Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
203s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/12/2022, 16:39
Static task
static1
Behavioral task
behavioral1
Sample
e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe
Resource
win10v2004-20220812-en
General
-
Target
e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe
-
Size
72KB
-
MD5
06a3d5ad999a6a4d2ee36f3a2a5b2529
-
SHA1
8b89024e2be5032c0ccb9bd6935b16d1e3c1c709
-
SHA256
e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b
-
SHA512
37a32d050828da1a6e0de72046afbbca3b78797bc7b5ecf51554dd49aade9ff4767a26cc59f89c5a003591b3a8de32fc472807ba95fedfb6c273a0642b4ce2ca
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf22:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPC
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 4840 backup.exe 4832 backup.exe 2196 System Restore.exe 2068 backup.exe 3020 backup.exe 4600 backup.exe 1580 backup.exe 1372 backup.exe 4760 backup.exe 4860 backup.exe 2312 data.exe 176 backup.exe 2080 backup.exe 4248 backup.exe 3620 backup.exe 3028 backup.exe 4272 backup.exe 5012 backup.exe 2580 update.exe 4160 backup.exe 3056 data.exe 1388 backup.exe 2572 backup.exe 2172 backup.exe 2408 backup.exe 372 backup.exe 2368 System Restore.exe 4424 backup.exe 4276 backup.exe 3796 System Restore.exe 3804 backup.exe 2428 backup.exe 1876 backup.exe 3348 backup.exe 2344 data.exe 4236 data.exe 2988 backup.exe 1432 backup.exe 4004 backup.exe 5104 backup.exe 2096 backup.exe 776 backup.exe 2060 backup.exe 2952 backup.exe 4032 System Restore.exe 4304 backup.exe 1300 update.exe 3932 backup.exe 404 update.exe 4648 backup.exe 4896 backup.exe 1520 backup.exe 1408 backup.exe 3012 data.exe 3284 backup.exe 2748 backup.exe 3432 backup.exe 680 backup.exe 4612 backup.exe 4000 backup.exe 4620 backup.exe 4960 backup.exe 1872 backup.exe 4240 backup.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\update.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe data.exe File opened for modification C:\Program Files\Common Files\DESIGNER\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\backup.exe update.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\data.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe data.exe File opened for modification C:\Program Files\Common Files\System\ado\fr-FR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\backup.exe update.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\backup.exe data.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\data.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe data.exe File opened for modification C:\Program Files\7-Zip\Lang\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe data.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe System Restore.exe File opened for modification C:\Program Files\Internet Explorer\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\update.exe data.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 4840 backup.exe 4832 backup.exe 2196 System Restore.exe 2068 backup.exe 3020 backup.exe 4600 backup.exe 1580 backup.exe 1372 backup.exe 4860 backup.exe 4760 backup.exe 2312 data.exe 176 backup.exe 2080 backup.exe 4248 backup.exe 3620 backup.exe 3028 backup.exe 4272 backup.exe 5012 backup.exe 2580 update.exe 4160 backup.exe 3056 data.exe 1388 backup.exe 2572 backup.exe 2172 backup.exe 2408 backup.exe 372 backup.exe 2368 System Restore.exe 4424 backup.exe 2428 backup.exe 3804 backup.exe 1876 backup.exe 3796 System Restore.exe 4276 backup.exe 3348 backup.exe 2344 data.exe 4236 data.exe 2988 backup.exe 1432 backup.exe 4004 backup.exe 776 backup.exe 5104 backup.exe 2096 backup.exe 2060 backup.exe 2952 backup.exe 4304 backup.exe 1300 update.exe 4032 System Restore.exe 4648 backup.exe 404 update.exe 3932 backup.exe 4896 backup.exe 1520 backup.exe 1408 backup.exe 3012 data.exe 3284 backup.exe 2748 backup.exe 680 backup.exe 3432 backup.exe 4000 backup.exe 4620 backup.exe 4612 backup.exe 4960 backup.exe 1872 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 848 wrote to memory of 4840 