Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
228s -
max time network
35s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
Resource
win10v2004-20221111-en
General
-
Target
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe
-
Size
72KB
-
MD5
089486ab489ab4f97ce70cba78a50961
-
SHA1
c86bcc5b33c46817d459523cd84a81675d1be81c
-
SHA256
e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e
-
SHA512
5d462d7449e6de7910fa476c5688dbb2718531a550d48c0ebf90012a3bc9dd1b4cfdb9e018620c2208019213db5cb34b35b194ab1bedd43a9d2b708c2045c2b6
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2D:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrP3
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 50 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe -
Executes dropped EXE 60 IoCs
pid Process 1160 data.exe 1872 backup.exe 1064 backup.exe 1360 update.exe 1512 backup.exe 1616 backup.exe 1936 update.exe 1608 backup.exe 616 backup.exe 428 backup.exe 1324 backup.exe 2020 backup.exe 1276 backup.exe 1884 backup.exe 996 backup.exe 2032 backup.exe 1060 backup.exe 960 backup.exe 1400 backup.exe 1116 backup.exe 536 backup.exe 1076 backup.exe 976 backup.exe 1540 backup.exe 1888 backup.exe 324 backup.exe 1932 backup.exe 1604 backup.exe 616 backup.exe 1944 backup.exe 2044 backup.exe 724 backup.exe 1728 backup.exe 1456 backup.exe 1236 backup.exe 2020 backup.exe 1592 backup.exe 1304 System Restore.exe 1676 backup.exe 1824 backup.exe 1972 backup.exe 944 backup.exe 1260 data.exe 1956 backup.exe 2028 backup.exe 1952 backup.exe 1900 data.exe 1908 backup.exe 328 backup.exe 1212 backup.exe 1396 backup.exe 2036 backup.exe 1672 backup.exe 324 backup.exe 188 backup.exe 820 backup.exe 1748 backup.exe 568 backup.exe 1764 backup.exe 680 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 1360 update.exe 1360 update.exe 1616 backup.exe 1616 backup.exe 1616 backup.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 1616 backup.exe 1616 backup.exe 1936 update.exe 1936 update.exe 1936 update.exe 1608 backup.exe 1608 backup.exe 1608 backup.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 1360 update.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 1360 update.exe 428 backup.exe 428 backup.exe 428 backup.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 428 backup.exe 428 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 2020 backup.exe 1276 backup.exe 1276 backup.exe 1276 backup.exe 428 backup.exe 428 backup.exe 1884 backup.exe 1884 backup.exe 1884 backup.exe 1884 backup.exe 1884 backup.exe 996 backup.exe 996 backup.exe 996 backup.exe 996 backup.exe 996 backup.exe 2032 backup.exe 2032 backup.exe 2032 backup.exe 996 backup.exe 996 backup.exe 1060 backup.exe 1060 backup.exe 1060 backup.exe 996 backup.exe 1360 update.exe 1884 backup.exe -
Drops file in Program Files directory 55 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe System Restore.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\update.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\System Restore.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe update.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Games\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\update.exe System Restore.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\addins\data.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\backup.exe update.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe -
Suspicious use of SetWindowsHookEx 61 IoCs
pid Process 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 1160 data.exe 1872 backup.exe 1064 backup.exe 1360 update.exe 1512 backup.exe 1616 backup.exe 1936 update.exe 1608 backup.exe 616 backup.exe 428 backup.exe 1324 backup.exe 2020 backup.exe 1276 backup.exe 1884 backup.exe 996 backup.exe 2032 backup.exe 1060 backup.exe 1400 backup.exe 960 backup.exe 1116 backup.exe 1076 backup.exe 976 backup.exe 1540 backup.exe 324 backup.exe 1932 backup.exe 1888 backup.exe 1604 backup.exe 616 backup.exe 2044 backup.exe 724 backup.exe 1728 backup.exe 1944 backup.exe 1456 backup.exe 1592 backup.exe 1304 System Restore.exe 2020 backup.exe 536 backup.exe 1236 backup.exe 1824 backup.exe 1676 backup.exe 1972 backup.exe 1908 backup.exe 944 backup.exe 2028 backup.exe 1956 backup.exe 1260 data.exe 1396 backup.exe 1900 data.exe 1952 backup.exe 328 backup.exe 2036 backup.exe 1212 backup.exe 1672 backup.exe 324 backup.exe 188 backup.exe 820 backup.exe 1748 backup.exe 568 backup.exe 1764 backup.exe 680 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 520 wrote to memory of 1160 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 28 PID 520 wrote to memory of 1160 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 28 PID 520 wrote to memory of 1160 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 28 PID 520 wrote to memory of 1160 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 28 PID 520 wrote to memory of 1872 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 29 PID 520 wrote to memory of 1872 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 29 PID 520 wrote to memory of 1872 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 29 PID 520 wrote to memory of 1872 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 29 PID 520 wrote to memory of 1064 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 31 PID 520 wrote to memory of 1064 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 31 PID 520 wrote to memory of 1064 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 31 PID 520 wrote to memory of 1064 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 31 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 