Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
265s -
max time network
336s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 19:26
Static task
static1
Behavioral task
behavioral1
Sample
429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe
Resource
win10v2004-20220901-en
General
-
Target
429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe
-
Size
72KB
-
MD5
08d5bd2894b1c8339ea9b024203b9be6
-
SHA1
f12bb866721524a49782454b81c6845803f541c8
-
SHA256
429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b
-
SHA512
ce26621688a0a4e44215f35b3a448b23b170f9d9920fdbad99c4644e0e3f6db7d4a071ea1208d93e7b8dc309dc7474fa3caef0204c74f17b7a4368bcf1ee921d
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2x:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPF
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1160 backup.exe 1040 data.exe 1860 backup.exe 984 backup.exe 1780 backup.exe 1384 backup.exe 848 backup.exe 936 backup.exe 1928 backup.exe 1312 System Restore.exe 1948 backup.exe 1108 backup.exe 2024 System Restore.exe 1056 backup.exe 1628 backup.exe 1920 backup.exe 1560 backup.exe 1960 data.exe 1396 backup.exe 844 backup.exe 1964 backup.exe 560 backup.exe 852 backup.exe 1236 backup.exe 1384 backup.exe 1616 backup.exe 1388 backup.exe 2012 System Restore.exe 836 System Restore.exe 1300 System Restore.exe 1376 backup.exe 1012 backup.exe 1216 System Restore.exe 1712 backup.exe 1684 backup.exe 1728 backup.exe 1720 backup.exe 972 System Restore.exe 956 backup.exe 1792 backup.exe 1920 System Restore.exe 924 backup.exe 1824 backup.exe 616 backup.exe 1212 backup.exe 1328 backup.exe 1544 backup.exe 1868 backup.exe 1780 backup.exe 1964 backup.exe 1052 data.exe 1760 backup.exe 1528 backup.exe 1936 backup.exe 1060 backup.exe 1680 backup.exe 1652 backup.exe 1996 backup.exe 1700 backup.exe 1876 backup.exe 2008 backup.exe 1720 backup.exe 1584 backup.exe 1960 backup.exe -
Loads dropped DLL 64 IoCs
pid Process 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 936 backup.exe 936 backup.exe 1928 backup.exe 1928 backup.exe 936 backup.exe 936 backup.exe 1948 backup.exe 1948 backup.exe 1108 backup.exe 1108 backup.exe 1948 backup.exe 1948 backup.exe 1056 backup.exe 1056 backup.exe 1628 backup.exe 1628 backup.exe 1628 backup.exe 1628 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 1560 backup.exe 936 backup.exe 1560 backup.exe 936 backup.exe 1948 backup.exe 1948 backup.exe 1056 backup.exe 1056 backup.exe 1628 backup.exe 1628 backup.exe 1560 backup.exe 1948 backup.exe 936 backup.exe 1628 backup.exe 936 backup.exe 1948 backup.exe 1056 backup.exe 1056 backup.exe 1628 backup.exe 1560 backup.exe 1384 backup.exe 1384 backup.exe 1388 backup.exe 1560 backup.exe -
Drops file in Program Files directory 61 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe System Restore.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Google\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Services\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\it-IT\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe backup.exe File opened for modification C:\Program Files\Internet Explorer\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\Lang\System Restore.exe backup.exe File opened for modification C:\Program Files\DVD Maker\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe backup.