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 79 PID 848 wrote to memory of 4840 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 79 PID 848 wrote to memory of 4840 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 79 PID 848 wrote to memory of 4832 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 80 PID 848 wrote to memory of 4832 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 80 PID 848 wrote to memory of 4832 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 80 PID 848 wrote to memory of 2196 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 81 PID 848 wrote to memory of 2196 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 81 PID 848 wrote to memory of 2196 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 81 PID 4840 wrote to memory of 2068 4840 backup.exe 82 PID 4840 wrote to memory of 2068 4840 backup.exe 82 PID 4840 wrote to memory of 2068 4840 backup.exe 82 PID 848 wrote to memory of 3020 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 83 PID 848 wrote to memory of 3020 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 83 PID 848 wrote to memory of 3020 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 83 PID 848 wrote to memory of 4600 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 84 PID 848 wrote to memory of 4600 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 84 PID 848 wrote to memory of 4600 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 84 PID 2068 wrote to memory of 1580 2068 backup.exe 85 PID 2068 wrote to memory of 1580 2068 backup.exe 85 PID 2068 wrote to memory of 1580 2068 backup.exe 85 PID 848 wrote to memory of 1372 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 86 PID 848 wrote to memory of 1372 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 86 PID 848 wrote to memory of 1372 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 86 PID 2068 wrote to memory of 4760 2068 backup.exe 87 PID 2068 wrote to memory of 4760 2068 backup.exe 87 PID 2068 wrote to memory of 4760 2068 backup.exe 87 PID 848 wrote to memory of 4860 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 88 PID 848 wrote to memory of 4860 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 88 PID 848 wrote to memory of 4860 848 e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe 88 PID 2068 wrote to memory of 2312 2068 backup.exe 89 PID 2068 wrote to memory of 2312 2068 backup.exe 89 PID 2068 wrote to memory of 2312 2068 backup.exe 89 PID 2312 wrote to memory of 176 2312 data.exe 90 PID 2312 wrote to memory of 176 2312 data.exe 90 PID 2312 wrote to memory of 176 2312 data.exe 90 PID 176 wrote to memory of 2080 176 backup.exe 91 PID 176 wrote to memory of 2080 176 backup.exe 91 PID 176 wrote to memory of 2080 176 backup.exe 91 PID 2312 wrote to memory of 4248 2312 data.exe 92 PID 2312 wrote to memory of 4248 2312 data.exe 92 PID 2312 wrote to memory of 4248 2312 data.exe 92 PID 4248 wrote to memory of 3620 4248 backup.exe 93 PID 4248 wrote to memory of 3620 4248 backup.exe 93 PID 4248 wrote to memory of 3620 4248 backup.exe 93 PID 4248 wrote to memory of 3028 4248 backup.exe 94 PID 4248 wrote to memory of 3028 4248 backup.exe 94 PID 4248 wrote to memory of 3028 4248 backup.exe 94 PID 3028 wrote to memory of 4272 3028 backup.exe 95 PID 3028 wrote to memory of 4272 3028 backup.exe 95 PID 3028 wrote to memory of 4272 3028 backup.exe 95 PID 3028 wrote to memory of 5012 3028 backup.exe 96 PID 3028 wrote to memory of 5012 3028 backup.exe 96 PID 3028 wrote to memory of 5012 3028 backup.exe 96 PID 5012 wrote to memory of 2580 5012 backup.exe 97 PID 5012 wrote to memory of 2580 5012 backup.exe 97 PID 5012 wrote to memory of 2580 5012 backup.exe 97 PID 5012 wrote to memory of 4160 5012 backup.exe 98 PID 5012 wrote to memory of 4160 5012 backup.exe 98 PID 5012 wrote to memory of 4160 5012 backup.exe 98 PID 5012 wrote to memory of 3056 5012 backup.exe 99 PID 5012 wrote to memory of 3056 5012 backup.exe 99 PID 5012 wrote to memory of 3056 5012 backup.exe 99 PID 5012 wrote to memory of 1388 5012 backup.exe 100 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe"C:\Users\Admin\AppData\Local\Temp\e0ca4a9a7aedf331c4427e7244c0b6b57bc3a18691a2a6947dafb3541c95786b.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\1988491009\backup.exeC:\Users\Admin\AppData\Local\Temp\1988491009\backup.exe C:\Users\Admin\AppData\Local\Temp\1988491009\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4840 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2068 -
