup.exe 1408 backup.exe 1888 backup.exe 832 backup.exe 1028 data.exe 560 System Restore.exe 1656 backup.exe 1768 backup.exe 580 backup.exe 768 backup.exe 288 backup.exe 1984 backup.exe 112 System Restore.exe 928 backup.exe 2024 backup.exe 1972 backup.exe 1896 backup.exe 1412 backup.exe 1220 backup.exe 952 backup.exe 876 update.exe 688 backup.exe 1608 backup.exe 1596 backup.exe 520 update.exe 984 backup.exe 572 backup.exe 1136 backup.exe 1928 System Restore.exe 1408 backup.exe 1696 backup.exe 1028 backup.exe 1032 backup.exe 1648 backup.exe 544 backup.exe 288 backup.exe 648 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1440 wrote to memory of 1712 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 28 PID 1440 wrote to memory of 1712 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 28 PID 1440 wrote to memory of 1712 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 28 PID 1440 wrote to memory of 1712 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 28 PID 1440 wrote to memory of 872 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 29 PID 1440 wrote to memory of 872 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 29 PID 1440 wrote to memory of 872 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 29 PID 1440 wrote to memory of 872 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 29 PID 1440 wrote to memory of 1660 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 30 PID 1440 wrote to memory of 1660 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 30 PID 1440 wrote to memory of 1660 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 30 PID 1440 wrote to memory of 1660 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 30 PID 1440 wrote to memory of 900 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 31 PID 1440 wrote to memory of 900 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 31 PID 1440 wrote to memory of 900 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 31 PID 1440 wrote to memory of 900 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 31 PID 1440 wrote to memory of 1452 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 32 PID 1440 wrote to memory of 1452 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 32 PID 1440 wrote to memory of 1452 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 32 PID 1440 wrote to memory of 1452 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 32 PID 1440 wrote to memory of 1644 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 33 PID 1440 wrote to memory of 1644 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 33 PID 1440 wrote to memory of 1644 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 33 PID 1440 wrote to memory of 1644 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 33 PID 1440 wrote to memory of 560 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 34 PID 1440 wrote to memory of 560 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 34 PID 1440 wrote to memory of 560 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 34 PID 1440 wrote to memory of 560 1440 efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe 34 PID 1712 wrote to memory of 1836 1712 backup.exe 35 PID 1712 wrote to memory of 1836 1712 backup.exe 35 PID 1712 wrote to memory of 1836 1712 backup.exe 35 PID 1712 wrote to memory of 1836 1712 backup.exe 35 PID 1836 wrote to memory of 288 1836 backup.exe 36 PID 1836 wrote to memory of 288 1836 backup.exe 36 PID 1836 wrote to memory of 288 1836 backup.exe 36 PID 1836 wrote to memory of 288 1836 backup.exe 36 PID 288 wrote to memory of 648 288 data.exe 37 PID 288 wrote to memory of 648 288 data.exe 37 PID 288 wrote to memory of 648 288 data.exe 37 PID 288 wrote to memory of 648 288 