Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
64s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 19:38
Static task
static1
Behavioral task
behavioral1
Sample
050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe
Resource
win10v2004-20220812-en
General
-
Target
050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe
-
Size
72KB
-
MD5
0629bb90400e2dc300e826a9860d4b14
-
SHA1
85d5ed15f83d0c3e1d32b7eb62d0b75c708c304b
-
SHA256
050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec
-
SHA512
85c1f6b8e336d499605eb7618453a7fc394204b2b84c3638aed7fe0394940d8a50fc6cc4af029d848817438a19b4a046d074097dbee60a8566e8ffb857af4248
-
SSDEEP
384:i6wayA+1mwnA353BXR+oGfP5d/ZBHXME+l93qPAqee/w6yJ/wWD+S83BXR+oGf2F:ipQNwC3BEddsEqOt/hyJF+x3BEJwRrPR
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe -
Disables RegEdit via registry modification 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" System Restore.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe -
Executes dropped EXE 64 IoCs
pid Process 1128 backup.exe 532 backup.exe 1180 backup.exe 1420 update.exe 1632 backup.exe 1312 backup.exe 1948 System Restore.exe 1544 backup.exe 904 System Restore.exe 1912 backup.exe 1968 backup.exe 1728 backup.exe 1980 backup.exe 2020 backup.exe 964 backup.exe 1528 backup.exe 1628 System Restore.exe 1932 backup.exe 1412 backup.exe 1952 backup.exe 1188 backup.exe 680 backup.exe 472 backup.exe 1472 backup.exe 1092 backup.exe 1552 backup.exe 1800 backup.exe 864 backup.exe 1948 backup.exe 1636 System Restore.exe 1892 update.exe 976 backup.exe 2028 data.exe 904 backup.exe 2012 backup.exe 784 backup.exe 368 data.exe 552 backup.exe 1148 backup.exe 1584 backup.exe 1748 backup.exe 944 backup.exe 984 data.exe 1704 backup.exe 1244 backup.exe 568 backup.exe 1708 update.exe 532 backup.exe 1008 backup.exe 1468 backup.exe 584 data.exe 632 backup.exe 600 backup.exe 1092 backup.exe 1552 backup.exe 1800 update.exe 1668 backup.exe 832 backup.exe 1344 backup.exe 1780 backup.exe 1908 update.exe 1912 backup.exe 1716 backup.exe 1040 update.exe -
Loads dropped DLL 64 IoCs
pid Process 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1420 update.exe 1420 update.exe 1420 update.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1544 backup.exe 1544 backup.exe 904 System Restore.exe 904 System Restore.exe 1544 backup.exe 1544 backup.exe 1968 backup.exe 1968 backup.exe 1728 backup.exe 1728 backup.exe 1968 backup.exe 1968 backup.exe 2020 backup.exe 2020 backup.exe 964 backup.exe 964 backup.exe 964 backup.exe 964 backup.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1628 System Restore.exe 1948 backup.exe 1948 backup.exe 1948 backup.exe 1892 update.exe 1892 update.exe 1892 update.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Java\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe update.exe File opened for modification C:\Program Files\Common Files\System\en-US\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe System Restore.exe File opened for modification C:\Program Files\DVD Maker\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\System\ado\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe backup.exe File opened for modification C:\Program Files\backup.exe backup.exe File opened for modification C:\Program Files\7-Zip\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\update.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe update.exe File opened for modification C:\Program Files\DVD Maker\es-ES\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\data.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe System Restore.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe backup.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe System Restore.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe update.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\System\de-DE\backup.exe backup.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe backup.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe backup.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\backup.exe backup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe -
Suspicious use of SetWindowsHookEx 64 IoCs
pid Process 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 1128 backup.exe 532 backup.exe 1180 backup.exe 1420 update.exe 1632 backup.exe 1312 backup.exe 1948 System Restore.exe 1544 backup.exe 904 System Restore.exe 1912 backup.exe 1968 backup.exe 1728 backup.exe 1980 backup.exe 2020 backup.exe 964 backup.exe 1528 backup.exe 1628 System Restore.exe 1932 backup.exe 1412 backup.exe 1952 backup.exe 1188 backup.exe 680 backup.exe 472 backup.exe 1472 backup.exe 1092 backup.exe 1552 backup.exe 1800 backup.exe 864 backup.exe 1948 backup.exe 1636 System Restore.exe 1892 update.exe 976 backup.exe 2028 data.exe 904 backup.exe 2012 backup.exe 784 backup.exe 368 data.exe 552 backup.exe 1148 backup.exe 1584 backup.exe 1748 backup.exe 944 backup.exe 984 data.exe 1704 backup.exe 1244 backup.exe 568 backup.exe 1708 update.exe 532 backup.exe 1008 backup.exe 1468 backup.exe 584 data.exe 632 backup.exe 600 backup.exe 1092 backup.exe 1552 backup.exe 1800 update.exe 1668 backup.exe 832 backup.exe 1344 backup.exe 1780 backup.exe 1908 update.exe 1912 backup.exe 1716 backup.