C:\odt\backup.exeC:\odt\backup.exe C:\odt\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1580
-
-
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
C:\Program Files\data.exe"C:\Program Files\data.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:176 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2080
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Program Files\Common Files\DESIGNER\backup.exe"C:\Program Files\Common Files\DESIGNER\backup.exe" C:\Program Files\Common Files\DESIGNER\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
C:\Program Files\Common Files\microsoft shared\backup.exe"C:\Program Files\Common Files\microsoft shared\backup.exe" C:\Program Files\Common Files\microsoft shared\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe"C:\Program Files\Common Files\microsoft shared\ClickToRun\backup.exe" C:\Program Files\Common Files\microsoft shared\ClickToRun\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4272
-
-
C:\Program Files\Common Files\microsoft shared\ink\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5012 -
C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe"C:\Program Files\Common Files\microsoft shared\ink\ar-SA\update.exe" C:\Program Files\Common Files\microsoft shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2580
-
-
C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4160
-
-
C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\data.exe"C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\data.exe" C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3056
-
-
C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1388
-
-
C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2572
-
-
C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\el-GR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2172
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-GB\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-GB\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2408
-
-
C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\en-US\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:372
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe"C:\Program Files\Common Files\microsoft shared\ink\es-ES\System Restore.exe" C:\Program Files\Common Files\microsoft shared\ink\es-ES\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2368
-
-
C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\es-MX\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\es-MX\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1876
-
-
C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fi-FI\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2060
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-CA\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-CA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4304
-
-
C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fr-FR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1408
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4960 -
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\9⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3528
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2596
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
PID:4712
-
-
C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\9⤵PID:4520
-
-
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3804 -
C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1432
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\update.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\update.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:404
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2748