data.exe 37 PID 1836 wrote to memory of 1748 1836 backup.exe 38 PID 1836 wrote to memory of 1748 1836 backup.exe 38 PID 1836 wrote to memory of 1748 1836 backup.exe 38 PID 1836 wrote to memory of 1748 1836 backup.exe 38 PID 1748 wrote to memory of 988 1748 backup.exe 39 PID 1748 wrote to memory of 988 1748 backup.exe 39 PID 1748 wrote to memory of 988 1748 backup.exe 39 PID 1748 wrote to memory of 988 1748 backup.exe 39 PID 988 wrote to memory of 1964 988 backup.exe 40 PID 988 wrote to memory of 1964 988 backup.exe 40 PID 988 wrote to memory of 1964 988 backup.exe 40 PID 988 wrote to memory of 1964 988 backup.exe 40 PID 1748 wrote to memory of 1084 1748 backup.exe 41 PID 1748 wrote to memory of 1084 1748 backup.exe 41 PID 1748 wrote to memory of 1084 1748 backup.exe 41 PID 1748 wrote to memory of 1084 1748 backup.exe 41 PID 1084 wrote to memory of 1892 1084 backup.exe 42 PID 1084 wrote to memory of 1892 1084 backup.exe 42 PID 1084 wrote to memory of 1892 1084 backup.exe 42 PID 1084 wrote to memory of 1892 1084 backup.exe 42 PID 1892 wrote to memory of 2004 1892 backup.exe 43 PID 1892 wrote to memory of 2004 1892 backup.exe 43 PID 1892 wrote to memory of 2004 1892 backup.exe 43 PID 1892 wrote to memory of 2004 1892 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe"C:\Users\Admin\AppData\Local\Temp\efc04ba5b394ef7b3f7e263e1ff4b5ee2800f4ca778b91f7ccc24d512d4fd55a.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\671615478\backup.exeC:\Users\Admin\AppData\Local\Temp\671615478\backup.exe C:\Users\Admin\AppData\Local\Temp\671615478\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1836 -
C:\PerfLogs\data.exeC:\PerfLogs\data.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:288 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1748 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:988 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1892 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2004
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1156 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1508
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1612
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1448
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1408
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1888
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1656
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:768
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:288
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:112
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:928
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1972
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1896
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1412
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1220
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
PID:752
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:876
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1596
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1136
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵PID:1576
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵PID:604
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵PID:2032
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:984 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1928
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵PID:1672
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:948
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵PID:956
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1032 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵PID:1704
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵PID:1884