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1480 wrote to memory of 1128 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 27 PID 1480 wrote to memory of 1128 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 27 PID 1480 wrote to memory of 1128 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 27 PID 1480 wrote to memory of 1128 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 27 PID 1480 wrote to memory of 532 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 28 PID 1480 wrote to memory of 532 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 28 PID 1480 wrote to memory of 532 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 28 PID 1480 wrote to memory of 532 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 28 PID 1480 wrote to memory of 1180 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 29 PID 1480 wrote to memory of 1180 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 29 PID 1480 wrote to memory of 1180 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 29 PID 1480 wrote to memory of 1180 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 29 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1420 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 30 PID 1480 wrote to memory of 1632 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 31 PID 1480 wrote to memory of 1632 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 31 PID 1480 wrote to memory of 1632 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 31 PID 1480 wrote to memory of 1632 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 31 PID 1480 wrote to memory of 1312 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 32 PID 1480 wrote to memory of 1312 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 32 PID 1480 wrote to memory of 1312 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 32 PID 1480 wrote to memory of 1312 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 32 PID 1480 wrote to memory of 1948 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 33 PID 1480 wrote to memory of 1948 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 33 PID 1480 wrote to memory of 1948 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 33 PID 1480 wrote to memory of 1948 1480 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe 33 PID 1128 wrote to memory of 1544 1128 backup.exe 34 PID 1128 wrote to memory of 1544 1128 backup.exe 34 PID 1128 wrote to memory of 1544 1128 backup.exe 34 PID 1128 wrote to memory of 1544 1128 backup.exe 34 PID 1544 wrote to memory of 904 1544 backup.exe 35 PID 1544 wrote to memory of 904 1544 backup.exe 35 PID 1544 wrote to memory of 904 1544 backup.exe 35 PID 1544 wrote to memory of 904 1544 backup.exe 35 PID 904 wrote to memory of 1912 904 System Restore.exe 36 PID 904 wrote to memory of 1912 904 System Restore.exe 36 PID 904 wrote to memory of 1912 904 System Restore.exe 36 PID 904 wrote to memory of 1912 904 System Restore.exe 36 PID 1544 wrote to memory of 1968 1544 backup.exe 37 PID 1544 wrote to memory of 1968 1544 backup.exe 37 PID 1544 wrote to memory of 1968 1544 backup.exe 37 PID 1544 wrote to memory of 1968 1544 backup.exe 37 PID 1968 wrote to memory of 1728 1968 backup.exe 38 PID 1968 wrote to memory of 1728 1968 backup.exe 38 PID 1968 wrote to memory of 1728 1968 backup.exe 38 PID 1968 wrote to memory of 1728 1968 backup.exe 38 PID 1728 wrote to memory of 1980 1728 backup.exe 39 PID 1728 wrote to memory of 1980 1728 backup.exe 39 PID 1728 wrote to memory of 1980 1728 backup.exe 39 PID 1728 wrote to memory of 1980 1728 backup.exe 39 PID 1968 wrote to memory of 2020 1968 backup.exe 40 PID 1968 wrote to memory of 2020 1968 backup.exe 40 PID 1968 wrote to memory of 2020 1968 backup.exe 40 PID 1968 wrote to memory of 2020 1968 backup.exe 40 PID 2020 wrote to memory of 964 2020 backup.exe 41 PID 2020 wrote to memory of 964 2020 backup.exe 41 PID 2020 wrote to memory of 964 2020 backup.exe 41 PID 2020 wrote to memory of 964 2020 backup.exe 41 PID 964 wrote to memory of 1528 964 backup.exe 42 -
System policy modification 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" data.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" System Restore.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System backup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System update.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" data.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" backup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer update.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe"C:\Users\Admin\AppData\Local\Temp\050c7a4d6332bb0c062c25604a3c53e1c7984ee47cc9fb215fc80f00c015a1ec.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\3768774454\backup.exeC:\Users\Admin\AppData\Local\Temp\3768774454\backup.exe C:\Users\Admin\AppData\Local\Temp\3768774454\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\backup.exe\backup.exe \3⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\PerfLogs\System Restore.exe"C:\PerfLogs\System Restore.exe" C:\PerfLogs\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:904 -