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe File opened for modification C:\Windows\addins\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 1160 backup.exe 1040 data.exe 1860 backup.exe 984 backup.exe 1780 backup.exe 1384 backup.exe 848 backup.exe 936 backup.exe 1928 backup.exe 1312 System Restore.exe 1948 backup.exe 1108 backup.exe 2024 System Restore.exe 1056 backup.exe 1628 backup.exe 1920 backup.exe 1560 backup.exe 1960 data.exe 1396 backup.exe 844 backup.exe 1964 backup.exe 1384 backup.exe 1236 backup.exe 560 backup.exe 1616 backup.exe 852 backup.exe 1300 System Restore.exe 2012 System Restore.exe 836 System Restore.exe 1388 backup.exe 1376 backup.exe 1012 backup.exe 1712 backup.exe 1720 backup.exe 972 System Restore.exe 1728 backup.exe 1792 backup.exe 1684 backup.exe 956 backup.exe 1920 System Restore.exe 1216 System Restore.exe 924 backup.exe 1212 backup.exe 616 backup.exe 1824 backup.exe 1544 backup.exe 1328 backup.exe 1868 backup.exe 1964 backup.exe 1780 backup.exe 1052 data.exe 1060 backup.exe 1528 backup.exe 1936 backup.exe 1760 backup.exe 1652 backup.exe 1680 backup.exe 1996 backup.exe 1700 backup.exe 1876 backup.exe 1960 backup.exe 1720 backup.exe 2008 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 472 wrote to memory of 1160 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 28 PID 472 wrote to memory of 1160 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 28 PID 472 wrote to memory of 1160 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 28 PID 472 wrote to memory of 1160 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 28 PID 472 wrote to memory of 1040 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 29 PID 472 wrote to memory of 1040 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 29 PID 472 wrote to memory of 1040 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 29 PID 472 wrote to memory of 1040 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 29 PID 472 wrote to memory of 1860 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 30 PID 472 wrote to memory of 1860 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 30 PID 472 wrote to memory of 1860 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 30 PID 472 wrote to memory of 1860 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 30 PID 472 wrote to memory of 984 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 31 PID 472 wrote to memory of 984 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 31 PID 472 wrote to memory of 984 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 31 PID 472 wrote to memory of 984 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 31 PID 472 wrote to memory of 1780 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 32 PID 472 wrote to memory of 1780 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 32 PID 472 wrote to memory of 1780 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 32 PID 472 wrote to memory of 1780 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 32 PID 472 wrote to memory of 1384 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 33 PID 472 wrote to memory of 1384 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 33 PID 472 wrote to memory of 1384 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 33 PID 472 wrote to memory of 1384 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 33 PID 472 wrote to memory of 848 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 34 PID 472 wrote to memory of 848 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 34 PID 472 wrote to memory of 848 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 34 PID 472 wrote to memory of 848 472 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe 34 PID 1160 wrote to memory of 936 1160 backup.exe 35 PID 1160 wrote to memory of 936 1160 backup.exe 35 PID 1160 wrote to memory of 936 1160 backup.exe 35 PID 1160 wrote to memory of 936 1160 backup.exe 35 PID 936 wrote to memory of 1928 936 backup.exe 36 PID 936 wrote to memory of 1928 936 backup.exe 36 PID 936 wrote to memory of 1928 936 backup.exe 36 PID 936 wrote to memory of 1928 936 backup.exe 36 PID 1928 wrote to memory of 1312 1928 backup.exe 37 PID 1928 wrote to memory of 1312 1928 backup.exe 37 PID 1928 wrote to memory of 1312 