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3620
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\data.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\data.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4552
-
-
C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:3980
-
-
-
C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\data.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4236 -
C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe"C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\backup.exe" C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:776
-
-
-
C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\System Restore.exe"C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\System Restore.exe" C:\Program Files\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4032
-
-
C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe"C:\Program Files\Common Files\microsoft shared\Source Engine\backup.exe" C:\Program Files\Common Files\microsoft shared\Source Engine\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:680
-
-
C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe"C:\Program Files\Common Files\microsoft shared\Stationery\backup.exe" C:\Program Files\Common Files\microsoft shared\Stationery\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- System policy modification
PID:4240
-
-
C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1664 -
C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe"C:\Program Files\Common Files\microsoft shared\TextConv\en-US\backup.exe" C:\Program Files\Common Files\microsoft shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2464
-
-
-
C:\Program Files\Common Files\microsoft shared\Triedit\data.exe"C:\Program Files\Common Files\microsoft shared\Triedit\data.exe" C:\Program Files\Common Files\microsoft shared\Triedit\7⤵PID:4064
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2428
-
-
C:\Program Files\Common Files\System\data.exe"C:\Program Files\Common Files\System\data.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2344 -
C:\Program Files\Common Files\System\ado\update.exe"C:\Program Files\Common Files\System\ado\update.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1300 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4612
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4444
-
-
C:\Program Files\Common Files\System\ado\fr-FR\backup.exe"C:\Program Files\Common Files\System\ado\fr-FR\backup.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:3864
-
-
C:\Program Files\Common Files\System\ado\it-IT\backup.exe"C:\Program Files\Common Files\System\ado\it-IT\backup.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵PID:3656
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:2760
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4276 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4004 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4896 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\data.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3012 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3432
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Installer\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3020
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Locales\9⤵
- System policy modification
PID:4048
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\MEIPreload\9⤵PID:540
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵
- Modifies visibility of file extensions in Explorer
PID:3396
-
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:2988 -
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2952
-
-
C:\Program Files\Internet Explorer\en-US\backup.exe"C:\Program Files\Internet Explorer\en-US\backup.exe" C:\Program Files\Internet Explorer\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1520
-
-
C:\Program Files\Internet Explorer\es-ES\backup.exe"C:\Program Files\Internet Explorer\es-ES\backup.exe" C:\Program Files\Internet Explorer\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3284
-
-