1160 wrote to memory of 1360 1160 data.exe 30 PID 520 wrote to memory of 1512 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 32 PID 520 wrote to memory of 1512 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 32 PID 520 wrote to memory of 1512 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 32 PID 520 wrote to memory of 1512 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 32 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 1360 wrote to memory of 1616 1360 update.exe 33 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 520 wrote to memory of 1936 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 34 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 1616 wrote to memory of 1608 1616 backup.exe 35 PID 520 wrote to memory of 616 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 36 PID 520 wrote to memory of 616 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 36 PID 520 wrote to memory of 616 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 36 PID 520 wrote to memory of 616 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 36 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 1360 wrote to memory of 428 1360 update.exe 37 PID 520 wrote to memory of 1324 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 38 PID 520 wrote to memory of 1324 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 38 PID 520 wrote to memory of 1324 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 38 PID 520 wrote to memory of 1324 520 e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe 38 PID 428 wrote to memory of 2020 428 backup.exe 39 PID 428 wrote to memory of 2020 428 backup.exe 39 PID 428 wrote to memory of 2020 428 backup.exe 39 PID 428 wrote to memory of 2020 428 backup.exe 39 PID 428 wrote to memory of 2020 428 backup.exe 39 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe"C:\Users\Admin\AppData\Local\Temp\e26f7347d9f78904842f917f55a0aac6940d7e44a2009e66433f8d9befd6103e.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\1596935197\data.exeC:\Users\Admin\AppData\Local\Temp\1596935197\data.exe C:\Users\Admin\AppData\Local\Temp\1596935197\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1160 -
C:\update.exe\update.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1360 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1616 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1608
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2020 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1276
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1884 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:996 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2032
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1060 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1076
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:324
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵PID:1620
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1400 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1236
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵PID:1940
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1888 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1956
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:820
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:2028
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1116
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:976 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1592
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:616 -
C:\Program Files\Common Files\System\ado\System Restore.exe"C:\Program Files\Common Files\System\ado\System Restore.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1304 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:944
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2036
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:324
-
-
C:\Program Files\Common Files\System\ado\fr-FR\update.exe"C:\Program Files\Common Files\System\ado\fr-FR\update.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1880
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1628
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:536 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:328
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:328
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1540 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2044 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1824 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1908 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:188
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1224
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1684
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:724
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1676
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1672
-
-
C:\Program Files\Internet Explorer\fr-FR\update.exe"C:\Program Files\Internet Explorer\fr-FR\update.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1516
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:608
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:960 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2020 -
C:\Program Files (x86)\Adobe\Reader 9.0\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1872
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1972 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1212
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1764
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:940
