Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
254s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 19:55
Static task
static1
Behavioral task
behavioral1
Sample
d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe
Resource
win10v2004-20220812-en
General
-
Target
d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe
-
Size
72KB
-
MD5
393b414c7abc43f449e3514e1d3f7ff0
-
SHA1
6b837bedc7d9f73b039f6503ccc19fd39e933813
-
SHA256
d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d
-
SHA512
440429301cfd9cc96abad6b52cbd166a8c9b1ebc5f86f3e17e9886db139db4f41b23220173b2d70a1feab336750d0a4d835591f3b8bde3c814097aab2060c774
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2l:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrJ
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 51 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 560 backup.exe 592 backup.exe 1720 backup.exe 1264 backup.exe 1364 backup.exe 1000 backup.exe 1604 backup.exe 1224 backup.exe 2016 backup.exe 1492 backup.exe 1300 backup.exe 932 backup.exe 1076 backup.exe 1676 backup.exe 852 backup.exe 952 backup.exe 520 update.exe 268 backup.exe 592 update.exe 1532 backup.exe 1844 backup.exe 848 backup.exe 1588 backup.exe 1364 backup.exe 1148 backup.exe 1416 backup.exe 1088 backup.exe 884 backup.exe 1560 backup.exe 1460 backup.exe 1980 backup.exe 2000 backup.exe 1748 backup.exe 1992 backup.exe 1672 backup.exe 1196 backup.exe 1512 System Restore.exe 1176 backup.exe 2040 backup.exe 1744 backup.exe 1752 backup.exe 588 backup.exe 580 backup.exe 1732 backup.exe 1568 backup.exe 1264 backup.exe 1740 backup.exe 1648 backup.exe 1068 System Restore.exe 452 backup.exe 1492 backup.exe 1932 backup.exe 1852 backup.exe 868 backup.exe 784 backup.exe 480 backup.exe 932 backup.exe 1784 backup.exe 1572 backup.exe 2024 backup.exe 1532 backup.exe 552 backup.exe 1064 backup.exe 1128 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 1224 backup.exe 1224 backup.exe 2016 backup.exe 2016 backup.exe 1224 backup.exe 1224 backup.exe 1300 backup.exe 1300 backup.exe 932 backup.exe 932 backup.exe 1300 backup.exe 1300 backup.exe 1676 backup.exe 1676 backup.exe 852 backup.exe 852 backup.exe 852 backup.exe 520 update.exe 520 update.exe 520 update.exe 520 update.exe 520 update.exe 268 backup.exe 268 backup.exe 268 backup.exe 520 update.exe 592 update.exe 592 update.exe 592 update.exe 520 update.exe 520 update.exe 1532 backup.exe 1532 backup.exe 1532 backup.exe 520 update.exe 520 update.exe 1844 backup.exe 1844 backup.exe 1844 backup.exe 520 update.exe 1224 backup.exe 520 update.exe 1224 backup.exe 1300 backup.exe 1300 backup.exe 1676 backup.exe 852 backup.exe 1676 backup.exe 852 backup.exe 1588 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Java\jre7\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe update.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe update.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Google\backup.exe backup.exe File opened for modification C:\Program Files\Microsoft Office\update.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\data.exe System Restore.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\update.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\update.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Google\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe update.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe -
Drops file in Windows directory 5 IoCs
description ioc Process File opened for modification C:\Windows\assembly\backup.exe backup.exe File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe File opened for modification C:\Windows\AppCompat\backup.exe backup.exe File opened for modification C:\Windows\AppPatch\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 560 backup.exe 592 backup.exe 1720 backup.exe 1264 backup.exe 1364 backup.exe 1000 backup.exe 1604 backup.exe 1224 backup.exe 2016 backup.exe 1492 backup.exe 1300 backup.exe 932 backup.exe 1076 backup.exe 1676 backup.exe 852 backup.exe 952 backup.exe 520 update.exe 268 backup.exe 592 update.exe 1532 backup.exe 1844 backup.exe 848 backup.exe 1364 backup.exe 1588 backup.exe 1148 backup.exe 1416 backup.exe 884 backup.exe 1088 backup.exe 1560 backup.exe 1460 backup.exe 1980 backup.exe 2000 backup.exe 1748 backup.exe 1672 backup.exe 1992 backup.exe 1196 backup.exe 1176 backup.exe 1512 System