1928 backup.exe 37 PID 1928 wrote to memory of 1312 1928 backup.exe 37 PID 936 wrote to memory of 1948 936 backup.exe 38 PID 936 wrote to memory of 1948 936 backup.exe 38 PID 936 wrote to memory of 1948 936 backup.exe 38 PID 936 wrote to memory of 1948 936 backup.exe 38 PID 1948 wrote to memory of 1108 1948 backup.exe 39 PID 1948 wrote to memory of 1108 1948 backup.exe 39 PID 1948 wrote to memory of 1108 1948 backup.exe 39 PID 1948 wrote to memory of 1108 1948 backup.exe 39 PID 1108 wrote to memory of 2024 1108 backup.exe 40 PID 1108 wrote to memory of 2024 1108 backup.exe 40 PID 1108 wrote to memory of 2024 1108 backup.exe 40 PID 1108 wrote to memory of 2024 1108 backup.exe 40 PID 1948 wrote to memory of 1056 1948 backup.exe 41 PID 1948 wrote to memory of 1056 1948 backup.exe 41 PID 1948 wrote to memory of 1056 1948 backup.exe 41 PID 1948 wrote to memory of 1056 1948 backup.exe 41 PID 1056 wrote to memory of 1628 1056 backup.exe 42 PID 1056 wrote to memory of 1628 1056 backup.exe 42 PID 1056 wrote to memory of 1628 1056 backup.exe 42 PID 1056 wrote to memory of 1628 1056 backup.exe 42 PID 1628 wrote to memory of 1920 1628 backup.exe 43 PID 1628 wrote to memory of 1920 1628 backup.exe 43 PID 1628 wrote to memory of 1920 1628 backup.exe 43 PID 1628 wrote to memory of 1920 1628 backup.exe 43 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe"C:\Users\Admin\AppData\Local\Temp\429e0d049676152692eb516a33b5a8a9a10442e15f67f002dcf21e677c3ac14b.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:472 -
C:\Users\Admin\AppData\Local\Temp\1121086468\backup.exeC:\Users\Admin\AppData\Local\Temp\1121086468\backup.exe C:\Users\Admin\AppData\Local\Temp\1121086468\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:936 -
C:\PerfLogs\backup.exeC:\PerfLogs\backup.exe C:\PerfLogs\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1928 -
C:\PerfLogs\Admin\System Restore.exe"C:\PerfLogs\Admin\System Restore.exe" C:\PerfLogs\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1312
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Program Files\7-Zip\Lang\System Restore.exe"C:\Program Files\7-Zip\Lang\System Restore.exe" C:\Program Files\7-Zip\Lang\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2024
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1056 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1560 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1396
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:844
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:560
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1376
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1728
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1920
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1868
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1760
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1876
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵PID:784
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1012
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1684
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1824
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1936
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵PID:1852
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:836 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1328
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1996
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵PID:1312
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1236
-
-
C:\Program Files\Common Files\SpeechEngines\backup.exe"C:\Program Files\Common Files\SpeechEngines\backup.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1388 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\System Restore.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1216