C:\Program Files\Internet Explorer\fr-FR\backup.exe"C:\Program Files\Internet Explorer\fr-FR\backup.exe" C:\Program Files\Internet Explorer\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1872
-
-
C:\Program Files\Internet Explorer\images\backup.exe"C:\Program Files\Internet Explorer\images\backup.exe" C:\Program Files\Internet Explorer\images\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:4720
-
-
C:\Program Files\Internet Explorer\it-IT\backup.exe"C:\Program Files\Internet Explorer\it-IT\backup.exe" C:\Program Files\Internet Explorer\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:3668
-
-
C:\Program Files\Internet Explorer\ja-JP\backup.exe"C:\Program Files\Internet Explorer\ja-JP\backup.exe" C:\Program Files\Internet Explorer\ja-JP\6⤵
- System policy modification
PID:3840
-
-
C:\Program Files\Internet Explorer\SIGNUP\backup.exe"C:\Program Files\Internet Explorer\SIGNUP\backup.exe" C:\Program Files\Internet Explorer\SIGNUP\6⤵PID:1396
-
-
-
-
C:\Program Files (x86)\System Restore.exe"C:\Program Files (x86)\System Restore.exe" C:\Program Files (x86)\4⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3796 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:5104 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:4648 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Esl\7⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4620
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
- System policy modification
PID:2888 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:4312 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\9⤵
- System policy modification
PID:4384
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\8⤵
- Drops file in Program Files directory
PID:4716
-
-
-
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3348 -
C:\Users\Admin\backup.exeC:\Users\Admin\backup.exe C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2096 -
C:\Users\Admin\3D Objects\backup.exe"C:\Users\Admin\3D Objects\backup.exe" C:\Users\Admin\3D Objects\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3932
-
-
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4000
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:4724
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Disables RegEdit via registry modification
- System policy modification
PID:3064
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:2368
-
-
C:\Users\Admin\Favorites\backup.exeC:\Users\Admin\Favorites\backup.exe C:\Users\Admin\Favorites\6⤵PID:3460
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exeC:\Users\Admin\AppData\Local\Temp\acrocef_low\backup.exe C:\Users\Admin\AppData\Local\Temp\acrocef_low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4832
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2196
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3020
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4600
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:4860
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\backup.exe" C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\locales\1⤵PID:2168
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5a10a5d0d0a1886d6520253f7d021a71f
SHA1457982e17220ef6f3ef5cd688a89fd91bb52035b
SHA256cdd9dc8b9d5d73b97c9dcec8e3c96ef7afa5593f7d930fcb7c8aeab6b3c0f803
SHA512d1399611ef9532fa17a045e188fee6f6ff44226717a731aecb8b514dfda93ceb31bcacb357e46f674da0f526573efbd2c41a76c61ce095d89efe06d12f818064
-
Filesize
72KB
MD5a10a5d0d0a1886d6520253f7d021a71f
SHA1457982e17220ef6f3ef5cd688a89fd91bb52035b
SHA256cdd9dc8b9d5d73b97c9dcec8e3c96ef7afa5593f7d930fcb7c8aeab6b3c0f803
SHA512d1399611ef9532fa17a045e188fee6f6ff44226717a731aecb8b514dfda93ceb31bcacb357e46f674da0f526573efbd2c41a76c61ce095d89efe06d12f818064
-
Filesize
72KB
MD5834ba185d69d914dead8ae23cc21adaa
SHA1c973a42fc6c23c4b0e80f52f2245a2ab3d72522d
SHA256edbc1181a1bba784656df400a282ed6ebe302f233d4038d759382cf9ea89b2cb
SHA5122fac1068f4b1ce51a77f55e921daf7038d06fbb7074a6ccb3269c8b6efbedb35bc13a08e8352106de4bfb728647f8ada65e83baaaaa0f3031b6e463b626b9061
-
Filesize
72KB
MD5173b26f4dc94c43193980a4b894ebe5e