Restore.exe 1744 backup.exe 588 backup.exe 580 backup.exe 2040 backup.exe 1752 backup.exe 1732 backup.exe 1568 backup.exe 1264 backup.exe 1648 backup.exe 1740 backup.exe 1068 System Restore.exe 868 backup.exe 452 backup.exe 1932 backup.exe 932 backup.exe 1784 backup.exe 1492 backup.exe 480 backup.exe 1852 backup.exe 784 backup.exe 2024 backup.exe 1572 backup.exe 552 backup.exe 1532 backup.exe 1064 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 860 wrote to memory of 560 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 28 PID 860 wrote to memory of 560 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 28 PID 860 wrote to memory of 560 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 28 PID 860 wrote to memory of 560 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 28 PID 860 wrote to memory of 592 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 29 PID 860 wrote to memory of 592 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 29 PID 860 wrote to memory of 592 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 29 PID 860 wrote to memory of 592 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 29 PID 860 wrote to memory of 1720 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 30 PID 860 wrote to memory of 1720 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 30 PID 860 wrote to memory of 1720 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 30 PID 860 wrote to memory of 1720 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 30 PID 860 wrote to memory of 1264 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 31 PID 860 wrote to memory of 1264 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 31 PID 860 wrote to memory of 1264 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 31 PID 860 wrote to memory of 1264 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 31 PID 860 wrote to memory of 1364 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 32 PID 860 wrote to memory of 1364 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 32 PID 860 wrote to memory of 1364 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 32 PID 860 wrote to memory of 1364 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 32 PID 860 wrote to memory of 1000 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 33 PID 860 wrote to memory of 1000 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 33 PID 860 wrote to memory of 1000 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 33 PID 860 wrote to memory of 1000 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 33 PID 860 wrote to memory of 1604 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 34 PID 860 wrote to memory of 1604 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 34 PID 860 wrote to memory of 1604 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 34 PID 860 wrote to memory of 1604 860 d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe 34 PID 560 wrote to memory of 1224 560 backup.exe 35 PID 560 wrote to memory of 1224 560 backup.exe 35 PID 560 wrote to memory of 1224 560 backup.exe 35 PID 560 wrote to memory of 1224 560 backup.exe 35 PID 1224 wrote to memory of 2016 1224 backup.exe 36 PID 1224 wrote to memory of 2016 1224 backup.exe 36 PID 1224 wrote to memory of 2016 1224 backup.exe 36 PID 1224 wrote to memory of 2016 1224 backup.exe 36 PID 2016 wrote to memory of 1492 2016 backup.exe 37 PID 2016 wrote to memory of 1492 2016 backup.exe 37 PID 2016 wrote to memory of 1492 2016 backup.exe 37 PID 2016 wrote to memory of 1492 2016 backup.exe 37 PID 1224 wrote to memory of 1300 1224 backup.exe 38 PID 1224 wrote to memory of 1300 1224 backup.exe 38 PID 1224 wrote to memory of 1300 1224 backup.exe 38 PID 1224 wrote to memory of 1300 1224 backup.exe 38 PID 1300 wrote to memory of 932 1300 backup.exe 39 PID 1300 wrote to memory of 932 1300 backup.exe 39 PID 1300 wrote to memory of 932 1300 backup.exe 39 PID 1300 wrote to memory of 932 1300 backup.exe 39 PID 932 wrote to memory of 1076 932 backup.exe 40 PID 932 wrote to memory of 1076 932 backup.exe 40 PID 932 wrote to memory of 1076 932 backup.exe 40 PID 932 wrote to memory of 1076 932 backup.exe 40 PID 1300 wrote to memory of 1676 1300 backup.exe 41 PID 1300 wrote to memory of 1676 1300 backup.exe 41 PID 1300 wrote to memory of 1676 1300 backup.exe 41 PID 1300 wrote to memory of 1676 1300 backup.exe 41 PID 1676 wrote to memory of 852 1676 backup.exe 42 PID 1676 wrote to memory of 852 1676 backup.exe 42 PID 1676 wrote to memory of 852 1676 backup.exe 42 PID 1676 wrote to memory of 852 1676 backup.exe 42 PID 852 wrote to memory of 952 852 backup.exe 43 PID 852 wrote to memory of 952 852 backup.exe 43 PID 852 wrote to memory of 952 852 backup.exe 43 PID 852 wrote to memory of 952 852 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe"C:\Users\Admin\AppData\Local\Temp\d17508b73d316a331cd4c86ffd57c906254584f06e3b4718561437cc3e59497d.