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵PID:904
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:468
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:480
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:572
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1408 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:648
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:544 -
C:\Program Files\Common Files\System\ado\data.exe"C:\Program Files\Common Files\System\ado\data.exe" C:\Program Files\Common Files\System\ado\7⤵PID:580
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1616
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:2024
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1696 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:1204
-
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵PID:756
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Executes dropped EXE
PID:1912
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1896
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1724
-
-
C:\Program Files\Microsoft Office\backup.exe"C:\Program Files\Microsoft Office\backup.exe" C:\Program Files\Microsoft Office\5⤵PID:1984
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1120
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:688 -
C:\Program Files (x86)\Adobe\update.exe"C:\Program Files (x86)\Adobe\update.exe" C:\Program Files (x86)\Adobe\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:520
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1648 -
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1264
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:360
-
-
C:\Program Files (x86)\Common Files\DESIGNER\backup.exe"C:\Program Files (x86)\Common Files\DESIGNER\backup.exe" C:\Program Files (x86)\Common Files\DESIGNER\6⤵PID:1064
-
-
-
C:\Program Files (x86)\Google\update.exe"C:\Program Files (x86)\Google\update.exe" C:\Program Files (x86)\Google\5⤵PID:928
-
C:\Program Files (x86)\Google\CrashReports\backup.exe"C:\Program Files (x86)\Google\CrashReports\backup.exe" C:\Program Files (x86)\Google\CrashReports\6⤵PID:912
-
-
C:\Program Files (x86)\Google\Policies\backup.exe"C:\Program Files (x86)\Google\Policies\backup.exe" C:\Program Files (x86)\Google\Policies\6⤵PID:872
-
-
C:\Program Files (x86)\Google\Temp\backup.exe"C:\Program Files (x86)\Google\Temp\backup.exe" C:\Program Files (x86)\Google\Temp\6⤵PID:704
-
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1308
-
C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe"C:\Program Files (x86)\Internet Explorer\de-DE\backup.exe" C:\Program Files (x86)\Internet Explorer\de-DE\6⤵PID:1592
-
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:2036
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:876
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1028 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵PID:1612
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1972
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:288
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:872
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:900
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\data.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:560
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD54b3795d6bb74c0fc493888077a40316c
SHA1fd8cd593386882d15b19f03520b7c3ed9a4d9738
SHA2568dbccaca06ec04790cafe1c3471a2c51a888d63fee23e50fb13cae21d4c1b4c5
SHA5120bd9d3dd5dc0809eb53b4772f39d41ae5fac904be042cc51f1c508a66530aa36d10e36ec6987ef3ea679592617012e29f9d7d6deb1d134ba0bf8353cf50a1e14
-
Filesize
72KB
MD5c046429173f69ead9efa25e5eb88f4ce
SHA1b4c30687ee7f36d666ae18317f0530c2b109868c
SHA2568d25cc4c3aea129bfe6f2ea0ac78b9a62b99bf588db94279b485c364ced11b9f