C:\PerfLogs\Admin\backup.exeC:\PerfLogs\Admin\backup.exe C:\PerfLogs\Admin\5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1912
-
-
-
C:\Program Files\backup.exe"C:\Program Files\backup.exe" C:\Program Files\4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Program Files\7-Zip\backup.exe"C:\Program Files\7-Zip\backup.exe" C:\Program Files\7-Zip\5⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1728 -
C:\Program Files\7-Zip\Lang\backup.exe"C:\Program Files\7-Zip\Lang\backup.exe" C:\Program Files\7-Zip\Lang\6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1980
-
-
-
C:\Program Files\Common Files\backup.exe"C:\Program Files\Common Files\backup.exe" C:\Program Files\Common Files\5⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Program Files\Common Files\Microsoft Shared\backup.exe"C:\Program Files\Common Files\Microsoft Shared\backup.exe" C:\Program Files\Common Files\Microsoft Shared\6⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Filters\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Filters\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1528
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\7⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1628 -
C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1932
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1952
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1188
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:680
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\en-US\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1472
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\et-EE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fr-FR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:864
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1948 -
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad\9⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1892
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:976
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2028
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\9⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:904
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2012
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:784
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\9⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:368
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\9⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:552
-
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\he-IL\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1148
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1748
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\it-IT\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:984
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1244
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:568
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nb-NO\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:532
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1008
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1468
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\data.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\data.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:584
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:632
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:600
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\ru-RU\8⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sk-SK\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sl-SI\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sr-Latn-CS\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1668
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:832
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\th-TH\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1344
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\tr-TR\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1780
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\update.exe"C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\update.exe" C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\8⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1912
-
-
C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe"C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\backup.exe" C:\Program Files\Common Files\Microsoft Shared\ink\zh-TW\8⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1716
-
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\update.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\7⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Drops file in Program Files directory
- System policy modification
PID:1040 -
C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1648
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\8⤵
- Modifies visibility of file extensions in Explorer
PID:1924
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\8⤵
- System policy modification
PID:1560
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1720
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1368
-
-
C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1076