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\2484006034\backup.exeC:\Users\Admin\AppData\Local\Temp\2484006034\backup.exe C:\Users\Admin\AppData\Local\Temp\2484006034\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:560 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1492
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1300 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:932 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1076
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:520 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:268
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:592
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1588
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1088
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1512
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵PID:1448
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1148 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2040
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1492
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Executes dropped EXE
PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵PID:904
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1460 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1744
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1196
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1572
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵PID:336
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1416
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1732
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1672 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1740 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1784
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:1196
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵PID:1760
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1064
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵PID:1600
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:848 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1264
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:868
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:1176
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵PID:1848
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:884 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:588 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1648 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:932 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵PID:1968
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe"C:\Program Files\Google\Chrome\Application\SetupMetrics\backup.exe" C:\Program Files\Google\Chrome\Application\SetupMetrics\8⤵PID:1504
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2000 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1852
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵PID:1200
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵PID:1568
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1992 -
C:\Program Files\Java\jdk1.7.0_80\System Restore.exe"C:\Program Files\Java\jdk1.7.0_80\System Restore.exe" C:\Program Files\Java\jdk1.7.0_80\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1068 -
C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe"C:\Program Files\Java\jdk1.7.0_80\bin\backup.exe" C:\Program Files\Java\jdk1.7.0_80\bin\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2024
-
-
C:\Program Files\Java\jdk1.7.0_80\db\backup.exe"C:\Program Files\Java\jdk1.7.0_80\db\backup.exe" C:\Program Files\Java\jdk1.7.0_80\db\7⤵PID:1752
-
-
-
C:\Program Files\Java\jre7\backup.exe"C:\Program Files\Java\jre7\backup.exe" C:\Program Files\Java\jre7\6⤵PID:1560
-
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:552
-