SHA172cb6fa63f43832c4a2eef97ea07fa717cd08221
SHA25660d4c3a640b12ea4ed02cd03e6971fcb25afdb0e3e30d8e3585687995753d983
SHA512c32031f811e9d4333c915ba89577dff9e6838d24dc2af639b142dc6c735cbc58c15a9a461cba7f8852ae51c47ffae20b33963f4f93ccf7055702dfc1f4db3d41
-
Filesize
72KB
MD5173b26f4dc94c43193980a4b894ebe5e
SHA172cb6fa63f43832c4a2eef97ea07fa717cd08221
SHA25660d4c3a640b12ea4ed02cd03e6971fcb25afdb0e3e30d8e3585687995753d983
SHA512c32031f811e9d4333c915ba89577dff9e6838d24dc2af639b142dc6c735cbc58c15a9a461cba7f8852ae51c47ffae20b33963f4f93ccf7055702dfc1f4db3d41
-
Filesize
72KB
MD53b2520ec97a1100d0495f7f59f121519
SHA1a6a6bbbb0c85c1406c85f10162d89ee6b70e8d2b
SHA2563d7e47cf49c1eb7d3cdff83d6db35dcf969c90812e21e8df87b66509cf5ab33f
SHA512527ed24622404fc3b67651652f02e6a66256124aa2320350d335b2ffe3779ecf3dc41ae54341c1654035070029b769686fe39dd7806b6519cd79e2208d90c93a
-
Filesize
72KB
MD53b2520ec97a1100d0495f7f59f121519
SHA1a6a6bbbb0c85c1406c85f10162d89ee6b70e8d2b
SHA2563d7e47cf49c1eb7d3cdff83d6db35dcf969c90812e21e8df87b66509cf5ab33f
SHA512527ed24622404fc3b67651652f02e6a66256124aa2320350d335b2ffe3779ecf3dc41ae54341c1654035070029b769686fe39dd7806b6519cd79e2208d90c93a
-
Filesize
72KB
MD502b43dcec1ccb678676f1d07606af8dd
SHA18c7d8b3be54f47249bd9c86aab7f0af9fd889121
SHA25675f6cabb368ddfae2630e90e209a26dc93aecd7c4b73bf57610d788bbe3e38ca
SHA51292ef04f3639f4252f59c554b52388b7a2629353f8c37b0366fdc8ce6c3655f3e4586116cffcb49e04718f60bafb3f75d9badf35313223737bc334fffc6890c50
-
Filesize
72KB
MD502b43dcec1ccb678676f1d07606af8dd
SHA18c7d8b3be54f47249bd9c86aab7f0af9fd889121
SHA25675f6cabb368ddfae2630e90e209a26dc93aecd7c4b73bf57610d788bbe3e38ca
SHA51292ef04f3639f4252f59c554b52388b7a2629353f8c37b0366fdc8ce6c3655f3e4586116cffcb49e04718f60bafb3f75d9badf35313223737bc334fffc6890c50
-
Filesize
72KB
MD5d88bb708fcaf56bfc7c8e078cc24fd16
SHA160e545dd3e2c0a49d0f33dbebada12d45b37e749
SHA25677afdd9985b1f615583d40671b5303ddab966e30b65ed22b9fba3300aeb1d306
SHA512c1a66594c36e12aa018d72e23b609b3a29d9f631fac6d7ce3fae444dbfc5e00b622be3293a119b2ea91894dfc945b3bf3c82e0ef9757ed1bdc5b104112931957
-
Filesize
72KB
MD5d88bb708fcaf56bfc7c8e078cc24fd16
SHA160e545dd3e2c0a49d0f33dbebada12d45b37e749
SHA25677afdd9985b1f615583d40671b5303ddab966e30b65ed22b9fba3300aeb1d306
SHA512c1a66594c36e12aa018d72e23b609b3a29d9f631fac6d7ce3fae444dbfc5e00b622be3293a119b2ea91894dfc945b3bf3c82e0ef9757ed1bdc5b104112931957
-
Filesize
72KB
MD5e1b82d9df21854d9e0b033a08af3aef3
SHA16c351528da877556bf8179b8b96cfd57bde39e64
SHA256aec228c1228a22c3725b6f9086d534a0b96618d8c7230720d9cc6b8e27a0cb51
SHA512de7bd92cae0530aed42fbe7d4c2207d510175602c17d1fe37df6820f411825d0f971a60c1edbf426f9ded0408116e6d92034e7a1008993c795b0da4b88f642fd
-
Filesize
72KB
MD5e1b82d9df21854d9e0b033a08af3aef3
SHA16c351528da877556bf8179b8b96cfd57bde39e64
SHA256aec228c1228a22c3725b6f9086d534a0b96618d8c7230720d9cc6b8e27a0cb51
SHA512de7bd92cae0530aed42fbe7d4c2207d510175602c17d1fe37df6820f411825d0f971a60c1edbf426f9ded0408116e6d92034e7a1008993c795b0da4b88f642fd
-
Filesize
72KB
MD5bbebaaf985ffbcc14b002500d0f94680
SHA1f7b958511b1cdfe9b045b094c43b7c50cd67a59f
SHA256adae066f0c5ed2555edbe5576e182fdeab5d45fe8f7c506d028fbd22a9b11693
SHA512d0ee64b5ea3bb2dc91aa67a031860fbb91a780d48af3d955197592b3b71818038e7608b3ffc8a1e56b5d1ea222ae0ac8becd12472ff012a290ed587c73029f1c
-
Filesize
72KB
MD5bbebaaf985ffbcc14b002500d0f94680
SHA1f7b958511b1cdfe9b045b094c43b7c50cd67a59f
SHA256adae066f0c5ed2555edbe5576e182fdeab5d45fe8f7c506d028fbd22a9b11693
SHA512d0ee64b5ea3bb2dc91aa67a031860fbb91a780d48af3d955197592b3b71818038e7608b3ffc8a1e56b5d1ea222ae0ac8becd12472ff012a290ed587c73029f1c
-
Filesize
72KB
MD55b20afae505d914bd2f47f42b29b28f7
SHA1defc85e8e6d86b42ae07628155fb534c8801cf4c
SHA256e3bdc89fb2ee9a5303e38227ce0fc4e75050f4cf1831b08370c4774979f8602e
SHA5122e7b3698e30a0d47ef32245d3a577ebe31143781e6cee2658901ec4ef2f1a8f97e7be8735dd2af533dd523f8553160407f0cca9d89e15684d9898b9c7e49dd1b
-
Filesize
72KB
MD55b20afae505d914bd2f47f42b29b28f7
SHA1defc85e8e6d86b42ae07628155fb534c8801cf4c
SHA256e3bdc89fb2ee9a5303e38227ce0fc4e75050f4cf1831b08370c4774979f8602e