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\7⤵
- System policy modification
PID:1752 -
C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:2036
-
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\backup.exe" C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\7⤵
- System policy modification
PID:1704
-
-
C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Stationery\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Stationery\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:840
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:960 -
C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
PID:1604
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\data.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\en-US\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1708
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
PID:1316
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\fr-FR\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1132
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\it-IT\8⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1764
-
-
C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\TextConv\ja-JP\8⤵
- Disables RegEdit via registry modification
PID:1056
-
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:584 -
C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\de-DE\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1696
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\System Restore.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\8⤵
- System policy modification
PID:1632
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:360
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\8⤵
- System policy modification
PID:980
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\it-IT\8⤵PID:1552
-
-
C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe"C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\backup.exe" C:\Program Files\Common Files\Microsoft Shared\Triedit\ja-JP\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:864
-
-
-
C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VC\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VC\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1216
-
-
C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VGX\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VGX\7⤵
- Disables RegEdit via registry modification
PID:1636
-
-
C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\7⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:832 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:772 -
C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe"C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\backup.exe" C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\9⤵PID:1732
-
-
-
-
-
C:\Program Files\Common Files\Services\backup.exe"C:\Program Files\Common Files\Services\backup.exe" C:\Program Files\Common Files\Services\6⤵PID:1476
-
-
C:\Program Files\Common Files\SpeechEngines\data.exe"C:\Program Files\Common Files\SpeechEngines\data.exe" C:\Program Files\Common Files\SpeechEngines\6⤵
- System policy modification
PID:1908 -
C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe"C:\Program Files\Common Files\SpeechEngines\Microsoft\backup.exe" C:\Program Files\Common Files\SpeechEngines\Microsoft\7⤵
- System policy modification
PID:1896
-
-
-
C:\Program Files\Common Files\System\backup.exe"C:\Program Files\Common Files\System\backup.exe" C:\Program Files\Common Files\System\6⤵
- Disables RegEdit via registry modification
- Drops file in Program Files directory
PID:2012 -
C:\Program Files\Common Files\System\ado\backup.exe"C:\Program Files\Common Files\System\ado\backup.exe" C:\Program Files\Common Files\System\ado\7⤵
- Disables RegEdit via registry modification
PID:1716 -
C:\Program Files\Common Files\System\ado\de-DE\backup.exe"C:\Program Files\Common Files\System\ado\de-DE\backup.exe" C:\Program Files\Common Files\System\ado\de-DE\8⤵PID:1812
-
-
C:\Program Files\Common Files\System\ado\en-US\backup.exe"C:\Program Files\Common Files\System\ado\en-US\backup.exe" C:\Program Files\Common Files\System\ado\en-US\8⤵PID:368
-
-
C:\Program Files\Common Files\System\ado\es-ES\backup.exe"C:\Program Files\Common Files\System\ado\es-ES\backup.exe" C:\Program Files\Common Files\System\ado\es-ES\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
PID:1728
-
-
C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe"C:\Program Files\Common Files\System\ado\fr-FR\System Restore.exe" C:\Program Files\Common Files\System\ado\fr-FR\8⤵PID:1404
-
-
C:\Program Files\Common Files\System\ado\it-IT\data.exe"C:\Program Files\Common Files\System\ado\it-IT\data.exe" C:\Program Files\Common Files\System\ado\it-IT\8⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:948
-
-
C:\Program Files\Common Files\System\ado\ja-JP\backup.exe"C:\Program Files\Common Files\System\ado\ja-JP\backup.exe" C:\Program Files\Common Files\System\ado\ja-JP\8⤵
- System policy modification
PID:620
-
-
-
C:\Program Files\Common Files\System\de-DE\backup.exe"C:\Program Files\Common Files\System\de-DE\backup.exe" C:\Program Files\Common Files\System\de-DE\7⤵
- Modifies visibility of file extensions in Explorer
PID:1936
-
-