-
C:\Program Files\Microsoft Office\update.exe"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\5⤵PID:884
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1568 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1532
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1180
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:580 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:480
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵PID:1264
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵PID:1736
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1732
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748 -
C:\Windows\addins\backup.exeC:\Windows\addins\backup.exe C:\Windows\addins\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1176
-
-
C:\Windows\AppCompat\backup.exeC:\Windows\AppCompat\backup.exe C:\Windows\AppCompat\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452
-
-
C:\Windows\AppPatch\backup.exeC:\Windows\AppPatch\backup.exe C:\Windows\AppPatch\5⤵PID:1460
-
-
C:\Windows\assembly\backup.exeC:\Windows\assembly\backup.exe C:\Windows\assembly\5⤵PID:2032
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:592
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1264
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1364
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1604
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5eac2b233eefa7f3a42ddcbc03ca78d3e
SHA12c47aa2fac5f005b6270ba86c5d0b23145fff6c5
SHA25635db822f1b250273c78db6546a4e5b4e820c7bfc41b428c01c63b598c1226e7b
SHA51249bc592d64229275448d33d66e38a7790c7c58eff800f14ee19602310e7524bd0a12711521fca3da01da98bddabb5d665b68ba4d1e1a62d9527d4b6376b30de3
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD539ff4151cd6bc06770a6672f0921a9ed
SHA18dfa6b6dfa89b84681a7673b2337551754e550a4
SHA25691da0782a7b733d9f32e01695bbe5cf8d94f608eb836d4576b9c4908459fa282
SHA512fb36577c3a984792b641f1dc6dcb3bb2e74fd246144c02e78a2dc27308b1382fa86667545e261dc0d20ae3d5309ef989acd9d28ce888446c83e82630f01898db
-
Filesize
72KB
MD539ff4151cd6bc06770a6672f0921a9ed
SHA18dfa6b6dfa89b84681a7673b2337551754e550a4
SHA25691da0782a7b733d9f32e01695bbe5cf8d94f608eb836d4576b9c4908459fa282
SHA512fb36577c3a984792b641f1dc6dcb3bb2e74fd246144c02e78a2dc27308b1382fa86667545e261dc0d20ae3d5309ef989acd9d28ce888446c83e82630f01898db
-
Filesize
72KB
MD50ebd122fac7200de899a4a8118731913
SHA17bda13991665759672bfd905abd304577ef1be90
SHA256eced7c80d44508eddec6a268e04a66caacf72c982e6c9e1102e1cbd7a84eec2d
SHA5121df4f26ffb71ad6231cf09b73a963f18419b66ab194fca9a9fdcfbe324fbec93e2d8bb210ac9a177e41d0022441d999101347c2ee266316e3155a8d59f7a47f8
-
Filesize
72KB
MD50ebd122fac7200de899a4a8118731913
SHA17bda13991665759672bfd905abd304577ef1be90
SHA256eced7c80d44508eddec6a268e04a66caacf72c982e6c9e1102e1cbd7a84eec2d
SHA5121df4f26ffb71ad6231cf09b73a963f18419b66ab194fca9a9fdcfbe324fbec93e2d8bb210ac9a177e41d0022441d999101347c2ee266316e3155a8d59f7a47f8
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD554286d841b367fd2e64b2fd39ef5d46c
SHA1d3d144dc8ee5a6a91ba5ebd07e8792e98d6fddfe
SHA2563d3a8014bff1c8729a9e700343cec0dd74f7366bd77b10159a16c2f9c3d428e5
SHA5122efa8c3857b4c184dfe118e457299fbe7d9b387e021545f102319682bbdde1d24f4a1fa59f31f1d86085dcd242903409df4254e2aee3ee5b7e4519146ed60a2c
-
Filesize
72KB
MD554286d841b367fd2e64b2fd39ef5d46c
SHA1d3d144dc8ee5a6a91ba5ebd07e8792e98d6fddfe
SHA2563d3a8014bff1c8729a9e700343cec0dd74f7366bd77b10159a16c2f9c3d428e5
SHA5122efa8c3857b4c184dfe118e457299fbe7d9b387e021545f102319682bbdde1d24f4a1fa59f31f1d86085dcd242903409df4254e2aee3ee5b7e4519146ed60a2c
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec
-
Filesize
72KB
MD5984d2201f3846bcb8cbf187c19ec8f6d
SHA1e2e32698d3c6789e25716315fc69e869659dba09
SHA2565f4c4309dfa9bce117301243d87d0b8a150aa04944d7f3931c1d8dd4f05bcece
SHA512bd07f673dd4831d57ffa8a629b83468ecf4e4f512af0dda000ad3e61f5a0c92e4e250f57cde8d1a7c6a741d918d5600841069d5d83df81c980b19a1c0e59ffc6
-
Filesize
72KB
MD5984d2201f3846bcb8cbf187c19ec8f6d
SHA1e2e32698d3c6789e25716315fc69e869659dba09
SHA2565f4c4309dfa9bce117301243d87d0b8a150aa04944d7f3931c1d8dd4f05bcece
SHA512bd07f673dd4831d57ffa8a629b83468ecf4e4f512af0dda000ad3e61f5a0c92e4e250f57cde8d1a7c6a741d918d5600841069d5d83df81c980b19a1c0e59ffc6
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5eac2b233eefa7f3a42ddcbc03ca78d3e
SHA12c47aa2fac5f005b6270ba86c5d0b23145fff6c5