SHA51280b7798bd55dd7f5ba8a6dee762f8cf3da37c6b241e9e6cc6249f0e50bf79d2be7a5e264c0d2b4021dd1a6c7943336a47b8e11672ad32c3ddfdcd2c1d82c7de3
-
Filesize
72KB
MD5c046429173f69ead9efa25e5eb88f4ce
SHA1b4c30687ee7f36d666ae18317f0530c2b109868c
SHA2568d25cc4c3aea129bfe6f2ea0ac78b9a62b99bf588db94279b485c364ced11b9f
SHA51280b7798bd55dd7f5ba8a6dee762f8cf3da37c6b241e9e6cc6249f0e50bf79d2be7a5e264c0d2b4021dd1a6c7943336a47b8e11672ad32c3ddfdcd2c1d82c7de3
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5b648a587f0f82f4401ff9c33aff6c16b
SHA1a8045ceee7b07e94b791e923c604dc45d9ce5216
SHA25616b51e6728cf1206fa066ba426490b658f9d3d89e85396b3956a047ac3caa92a
SHA5125b2e697fe779615c6049c73d2137f257111c5550163ad7d2a752299e1acc0925cf9361c57d76cdb5d029e8092aa7238ede7cf40d1855650e2f52a30cf60ef8ac
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD5cc39666e2464a98244928bd0eec3c133
SHA1d5c077e899b4f6766bd50bf577d0aced4a2afa54
SHA256c52d355d2bd28f496e2396f70dd2a65e97af72b08a608ef11279fa54d4a9c7fe
SHA51274d8304ffdeb2e8688355b16dba6add559a449528ab5baab5a9dced92ca6e073cbebb9953df9cceb1da3c4cba679300414159ab367fb79713b574cce129a6a66
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5d3c533b4906d5ee3f642a68280ca8abf
SHA178b4f97767c7346bd159ff76644e29ac680ed39a
SHA256d1cc7a26676b98b757ffbdd45166331592addc05eb1a93735689e660306b250f
SHA512be2111d622d6366aa6717775486dc28e70061a58862a93df136d451e421587cdbb42d411bda273dfa2eb9931272d83fbc450685409944431fe69ecd831206a15
-
Filesize
72KB
MD5d3c533b4906d5ee3f642a68280ca8abf
SHA178b4f97767c7346bd159ff76644e29ac680ed39a
SHA256d1cc7a26676b98b757ffbdd45166331592addc05eb1a93735689e660306b250f
SHA512be2111d622d6366aa6717775486dc28e70061a58862a93df136d451e421587cdbb42d411bda273dfa2eb9931272d83fbc450685409944431fe69ecd831206a15
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD52b1036a788aef06c837d835abd5f586d
SHA1f956c3eec4b9d6200ecf2377fc93286e5bddf986
SHA25610fde8a84c31d5b2ec94e2abe25bdd768ae97cab89d391f8648d0d824f710c91
SHA5125ff077735708b3c0e915296acb7d58c405a4068f5e76f0636e916a7a2a5d423504b369d5c4ecf53fddf18985b8b17613a75bbaabe69ff9b8343420a901d294b6
-
Filesize
72KB
MD52b1036a788aef06c837d835abd5f586d
SHA1f956c3eec4b9d6200ecf2377fc93286e5bddf986
SHA25610fde8a84c31d5b2ec94e2abe25bdd768ae97cab89d391f8648d0d824f710c91
SHA5125ff077735708b3c0e915296acb7d58c405a4068f5e76f0636e916a7a2a5d423504b369d5c4ecf53fddf18985b8b17613a75bbaabe69ff9b8343420a901d294b6
-
Filesize
72KB
MD54b3795d6bb74c0fc493888077a40316c
SHA1fd8cd593386882d15b19f03520b7c3ed9a4d9738
SHA2568dbccaca06ec04790cafe1c3471a2c51a888d63fee23e50fb13cae21d4c1b4c5
SHA5120bd9d3dd5dc0809eb53b4772f39d41ae5fac904be042cc51f1c508a66530aa36d10e36ec6987ef3ea679592617012e29f9d7d6deb1d134ba0bf8353cf50a1e14
-
Filesize
72KB
MD54b3795d6bb74c0fc493888077a40316c
SHA1fd8cd593386882d15b19f03520b7c3ed9a4d9738
SHA2568dbccaca06ec04790cafe1c3471a2c51a888d63fee23e50fb13cae21d4c1b4c5
SHA5120bd9d3dd5dc0809eb53b4772f39d41ae5fac904be042cc51f1c508a66530aa36d10e36ec6987ef3ea679592617012e29f9d7d6deb1d134ba0bf8353cf50a1e14
-
Filesize
72KB
MD5c046429173f69ead9efa25e5eb88f4ce
SHA1b4c30687ee7f36d666ae18317f0530c2b109868c
SHA2568d25cc4c3aea129bfe6f2ea0ac78b9a62b99bf588db94279b485c364ced11b9f
SHA51280b7798bd55dd7f5ba8a6dee762f8cf3da37c6b241e9e6cc6249f0e50bf79d2be7a5e264c0d2b4021dd1a6c7943336a47b8e11672ad32c3ddfdcd2c1d82c7de3
-
Filesize
72KB
MD5c046429173f69ead9efa25e5eb88f4ce
SHA1b4c30687ee7f36d666ae18317f0530c2b109868c
SHA2568d25cc4c3aea129bfe6f2ea0ac78b9a62b99bf588db94279b485c364ced11b9f
SHA51280b7798bd55dd7f5ba8a6dee762f8cf3da37c6b241e9e6cc6249f0e50bf79d2be7a5e264c0d2b4021dd1a6c7943336a47b8e11672ad32c3ddfdcd2c1d82c7de3
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5407433367868691369d7dd8b8b26c2c8