C:\Program Files\Common Files\System\en-US\backup.exe"C:\Program Files\Common Files\System\en-US\backup.exe" C:\Program Files\Common Files\System\en-US\7⤵
- Modifies visibility of file extensions in Explorer
PID:1412
-
-
C:\Program Files\Common Files\System\es-ES\backup.exe"C:\Program Files\Common Files\System\es-ES\backup.exe" C:\Program Files\Common Files\System\es-ES\7⤵
- Disables RegEdit via registry modification
- System policy modification
PID:684
-
-
C:\Program Files\Common Files\System\fr-FR\backup.exe"C:\Program Files\Common Files\System\fr-FR\backup.exe" C:\Program Files\Common Files\System\fr-FR\7⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1820
-
-
C:\Program Files\Common Files\System\it-IT\backup.exe"C:\Program Files\Common Files\System\it-IT\backup.exe" C:\Program Files\Common Files\System\it-IT\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1168
-
-
C:\Program Files\Common Files\System\ja-JP\backup.exe"C:\Program Files\Common Files\System\ja-JP\backup.exe" C:\Program Files\Common Files\System\ja-JP\7⤵PID:1420
-
-
C:\Program Files\Common Files\System\msadc\backup.exe"C:\Program Files\Common Files\System\msadc\backup.exe" C:\Program Files\Common Files\System\msadc\7⤵PID:972
-
-
C:\Program Files\Common Files\System\Ole DB\backup.exe"C:\Program Files\Common Files\System\Ole DB\backup.exe" C:\Program Files\Common Files\System\Ole DB\7⤵PID:1412
-
C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe"C:\Program Files\Common Files\System\Ole DB\de-DE\backup.exe" C:\Program Files\Common Files\System\Ole DB\de-DE\8⤵PID:1936
-
-
-
-
-
C:\Program Files\DVD Maker\backup.exe"C:\Program Files\DVD Maker\backup.exe" C:\Program Files\DVD Maker\5⤵
- Drops file in Program Files directory
PID:324 -
C:\Program Files\DVD Maker\de-DE\backup.exe"C:\Program Files\DVD Maker\de-DE\backup.exe" C:\Program Files\DVD Maker\de-DE\6⤵
- Modifies visibility of file extensions in Explorer
PID:572
-
-
C:\Program Files\DVD Maker\en-US\backup.exe"C:\Program Files\DVD Maker\en-US\backup.exe" C:\Program Files\DVD Maker\en-US\6⤵
- Disables RegEdit via registry modification
PID:1056
-
-
C:\Program Files\DVD Maker\es-ES\backup.exe"C:\Program Files\DVD Maker\es-ES\backup.exe" C:\Program Files\DVD Maker\es-ES\6⤵PID:924
-
-
C:\Program Files\DVD Maker\fr-FR\backup.exe"C:\Program Files\DVD Maker\fr-FR\backup.exe" C:\Program Files\DVD Maker\fr-FR\6⤵
- System policy modification
PID:1048
-
-
C:\Program Files\DVD Maker\it-IT\backup.exe"C:\Program Files\DVD Maker\it-IT\backup.exe" C:\Program Files\DVD Maker\it-IT\6⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:1616
-
-
C:\Program Files\DVD Maker\ja-JP\backup.exe"C:\Program Files\DVD Maker\ja-JP\backup.exe" C:\Program Files\DVD Maker\ja-JP\6⤵
- Disables RegEdit via registry modification
PID:2008
-
-
C:\Program Files\DVD Maker\Shared\backup.exe"C:\Program Files\DVD Maker\Shared\backup.exe" C:\Program Files\DVD Maker\Shared\6⤵
- Disables RegEdit via registry modification
PID:964 -
C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:904 -
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\8⤵PID:1676
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\8⤵PID:1468
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\8⤵PID:1092
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Full\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Full\8⤵PID:1072
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\8⤵PID:1904
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\System Restore.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\8⤵PID:1732
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\data.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\8⤵PID:296
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\8⤵PID:1404
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\8⤵PID:1076
-
-
C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe"C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\backup.exe" C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\8⤵PID:604
-
-
-
-
-
C:\Program Files\Google\backup.exe"C:\Program Files\Google\backup.exe" C:\Program Files\Google\5⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1008 -
C:\Program Files\Google\Chrome\backup.exe"C:\Program Files\Google\Chrome\backup.exe" C:\Program Files\Google\Chrome\6⤵PID:584
-
-
-
C:\Program Files\Internet Explorer\backup.exe"C:\Program Files\Internet Explorer\backup.exe" C:\Program Files\Internet Explorer\5⤵PID:1632
-
C:\Program Files\Internet Explorer\de-DE\backup.exe"C:\Program Files\Internet Explorer\de-DE\backup.exe" C:\Program Files\Internet Explorer\de-DE\6⤵PID:1324
-
-
-
C:\Program Files\Java\backup.exe"C:\Program Files\Java\backup.exe" C:\Program Files\Java\5⤵PID:1552
-
-
C:\Program Files\Microsoft Games\backup.exe"C:\Program Files\Microsoft Games\backup.exe" C:\Program Files\Microsoft Games\5⤵PID:1216
-
-
C:\Program Files\Microsoft Office\update.exe"C:\Program Files\Microsoft Office\update.exe" C:\Program Files\Microsoft Office\5⤵PID:864
-
-
C:\Program Files\Mozilla Firefox\backup.exe"C:\Program Files\Mozilla Firefox\backup.exe" C:\Program Files\Mozilla Firefox\5⤵PID:1896
-
-
C:\Program Files\MSBuild\backup.exe"C:\Program Files\MSBuild\backup.exe" C:\Program Files\MSBuild\5⤵PID:1680