SHA25635db822f1b250273c78db6546a4e5b4e820c7bfc41b428c01c63b598c1226e7b
SHA51249bc592d64229275448d33d66e38a7790c7c58eff800f14ee19602310e7524bd0a12711521fca3da01da98bddabb5d665b68ba4d1e1a62d9527d4b6376b30de3
-
Filesize
72KB
MD5eac2b233eefa7f3a42ddcbc03ca78d3e
SHA12c47aa2fac5f005b6270ba86c5d0b23145fff6c5
SHA25635db822f1b250273c78db6546a4e5b4e820c7bfc41b428c01c63b598c1226e7b
SHA51249bc592d64229275448d33d66e38a7790c7c58eff800f14ee19602310e7524bd0a12711521fca3da01da98bddabb5d665b68ba4d1e1a62d9527d4b6376b30de3
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD539ff4151cd6bc06770a6672f0921a9ed
SHA18dfa6b6dfa89b84681a7673b2337551754e550a4
SHA25691da0782a7b733d9f32e01695bbe5cf8d94f608eb836d4576b9c4908459fa282
SHA512fb36577c3a984792b641f1dc6dcb3bb2e74fd246144c02e78a2dc27308b1382fa86667545e261dc0d20ae3d5309ef989acd9d28ce888446c83e82630f01898db
-
Filesize
72KB
MD539ff4151cd6bc06770a6672f0921a9ed
SHA18dfa6b6dfa89b84681a7673b2337551754e550a4
SHA25691da0782a7b733d9f32e01695bbe5cf8d94f608eb836d4576b9c4908459fa282
SHA512fb36577c3a984792b641f1dc6dcb3bb2e74fd246144c02e78a2dc27308b1382fa86667545e261dc0d20ae3d5309ef989acd9d28ce888446c83e82630f01898db
-
Filesize
72KB
MD50ebd122fac7200de899a4a8118731913
SHA17bda13991665759672bfd905abd304577ef1be90
SHA256eced7c80d44508eddec6a268e04a66caacf72c982e6c9e1102e1cbd7a84eec2d
SHA5121df4f26ffb71ad6231cf09b73a963f18419b66ab194fca9a9fdcfbe324fbec93e2d8bb210ac9a177e41d0022441d999101347c2ee266316e3155a8d59f7a47f8
-
Filesize
72KB
MD50ebd122fac7200de899a4a8118731913
SHA17bda13991665759672bfd905abd304577ef1be90
SHA256eced7c80d44508eddec6a268e04a66caacf72c982e6c9e1102e1cbd7a84eec2d
SHA5121df4f26ffb71ad6231cf09b73a963f18419b66ab194fca9a9fdcfbe324fbec93e2d8bb210ac9a177e41d0022441d999101347c2ee266316e3155a8d59f7a47f8
-
Filesize
72KB
MD50ebd122fac7200de899a4a8118731913
SHA17bda13991665759672bfd905abd304577ef1be90
SHA256eced7c80d44508eddec6a268e04a66caacf72c982e6c9e1102e1cbd7a84eec2d
SHA5121df4f26ffb71ad6231cf09b73a963f18419b66ab194fca9a9fdcfbe324fbec93e2d8bb210ac9a177e41d0022441d999101347c2ee266316e3155a8d59f7a47f8
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5ab61a8cb53056ac8a2e304d66eb6ed45
SHA1a065e34113e57637d14729a80bddf6cd0c584c1a
SHA256ebca53563bf0f3c54215c978f9ff4854ac1e0568d674ed5340fd84607e388e04
SHA51216de5633bcb0e6ec8308b39aaf7cf0bb195b3c0ac1188fb9486ea7f9aad18d31aedb00d56111d7ae8b80a5ff47f5d5e33f130582c449bdf4a01c2648e09069d3
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5584626c78016103edaeeae4b00e9c5e9
SHA116aeb92ee72f04c7da04601360dec0cba71cd644
SHA256c8c95712475fe94cc52a28e47b4a500a8131d34aa4f97b960474f5a4258422c4
SHA512ce65dd6a945714c8fca19d318d7ffbfd0c548670f08401b4cf0ef61b53e6675cc075bc69040d572630650927561e5fdb32df4d72d8cfb5867f8bc1029590bde4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD5344f7469d98a6ff535e7516346ade77d
SHA101d890c0cd90bd08db28c8903f11be341fb50f54
SHA25636c19655575d2efd5b1698e03facb2cb15e21fa68139a0e5ccf01c8439a31349
SHA512e4e75e580f7656c4c66480e9a11b50abf254ff3c24cc197cd96c9b15caf95eae9ac8ffc0c9d270097bb30ee24074a7deaca87aab9638bd5b43ab9aed2270d4c4
-
Filesize
72KB
MD554286d841b367fd2e64b2fd39ef5d46c
SHA1d3d144dc8ee5a6a91ba5ebd07e8792e98d6fddfe
SHA2563d3a8014bff1c8729a9e700343cec0dd74f7366bd77b10159a16c2f9c3d428e5
SHA5122efa8c3857b4c184dfe118e457299fbe7d9b387e021545f102319682bbdde1d24f4a1fa59f31f1d86085dcd242903409df4254e2aee3ee5b7e4519146ed60a2c
-
Filesize
72KB
MD554286d841b367fd2e64b2fd39ef5d46c
SHA1d3d144dc8ee5a6a91ba5ebd07e8792e98d6fddfe
SHA2563d3a8014bff1c8729a9e700343cec0dd74f7366bd77b10159a16c2f9c3d428e5
SHA5122efa8c3857b4c184dfe118e457299fbe7d9b387e021545f102319682bbdde1d24f4a1fa59f31f1d86085dcd242903409df4254e2aee3ee5b7e4519146ed60a2c
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD5ea897a54a2de9ddae952a234a99d19de
SHA184d02f5ea5d29a385c7a97112cb9717b97e83496
SHA2569a5773a9780be81bd73e110089770e4587a70c15ff9909f1b7a95cf8d5b8fcbf
SHA512068e9b7f512eebde4bc54eae7a2bddab89c10f0bb55037f59b2721d080c3d768d09d8ebf179697eecc7318fec0de25d8885a981a463365415ebfc248d7c7686c
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec
-
Filesize
72KB
MD55ad93fec3ab6da8556999deedb814c23
SHA134a0d8c18cb083ae018be5efdbf8c812bb0d511c
SHA25664d33bd0b43c4c42badbb95ccc5f95a2401e5aa7e05541262e79a86775616cb8
SHA512c33754f7480d1691f0565d67f70dddf55fc41c4f95936ed7cc3c24f414e9701b42e96d87b1e64cecc7bdeeff47690b8cd143ee4ab24dac3a132d565f220524ec