SHA5122e7b3698e30a0d47ef32245d3a577ebe31143781e6cee2658901ec4ef2f1a8f97e7be8735dd2af533dd523f8553160407f0cca9d89e15684d9898b9c7e49dd1b
-
Filesize
72KB
MD581f6bf53446f447fe7e330c1c77bff17
SHA16aba11dd5f12a81c8d2f2f53dfecaf1d20ef0362
SHA2566337885939e838d7674e3dead6eaef8df64a127a470c5c921456a1897f859cd3
SHA5124f0dbbda52b5ba7458b77f6b1ccc5d4bc29ca69d37c39f9041c010f7feef7525df9454448eb948796fb948e3cfd6dde5c3da7c0a0811e3f2fdb4d15058d79d37
-
Filesize
72KB
MD581f6bf53446f447fe7e330c1c77bff17
SHA16aba11dd5f12a81c8d2f2f53dfecaf1d20ef0362
SHA2566337885939e838d7674e3dead6eaef8df64a127a470c5c921456a1897f859cd3
SHA5124f0dbbda52b5ba7458b77f6b1ccc5d4bc29ca69d37c39f9041c010f7feef7525df9454448eb948796fb948e3cfd6dde5c3da7c0a0811e3f2fdb4d15058d79d37
-
Filesize
72KB
MD5a78179a9413c403147fb69d7d106a5eb
SHA1f49ed76007e6c09c0313abc346216cfe41c12fcb
SHA2564a5086dcc0921610fbbe5c8ce5a53a353ffa6ed6bd589af416361c1eb018e40c
SHA512b3c17076abd06250d2ebc142a9115d9c9c8eb1620d966dc188a98ef4c671a63e594d1c704da347f9592d7b4c4d44b5dc3fa52c4174a35e823cc6d945e1d45f3f
-
Filesize
72KB
MD5a78179a9413c403147fb69d7d106a5eb
SHA1f49ed76007e6c09c0313abc346216cfe41c12fcb
SHA2564a5086dcc0921610fbbe5c8ce5a53a353ffa6ed6bd589af416361c1eb018e40c
SHA512b3c17076abd06250d2ebc142a9115d9c9c8eb1620d966dc188a98ef4c671a63e594d1c704da347f9592d7b4c4d44b5dc3fa52c4174a35e823cc6d945e1d45f3f
-
Filesize
72KB
MD5c8d59f3999066f4a5232ca737696ef68
SHA14f3254256def0fce0a33d286139c6ad98c2beb44
SHA25694d35685f9f4d6acc8cfe0022e3877450132b638100d4e997d1294127e375cf9
SHA5124854c42e0fd64ac7559883419d95aa1320aac5624ef135c84ca19eeba8c2b99c4b97cb6f21d086066caf922c048da6939d60fa115943fbe5243e9688cffc33f6
-
Filesize
72KB
MD5c8d59f3999066f4a5232ca737696ef68
SHA14f3254256def0fce0a33d286139c6ad98c2beb44
SHA25694d35685f9f4d6acc8cfe0022e3877450132b638100d4e997d1294127e375cf9
SHA5124854c42e0fd64ac7559883419d95aa1320aac5624ef135c84ca19eeba8c2b99c4b97cb6f21d086066caf922c048da6939d60fa115943fbe5243e9688cffc33f6
-
Filesize
72KB
MD5c92453a8d366eee2d121090db9689699
SHA13cdbd7a90b71d91b6c017337dac981fa789e4b3c
SHA256a0d3252a9734cb4643f386a511d77a28f00247e023b540396350c698de3c70ac
SHA512f075d42693ec6ef69faa48b41f89bc0e886f4d5f87f85218cf0ee0ecb76acdab444ec3a4c1af47ed75689a4140a4d3b0ac5448c0c862e042c58e9cee379f1a62
-
Filesize
72KB
MD5c92453a8d366eee2d121090db9689699
SHA13cdbd7a90b71d91b6c017337dac981fa789e4b3c
SHA256a0d3252a9734cb4643f386a511d77a28f00247e023b540396350c698de3c70ac
SHA512f075d42693ec6ef69faa48b41f89bc0e886f4d5f87f85218cf0ee0ecb76acdab444ec3a4c1af47ed75689a4140a4d3b0ac5448c0c862e042c58e9cee379f1a62
-
Filesize
72KB
MD5c92453a8d366eee2d121090db9689699
SHA13cdbd7a90b71d91b6c017337dac981fa789e4b3c
SHA256a0d3252a9734cb4643f386a511d77a28f00247e023b540396350c698de3c70ac
SHA512f075d42693ec6ef69faa48b41f89bc0e886f4d5f87f85218cf0ee0ecb76acdab444ec3a4c1af47ed75689a4140a4d3b0ac5448c0c862e042c58e9cee379f1a62
-
Filesize
72KB
MD5c92453a8d366eee2d121090db9689699
SHA13cdbd7a90b71d91b6c017337dac981fa789e4b3c
SHA256a0d3252a9734cb4643f386a511d77a28f00247e023b540396350c698de3c70ac
SHA512f075d42693ec6ef69faa48b41f89bc0e886f4d5f87f85218cf0ee0ecb76acdab444ec3a4c1af47ed75689a4140a4d3b0ac5448c0c862e042c58e9cee379f1a62
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD54be543a76fbc00ad34e9472b7f963d50
SHA126104d467e55406f4d6a1f1db7fb8f9cac296921
SHA256c66099d678a9751ff36f3980000318cbccf9f202c58153ae1a4abe488f1125c3
SHA5127b2904f52a8064189f44593d516bff90518612395c6f28f21a356655a6b8e4cdd34cde054060c46ef1b02480473f2c149367da9dadaf09388e77cdb43525074b
-
Filesize
72KB
MD5dc34ec03f8ae4934733eefedbb5bad33
SHA1d81dff1b2a742445d3923702619d4428f39fe200
SHA256a565eb4a93b4426ee7bddd1a1c7be567d0c38412bfc03892092cd986ead2dfb5
SHA51292b08425f65741590c90d5b7e73308c0cab7d8914be7a98c734f90cdf0a8f7e4d4bd96a2f549822fb20fdf9c8ad7fef505d283f1743424abff66f82c9ee2e403
-
Filesize
72KB
MD5dc34ec03f8ae4934733eefedbb5bad33
SHA1d81dff1b2a742445d3923702619d4428f39fe200
SHA256a565eb4a93b4426ee7bddd1a1c7be567d0c38412bfc03892092cd986ead2dfb5
SHA51292b08425f65741590c90d5b7e73308c0cab7d8914be7a98c734f90cdf0a8f7e4d4bd96a2f549822fb20fdf9c8ad7fef505d283f1743424abff66f82c9ee2e403