SHA1d9076bd2dc7a1cb13b7b0f7f8122ff04ab979095
SHA256bd1f50312187c537d6bb32195a9372f7049f35b5feeccf6df55f62712f30f8b6
SHA51235ebcfe203fcd18e39de2ced7585e59fa341764c0940eaea34a0aafb30e67b71524fa8e1c0c5443c3b5ff16265260bef38f40479e63ff491eeb0b54408a73330
-
Filesize
72KB
MD5b648a587f0f82f4401ff9c33aff6c16b
SHA1a8045ceee7b07e94b791e923c604dc45d9ce5216
SHA25616b51e6728cf1206fa066ba426490b658f9d3d89e85396b3956a047ac3caa92a
SHA5125b2e697fe779615c6049c73d2137f257111c5550163ad7d2a752299e1acc0925cf9361c57d76cdb5d029e8092aa7238ede7cf40d1855650e2f52a30cf60ef8ac
-
Filesize
72KB
MD5b648a587f0f82f4401ff9c33aff6c16b
SHA1a8045ceee7b07e94b791e923c604dc45d9ce5216
SHA25616b51e6728cf1206fa066ba426490b658f9d3d89e85396b3956a047ac3caa92a
SHA5125b2e697fe779615c6049c73d2137f257111c5550163ad7d2a752299e1acc0925cf9361c57d76cdb5d029e8092aa7238ede7cf40d1855650e2f52a30cf60ef8ac
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD55d3acc172878821199d4e6014c1a3aac
SHA11b0a98c4ce3d7860fc1c75159f69ea92f9060491
SHA2566a88de36b2beb4ae0e1d1263ae955d503b62d58c8a259fa971ba01430c137732
SHA512da9aeb070460c7e15da1293e7b0490006ca401fb4c54879876df640fc6da793b46bfd406e9fcdd4f7e0d85506f7160dbd63e5d55e8821922a06203e77112e526
-
Filesize
72KB
MD5cc39666e2464a98244928bd0eec3c133
SHA1d5c077e899b4f6766bd50bf577d0aced4a2afa54
SHA256c52d355d2bd28f496e2396f70dd2a65e97af72b08a608ef11279fa54d4a9c7fe
SHA51274d8304ffdeb2e8688355b16dba6add559a449528ab5baab5a9dced92ca6e073cbebb9953df9cceb1da3c4cba679300414159ab367fb79713b574cce129a6a66
-
Filesize
72KB
MD5cc39666e2464a98244928bd0eec3c133
SHA1d5c077e899b4f6766bd50bf577d0aced4a2afa54
SHA256c52d355d2bd28f496e2396f70dd2a65e97af72b08a608ef11279fa54d4a9c7fe
SHA51274d8304ffdeb2e8688355b16dba6add559a449528ab5baab5a9dced92ca6e073cbebb9953df9cceb1da3c4cba679300414159ab367fb79713b574cce129a6a66
-
Filesize
72KB
MD5cc39666e2464a98244928bd0eec3c133
SHA1d5c077e899b4f6766bd50bf577d0aced4a2afa54
SHA256c52d355d2bd28f496e2396f70dd2a65e97af72b08a608ef11279fa54d4a9c7fe
SHA51274d8304ffdeb2e8688355b16dba6add559a449528ab5baab5a9dced92ca6e073cbebb9953df9cceb1da3c4cba679300414159ab367fb79713b574cce129a6a66
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5b7599b615c75afe7c01084f464969e5b
SHA12236e634ee0e4216a9dd0e56a7cf97eece5b4ac4
SHA2564a2d888accbfc95fb181c3e3f742cb71f2268540279a1c1f99443bbdab421ea4
SHA512a835bbebd6a4e6c5cd2f904e33d59b873cf2618ca7242604655b8c36039e0d927e462671c915d9c60d9fe08e961efe9d8313682f2fdf3758208f2990b20db370
-
Filesize
72KB
MD5d3c533b4906d5ee3f642a68280ca8abf
SHA178b4f97767c7346bd159ff76644e29ac680ed39a
SHA256d1cc7a26676b98b757ffbdd45166331592addc05eb1a93735689e660306b250f
SHA512be2111d622d6366aa6717775486dc28e70061a58862a93df136d451e421587cdbb42d411bda273dfa2eb9931272d83fbc450685409944431fe69ecd831206a15
-
Filesize
72KB
MD5d3c533b4906d5ee3f642a68280ca8abf
SHA178b4f97767c7346bd159ff76644e29ac680ed39a
SHA256d1cc7a26676b98b757ffbdd45166331592addc05eb1a93735689e660306b250f
SHA512be2111d622d6366aa6717775486dc28e70061a58862a93df136d451e421587cdbb42d411bda273dfa2eb9931272d83fbc450685409944431fe69ecd831206a15
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5657afebfd18708845d76fc69cd3d2d08
SHA1fee1bbd70f981a75a48630d56e91bfaf28b52ae5
SHA25665eb562001d3a890d90fb8282167a54d62d2c257729f4aee1c728a429bb0a02c
SHA512857d83f317c6e895819baae5a35102a51cb203cb26b5ec7363204fd981947bc2f9494022491e5b41ec9abac176ba5e3d93f78b00396bfa9521c21365b8dd0a8b
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c
-
Filesize
72KB
MD5f965a47019514a066c900a314a84762c
SHA17c921491c589710dd7959ffd159b4e1b451bab7b
SHA256cfc6b76ef921954d812c70b90ca511e845fec0c36b5ee267cd126a00ae6008ca
SHA512c560b55afbe78ecc703115df77547f9c1664e9a8d30819f91e76bf13610f40952db2239d7e3c52403c421dd6e1784ea2fcfb7d6987c620991cb531b037ff564c