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1680 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1776
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵PID:1664
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:852 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:956
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:924
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1964
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1652
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵PID:756
-
-
-
C:\Program Files\Google\System Restore.exe"C:\Program Files\Google\System Restore.exe" C:\Program Files\Google\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1300 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1792 -
C:\Program Files\Google\Chrome\Application\backup.exe"C:\Program Files\Google\Chrome\Application\backup.exe" C:\Program Files\Google\Chrome\Application\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:616 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1528 -
C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\default_apps\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2008
-
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\backup.exe" C:\Program Files\Google\Chrome\Application\89.0.4389.114\Extensions\9⤵PID:1388
-
-
-
C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe"C:\Program Files\Google\Chrome\Application\Dictionaries\backup.exe" C:\Program Files\Google\Chrome\Application\Dictionaries\8⤵PID:1252
-
-
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- System policy modification
PID:1584
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1468
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1616 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1712 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1212 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\data.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1052
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1700 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵PID:984
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:1924
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1944
-
-
-
C:\Users\System Restore.exe"C:\Users\System Restore.exe" C:\Users\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2012 -
C:\Users\Admin\System Restore.exe"C:\Users\Admin\System Restore.exe" C:\Users\Admin\5⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:972 -
C:\Users\Admin\Contacts\backup.exeC:\Users\Admin\Contacts\backup.exe C:\Users\Admin\Contacts\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1544
-
-
C:\Users\Admin\Desktop\backup.exeC:\Users\Admin\Desktop\backup.exe C:\Users\Admin\Desktop\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1060
-
-
C:\Users\Admin\Documents\backup.exeC:\Users\Admin\Documents\backup.exe C:\Users\Admin\Documents\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
C:\Users\Admin\Downloads\backup.exeC:\Users\Admin\Downloads\backup.exe C:\Users\Admin\Downloads\6⤵PID:876
-
-
-
C:\Users\Public\backup.exeC:\Users\Public\backup.exe C:\Users\Public\5⤵PID:1532
-
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1720
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\data.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1040
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1860
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:984
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1780
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1384
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exeC:\Users\Admin\AppData\Local\Temp\WPDNSE\backup.exe C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:848
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD59b337a8916a998cef8a285ed6b8b23c8