-
Filesize
72KB
MD52bea238e2b551e2067ba3aa405fc088a
SHA15534c8911417997b3e8c454e5880c8a873a4c3e8
SHA256535a1b1c8beb5c54cbb2d854c8d58a89bc6dc20bf10f8ac5cf411a77895277f6
SHA512330eb4ee3cdb46103f2cbf38d1bcba1272aa62756429969a3bcabff34bd02bccf355a0c203f60e257f60bb6eb2cd7d3da6096d0cec28b01a9797674641f2e9d9
-
Filesize
72KB
MD5b9220e8037554d23386eeffebb027023
SHA16902762fd39936bc1d00686e89cd4ed047552d29
SHA256c20be27bdef332f28b0ce609729a080edd6ee68f103c81e7d0e5a25a16a75281
SHA51250a36dde95f43ffab1446bcf5c54a0438cc62d194a88f420203ffd4a33882c4a9bddd4fce49d5c705b081e794d35f83ff6749159651fa5e0dcfe30702caf175e
-
Filesize
72KB
MD5b9220e8037554d23386eeffebb027023
SHA16902762fd39936bc1d00686e89cd4ed047552d29
SHA256c20be27bdef332f28b0ce609729a080edd6ee68f103c81e7d0e5a25a16a75281
SHA51250a36dde95f43ffab1446bcf5c54a0438cc62d194a88f420203ffd4a33882c4a9bddd4fce49d5c705b081e794d35f83ff6749159651fa5e0dcfe30702caf175e
-
Filesize
72KB
MD5a10a5d0d0a1886d6520253f7d021a71f
SHA1457982e17220ef6f3ef5cd688a89fd91bb52035b
SHA256cdd9dc8b9d5d73b97c9dcec8e3c96ef7afa5593f7d930fcb7c8aeab6b3c0f803
SHA512d1399611ef9532fa17a045e188fee6f6ff44226717a731aecb8b514dfda93ceb31bcacb357e46f674da0f526573efbd2c41a76c61ce095d89efe06d12f818064
-
Filesize
72KB
MD5a10a5d0d0a1886d6520253f7d021a71f
SHA1457982e17220ef6f3ef5cd688a89fd91bb52035b
SHA256cdd9dc8b9d5d73b97c9dcec8e3c96ef7afa5593f7d930fcb7c8aeab6b3c0f803
SHA512d1399611ef9532fa17a045e188fee6f6ff44226717a731aecb8b514dfda93ceb31bcacb357e46f674da0f526573efbd2c41a76c61ce095d89efe06d12f818064
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
Filesize
72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5aadc95c2aaeb1f5b987877223df1ad0d
SHA109d86336c2c31ad9b91c44d1c40bdc5f97f5d034
SHA256a053ddb0e3b44a36db407df6a23f1f37130d169e3d9a196acfb138251354fe78
SHA51259139ec2fde8d75bcc73e59fa787fd1ee663b51939fbeba5872485ccb79a413169e47d077f9fb75c9175137631d3644f16010991e9c976787723dff027e8565f
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5b9083786f30fdcad00a075e7f0001ee0
SHA1149ad040fe49b74286685241af879c2078459b3e
SHA25641fafb6c2f54839d84d667575957b2a2bd2d1fd5787ee499172675552f91bf98
SHA512af634fe8e60a5da9317ac16e890458ad2102a4e28e1f01d4d48610d9e4304fd324dd8cff640a4a2771de8c00dba01d7cbcf572c2458911fa59d2f71ab20b388f
-
Filesize
72KB
MD5088f0823ad7f3dd992a0337b365948b2
SHA1b9422387b05b1ad1ed9e7cb14f2c9cd569568ca5
SHA256355cf4cc2ed4e22137d9923c1a6429bb93c0c7d862db43bbf013be9a4b689f76
SHA5123152fe1c68c7a18d4ac6dace5038e65bfa560b00cf2bcf9dea9a3b4566f7576e64a04bfdf88b723362a5a63015fa664d0a668564f4ef7c133d60a0eab0ce95dc
-
Filesize
72KB
MD5088f0823ad7f3dd992a0337b365948b2
SHA1b9422387b05b1ad1ed9e7cb14f2c9cd569568ca5
SHA256355cf4cc2ed4e22137d9923c1a6429bb93c0c7d862db43bbf013be9a4b689f76
SHA5123152fe1c68c7a18d4ac6dace5038e65bfa560b00cf2bcf9dea9a3b4566f7576e64a04bfdf88b723362a5a63015fa664d0a668564f4ef7c133d60a0eab0ce95dc
-
Filesize
72KB
MD5d82caf64c6c44e08d4826aeef13b8447
SHA1d539c3ce0500f56d2e411b7e1c1303a35af291fb
SHA2569fd1b47e8cdbe3f459ed091bc9a08752f1ce926f022e360f59410be514729f44
SHA5123cddf0a7946ae27f6ee8d3bba97870edd6fa7385afcde7b37cabe7f5bf0daa0917bae577c6358e312bd9a4c65635092f541334ad8d0803ccbf3c91267d4943aa
-
Filesize
72KB
MD5d82caf64c6c44e08d4826aeef13b8447
SHA1d539c3ce0500f56d2e411b7e1c1303a35af291fb
SHA2569fd1b47e8cdbe3f459ed091bc9a08752f1ce926f022e360f59410be514729f44
SHA5123cddf0a7946ae27f6ee8d3bba97870edd6fa7385afcde7b37cabe7f5bf0daa0917bae577c6358e312bd9a4c65635092f541334ad8d0803ccbf3c91267d4943aa
-
Filesize
72KB
MD5d65543d8f53e60faa4f7991aa4fc4805
SHA12e6769b12f342e628625089076dbc0e3b7849619
SHA2564704048c8441adc9a313e7b2c2d60fd26d925c1ea7f3913d5ed95c09930eda7b
SHA5129bb4418056db5a1b406351240eb8b6524718e7055fe9e6d940be9864b7160adf5dcd3f49820e2db921743e802c3777f81e74d5ad53a9a91a831d3a2b4f8269a6
-
Filesize
72KB
MD5d65543d8f53e60faa4f7991aa4fc4805
SHA12e6769b12f342e628625089076dbc0e3b7849619
SHA2564704048c8441adc9a313e7b2c2d60fd26d925c1ea7f3913d5ed95c09930eda7b
SHA5129bb4418056db5a1b406351240eb8b6524718e7055fe9e6d940be9864b7160adf5dcd3f49820e2db921743e802c3777f81e74d5ad53a9a91a831d3a2b4f8269a6