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1588
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1728 -
C:\Windows\addins\data.exeC:\Windows\addins\data.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1260
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵PID:1512
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1872
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1512
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:616
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1324
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD5c2b127bb70c763414c37c4bac72c0c4c
SHA1708e762d5855575da1dc56855a219bd1560df71f
SHA2563629abcec2538cc87a5ae0e4344ff40ebec9f1320cc9fa77e41d67837cd3186c
SHA5126a4e38e925424537bbf1a54a160ff16fff1f54f55bd96d878c7e5f210cfb9491a923f93d4454a3af1c2509262ff19cfd2c8b5df8fa3776d97c8b111340282404
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5efd61ff0ee43463b867b1b3855e26af1
SHA18bd56501716bbb99f7d11dfc1f50126b8fb5c150
SHA2565623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e
SHA512a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916
-
Filesize
72KB
MD5f0591f4c9f686ce54ddf87cefdf40627
SHA1e9ac787a3f56a7374eaa12fba82b22fd31cb55ce
SHA2561c2b309e4f6ab8327d903a52c8d3f77aab22b8a2cfdce6de551d05cbefe56b98
SHA51297ba57c15ac84d118d2d04d924d11937382a053211116f611f7064ebb6096238f89203250449cd65ec5bbd975ba8df956ebc47e0eafde20def693c886298acf3
-
Filesize
72KB
MD5f0591f4c9f686ce54ddf87cefdf40627
SHA1e9ac787a3f56a7374eaa12fba82b22fd31cb55ce
SHA2561c2b309e4f6ab8327d903a52c8d3f77aab22b8a2cfdce6de551d05cbefe56b98
SHA51297ba57c15ac84d118d2d04d924d11937382a053211116f611f7064ebb6096238f89203250449cd65ec5bbd975ba8df956ebc47e0eafde20def693c886298acf3
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5611460c512df60f3b140c6039bc91ed4
SHA173cf146481e3f52f97c65c64d05973b1bf8cdc1c
SHA256d0ca4c569cdd99195683c2336823bca6e7f9188a48aa0a51bfaff39d59f21710
SHA5122072b715b805454518df6183417fb09eb1f2a1b9bfda09a74c1df1ba619cfcc11742b5c4de160619337c77858f225013ef74649db076ba66c15a5ab7c2fd10ed
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD5df0b6100965816a95a44c68da0b78751
SHA11d360e2a8ebf44054b4ce7ec4070b8585968ea5e
SHA2566ab02051eb62c4f7e04477539b7350d5b02d449d698d19e135cfa8bb57b89426
SHA512ca816927552036c3fad231a1c827694a9a033c3b2148ff0641e8419cadda56f6e0373413760eba140e0ac2514f7d8933cbcc9a42587138ae1aa680d88f2e4b20
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD50bcc00600c3dce919721973023d6cd0c
SHA1c41210b996a667a90a586d9347589392c150fc61
SHA25663456e973b76073bc2afdcf5bafc26f7cb6a353ca8fd105c1143cbeb828b5d7e
SHA5122ee40924f0244d1433c529cecabc65540dcd416f70566aa392259c8bbc2c2a0eb599072f0778f41102a6e9d62640380717fc330555e429e79125e0d9fa48e623
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD58ccf64bb21ff778942ceec093fe78e5c
SHA1467e7b41aac60574e31e8ff98398d48476698dc8
SHA2563412e5dd5184876cd8537be4ac379dd18265741e50776dc05cc80e0967bad8f0
SHA51280010dc346f630ce32e815abd6f390dd9a0cfa21da5c6b778b10a4ce4897e45e74b297406695edbdd041ad4f64b05f5999caa5e1abd5d7353ba110fe47ef2280
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD512faf278a6b955c074a29b3da254dc4a
SHA1f40c5cad2c3cc75a24089afde4c78ae92bce7509
SHA256f30a8a2c78eee9568b1ed8bfd29044f00346371cc4ca09f69bd6db7623742b7a
SHA51283b5fa2692cc79b5754780f4f79eca55764709e06279db85221b026b128a1ff20831afcb6a27f2261fbd7fe9d52233e9ee053d78fd6be10b65f8683caf8c0aa9
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD5c2b127bb70c763414c37c4bac72c0c4c
SHA1708e762d5855575da1dc56855a219bd1560df71f
SHA2563629abcec2538cc87a5ae0e4344ff40ebec9f1320cc9fa77e41d67837cd3186c
SHA5126a4e38e925424537bbf1a54a160ff16fff1f54f55bd96d878c7e5f210cfb9491a923f93d4454a3af1c2509262ff19cfd2c8b5df8fa3776d97c8b111340282404
-
Filesize
72KB
MD5c2b127bb70c763414c37c4bac72c0c4c
SHA1708e762d5855575da1dc56855a219bd1560df71f
SHA2563629abcec2538cc87a5ae0e4344ff40ebec9f1320cc9fa77e41d67837cd3186c
SHA5126a4e38e925424537bbf1a54a160ff16fff1f54f55bd96d878c7e5f210cfb9491a923f93d4454a3af1c2509262ff19cfd2c8b5df8fa3776d97c8b111340282404
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5efd61ff0ee43463b867b1b3855e26af1
SHA18bd56501716bbb99f7d11dfc1f50126b8fb5c150
SHA2565623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e
SHA512a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5efd61ff0ee43463b867b1b3855e26af1
SHA18bd56501716bbb99f7d11dfc1f50126b8fb5c150
SHA2565623cc065036b05e1a4934c4b2033466c0b824031c8962ce872bf9fe2a5add4e
SHA512a9b311900e04375fd001347a708b88f2e3f80e3cbcd2bb0bd263d048b01e9a891c453f2bfdfc92c83b95da08a15a71688e8d547cc3f0a33b44372ad39810be61
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD52db571f78c9296afacafdffb890d2bd1
SHA1b13651d266c884440882acbcb0bf370b4d084dbf
SHA25650380764e6eb9dd96321942ff79a01fc153be615978feedc83d7a57c7cf7dbc3
SHA512df3a6593f7e137e040c9d16bb39627ad7d07b3194db1ad280c749776d29601939e72d48d4cc8f27619744f06a36294a03f035ad28d9803f205ed9cdecd223e83
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD5b58c4282847e3a29f6b5ae819158a6f0
SHA16dc42caa059ff6fb5ea51d784ce3ef607d26487e
SHA2565747f5b816482f75e2f8c91d8549c59ca2c1697cae5c7964ac50b044f8516d1a
SHA512f2e8ac852a4019e0c30d39101c65125a90889679c7440a63e07b2b5b7f4c85731f279f1bc8b0d3c5c774a760f4751cd048e16b798b63c55ebe6077feced7926a
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916
-
Filesize
72KB
MD57b05c9f77cd1b005da53f5d051a1e639
SHA19a1058c224be099a1ded3f71394386cef53eaa9f
SHA2562278dc33d847a8f7c0c0aaef5ef9d054453c49e44f123f6fbe04bdbf7890d490
SHA512724a67420e08c525121988bcf410dec7664febf712e47d49ae71e9360d801414c0a4fa0849ac77f381b7fae2cc4e4b1f3ddd97843f36e10af988af5644118916