SHA1fcd1c9b7c11ccf284d3c4ac04544570dac525847
SHA2561b393af73179533082f323ee0007b1c3ebb025fb5cf028408dc01555f4be3051
SHA5128d35ee4e85d5e0f5efc29e4d2827739127434e584c451ce93ac95dc300fd48addad102429aba67a6ecd72022e3ae3f26a8a1e1a15b21bd958eb6626a09225503
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD54b69289c1c3b70b30000fd22e42535e9
SHA1b193319f1d3423283116018f7313ac840503cdff
SHA25657c032bfe170548613657d75cd10564433eb2e097b82b0326d4d0b832790963d
SHA512f68f06bca7d616016eeecca79cf6d74062037e580d62a88c3c0443f910c13828f00d8e6acd9522acfa9b629716b7c2c72461ac9abf3a1ed2e57f33056c8a54b2
-
Filesize
72KB
MD58ce3d5f70cb0f4390b2296f491f4a834
SHA1c6403ac7d739a44d8f4f83d242920999e7ddbb95
SHA25600c83a991b199d445f97f2a824bfca2edf8579225a8f3b6de943feb7e1a064a9
SHA5127e3d233e263af3c122b073ce3ca55ef35a357e9c9fe21cfe88092169507d50fd22bd6e2e19ed1279ba14c3d62959748cc489f36962c5c095af83aa26da167bb9
-
Filesize
72KB
MD58ce3d5f70cb0f4390b2296f491f4a834
SHA1c6403ac7d739a44d8f4f83d242920999e7ddbb95
SHA25600c83a991b199d445f97f2a824bfca2edf8579225a8f3b6de943feb7e1a064a9
SHA5127e3d233e263af3c122b073ce3ca55ef35a357e9c9fe21cfe88092169507d50fd22bd6e2e19ed1279ba14c3d62959748cc489f36962c5c095af83aa26da167bb9
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD5760b5365fa9cf8adea1e6ce6a261dced
SHA1bf93700b0ea1a7b75d1dfd118ce97900f1a73da0
SHA256568a3a714b6b57aa7cd31df08827001df5e3c3ecf135c647e383946490e8ae85
SHA51244dd06f635bb217d08e67304a9dbcf4b2b06171a61dc2056cdf28b2bc8bbfab95c28c0222604561f2a249beee39a6ecd890a12e78a75096291f6793886950177
-
Filesize
72KB
MD5760b5365fa9cf8adea1e6ce6a261dced
SHA1bf93700b0ea1a7b75d1dfd118ce97900f1a73da0
SHA256568a3a714b6b57aa7cd31df08827001df5e3c3ecf135c647e383946490e8ae85
SHA51244dd06f635bb217d08e67304a9dbcf4b2b06171a61dc2056cdf28b2bc8bbfab95c28c0222604561f2a249beee39a6ecd890a12e78a75096291f6793886950177
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5b9727b772604ffe8f0b79adac9655b33
SHA12774151814f3e24fd3be146fa00c23cb5d34e97c
SHA256dccd91352072383bab24c23872e34102cc2b4bee42ae2727c1fbc1964825c14b
SHA5127bd8d094c00dd7ea6aef635dcc65b4dea3ed1f8889d276e627440dc56ee15f5f58229afb114284c1882833b50caa95bf0ecd4b0e0ebfc0258b64e354fc6a200c
-
Filesize
72KB
MD5b9727b772604ffe8f0b79adac9655b33
SHA12774151814f3e24fd3be146fa00c23cb5d34e97c
SHA256dccd91352072383bab24c23872e34102cc2b4bee42ae2727c1fbc1964825c14b
SHA5127bd8d094c00dd7ea6aef635dcc65b4dea3ed1f8889d276e627440dc56ee15f5f58229afb114284c1882833b50caa95bf0ecd4b0e0ebfc0258b64e354fc6a200c
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD596af78ad84e57782af4671b211cb8d35
SHA15891556c683c787552dbf6a4bfce7b781131b547
SHA2569116fbb37fb1a86db96a5a43e46aca75193d8ff4647d47c581dd56170af8529a
SHA5122e0371fc0ad148221c53013f2d13acfcf53276369f37a148af591d85c9c08a84f6a96ec2a043cb8ec5543c97eb2a36f08cb4d19dfb8bc8c10a06d87f6e55c689
-
Filesize
72KB
MD596af78ad84e57782af4671b211cb8d35
SHA15891556c683c787552dbf6a4bfce7b781131b547
SHA2569116fbb37fb1a86db96a5a43e46aca75193d8ff4647d47c581dd56170af8529a
SHA5122e0371fc0ad148221c53013f2d13acfcf53276369f37a148af591d85c9c08a84f6a96ec2a043cb8ec5543c97eb2a36f08cb4d19dfb8bc8c10a06d87f6e55c689
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD59b337a8916a998cef8a285ed6b8b23c8
SHA1fcd1c9b7c11ccf284d3c4ac04544570dac525847
SHA2561b393af73179533082f323ee0007b1c3ebb025fb5cf028408dc01555f4be3051
SHA5128d35ee4e85d5e0f5efc29e4d2827739127434e584c451ce93ac95dc300fd48addad102429aba67a6ecd72022e3ae3f26a8a1e1a15b21bd958eb6626a09225503
-
Filesize
72KB
MD59b337a8916a998cef8a285ed6b8b23c8
SHA1fcd1c9b7c11ccf284d3c4ac04544570dac525847
SHA2561b393af73179533082f323ee0007b1c3ebb025fb5cf028408dc01555f4be3051
SHA5128d35ee4e85d5e0f5efc29e4d2827739127434e584c451ce93ac95dc300fd48addad102429aba67a6ecd72022e3ae3f26a8a1e1a15b21bd958eb6626a09225503
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD54b69289c1c3b70b30000fd22e42535e9
SHA1b193319f1d3423283116018f7313ac840503cdff
SHA25657c032bfe170548613657d75cd10564433eb2e097b82b0326d4d0b832790963d
SHA512f68f06bca7d616016eeecca79cf6d74062037e580d62a88c3c0443f910c13828f00d8e6acd9522acfa9b629716b7c2c72461ac9abf3a1ed2e57f33056c8a54b2
-
Filesize
72KB
MD54b69289c1c3b70b30000fd22e42535e9
SHA1b193319f1d3423283116018f7313ac840503cdff
SHA25657c032bfe170548613657d75cd10564433eb2e097b82b0326d4d0b832790963d
SHA512f68f06bca7d616016eeecca79cf6d74062037e580d62a88c3c0443f910c13828f00d8e6acd9522acfa9b629716b7c2c72461ac9abf3a1ed2e57f33056c8a54b2
-
Filesize
72KB
MD58ce3d5f70cb0f4390b2296f491f4a834
SHA1c6403ac7d739a44d8f4f83d242920999e7ddbb95
SHA25600c83a991b199d445f97f2a824bfca2edf8579225a8f3b6de943feb7e1a064a9
SHA5127e3d233e263af3c122b073ce3ca55ef35a357e9c9fe21cfe88092169507d50fd22bd6e2e19ed1279ba14c3d62959748cc489f36962c5c095af83aa26da167bb9
-
Filesize
72KB
MD58ce3d5f70cb0f4390b2296f491f4a834
SHA1c6403ac7d739a44d8f4f83d242920999e7ddbb95
SHA25600c83a991b199d445f97f2a824bfca2edf8579225a8f3b6de943feb7e1a064a9
SHA5127e3d233e263af3c122b073ce3ca55ef35a357e9c9fe21cfe88092169507d50fd22bd6e2e19ed1279ba14c3d62959748cc489f36962c5c095af83aa26da167bb9
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD5760b5365fa9cf8adea1e6ce6a261dced
SHA1bf93700b0ea1a7b75d1dfd118ce97900f1a73da0
SHA256568a3a714b6b57aa7cd31df08827001df5e3c3ecf135c647e383946490e8ae85
SHA51244dd06f635bb217d08e67304a9dbcf4b2b06171a61dc2056cdf28b2bc8bbfab95c28c0222604561f2a249beee39a6ecd890a12e78a75096291f6793886950177
-
Filesize
72KB
MD5760b5365fa9cf8adea1e6ce6a261dced
SHA1bf93700b0ea1a7b75d1dfd118ce97900f1a73da0
SHA256568a3a714b6b57aa7cd31df08827001df5e3c3ecf135c647e383946490e8ae85
SHA51244dd06f635bb217d08e67304a9dbcf4b2b06171a61dc2056cdf28b2bc8bbfab95c28c0222604561f2a249beee39a6ecd890a12e78a75096291f6793886950177
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD5bab36f4055f9f7166cafc502b7a88913
SHA19fd5d7499e1e2615a3104165ea6efbcb185dfd1b
SHA25690d36330cc4797c6213034cfd70fea2b1aae9f0066602f0c87dec9d9bec69b48
SHA5126a576133a55378e407a295488af5bfd643e75c54f542cb4dafd61abdad56f84a6d99500e25f420a3b857e0622f5a505b3aac8c534eff1f08bc48af3167128353
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD50aa018d9634071588993b1c3e4b8b919
SHA13a2eeff3b3e48970f011800341e5f8e85e1d746d
SHA256b6b6e115fc5ec2a37b3e36b41898c2b60df7e52163342d352c9eb604341768cd
SHA51216b66dce996909110f2f0180efa8667fd4323d3d454bf47004fa1ffe07054a55350a43c78f1922635b75ff3c577e921454fa0c5927ae6bf3c05daf301fd19942
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5bbcb222986fe669c4460f10bfeeb42fe
SHA1e5cbc41e74cad36a0340a39ccc0374a7c2a4b6ca
SHA2564d3aa234dd8315c16358aed4ddee7444a1fcdca6e8bc36d36f2874b789f6897b
SHA51209a427e9defa7b08c9eafdf7770602c477837a0986c7eb7d3f572d96b411ee71e18bbf1a0fabbd25d55203869674ccf16c7faa499ecdfc2cefeb48b42f6fe8bb
-
Filesize
72KB
MD5b9727b772604ffe8f0b79adac9655b33
SHA12774151814f3e24fd3be146fa00c23cb5d34e97c
SHA256dccd91352072383bab24c23872e34102cc2b4bee42ae2727c1fbc1964825c14b
SHA5127bd8d094c00dd7ea6aef635dcc65b4dea3ed1f8889d276e627440dc56ee15f5f58229afb114284c1882833b50caa95bf0ecd4b0e0ebfc0258b64e354fc6a200c
-
Filesize
72KB
MD5b9727b772604ffe8f0b79adac9655b33
SHA12774151814f3e24fd3be146fa00c23cb5d34e97c
SHA256dccd91352072383bab24c23872e34102cc2b4bee42ae2727c1fbc1964825c14b
SHA5127bd8d094c00dd7ea6aef635dcc65b4dea3ed1f8889d276e627440dc56ee15f5f58229afb114284c1882833b50caa95bf0ecd4b0e0ebfc0258b64e354fc6a200c
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d
-
Filesize
72KB
MD59219c5f0ad38ca1f5385d2f9c6dd8f11
SHA10da2af1dc86b881908193b46cdaacd2ab26626a9
SHA2569d49c43a721bdfb20bb6604c46e3d8980d5c59f729cbf359570e069f07648ec3
SHA5125ef03f4a19e686bc7e26334174a856d269a5f5ee659fffdc71aa46026a0d519d10c314b95a5f29f2df6aee1497ca8b2d6836d91fbbf06f88758448d59549815d