-
-
C:\Program Files\Reference Assemblies\backup.exe"C:\Program Files\Reference Assemblies\backup.exe" C:\Program Files\Reference Assemblies\5⤵PID:1580
-
-
C:\Program Files\VideoLAN\backup.exe"C:\Program Files\VideoLAN\backup.exe" C:\Program Files\VideoLAN\5⤵PID:1932
-
-
-
C:\Program Files (x86)\backup.exe"C:\Program Files (x86)\backup.exe" C:\Program Files (x86)\4⤵
- Drops file in Program Files directory
- System policy modification
PID:1656 -
C:\Program Files (x86)\Adobe\backup.exe"C:\Program Files (x86)\Adobe\backup.exe" C:\Program Files (x86)\Adobe\5⤵
- Drops file in Program Files directory
PID:604 -
C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\6⤵
- Drops file in Program Files directory
- System policy modification
PID:1900 -
C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Esl\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Esl\7⤵PID:1096
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\7⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Drops file in Program Files directory
- System policy modification
PID:1532 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\8⤵
- Modifies visibility of file extensions in Explorer
PID:568
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\8⤵PID:1952
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Browser\8⤵
- Modifies visibility of file extensions in Explorer
PID:816
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\8⤵
- System policy modification
PID:632 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\9⤵
- Disables RegEdit via registry modification
PID:1920
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\System Restore.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\8⤵
- Disables RegEdit via registry modification
PID:1540
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\8⤵
- Modifies visibility of file extensions in Explorer
- System policy modification
PID:976 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Legal\ENU\9⤵
- Disables RegEdit via registry modification
- System policy modification
PID:832
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\8⤵
- Disables RegEdit via registry modification
PID:296
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\8⤵
- Modifies visibility of file extensions in Explorer
- Drops file in Program Files directory
PID:1460 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\9⤵PID:1948
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\AcroForm\PMP\10⤵
- Disables RegEdit via registry modification
- System policy modification
PID:1976
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\9⤵
- Drops file in Program Files directory
- System policy modification
PID:1728 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\10⤵
- Disables RegEdit via registry modification
PID:1740 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\11⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- System policy modification
PID:1960
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\9⤵
- Drops file in Program Files directory
- System policy modification
PID:948 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\10⤵PID:1752
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\9⤵
- System policy modification
PID:1500 -
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\10⤵
- Modifies visibility of file extensions in Explorer
PID:1244
-
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\8⤵PID:1188
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\8⤵PID:1056
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\8⤵PID:924
-
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Resource\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Resource\7⤵PID:680
-
-
C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe"C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\backup.exe" C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\7⤵PID:360
-
-
-
-
C:\Program Files (x86)\Common Files\backup.exe"C:\Program Files (x86)\Common Files\backup.exe" C:\Program Files (x86)\Common Files\5⤵PID:1576
-
C:\Program Files (x86)\Common Files\Adobe\backup.exe"C:\Program Files (x86)\Common Files\Adobe\backup.exe" C:\Program Files (x86)\Common Files\Adobe\6⤵PID:1040
-
-
C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe"C:\Program Files (x86)\Common Files\Adobe AIR\backup.exe" C:\Program Files (x86)\Common Files\Adobe AIR\6⤵PID:1020
-
-
-
C:\Program Files (x86)\Google\backup.exe"C:\Program Files (x86)\Google\backup.exe" C:\Program Files (x86)\Google\5⤵PID:1472
-
-
C:\Program Files (x86)\Internet Explorer\backup.exe"C:\Program Files (x86)\Internet Explorer\backup.exe" C:\Program Files (x86)\Internet Explorer\5⤵PID:1496
-
-
C:\Program Files (x86)\Microsoft Analysis Services\backup.exe"C:\Program Files (x86)\Microsoft Analysis Services\backup.exe" C:\Program Files (x86)\Microsoft Analysis Services\5⤵PID:1504
-
-
C:\Program Files (x86)\Microsoft Office\backup.exe"C:\Program Files (x86)\Microsoft Office\backup.exe" C:\Program Files (x86)\Microsoft Office\5⤵PID:1540
-
-
C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe"C:\Program Files (x86)\Microsoft SQL Server Compact Edition\backup.exe" C:\Program Files (x86)\Microsoft SQL Server Compact Edition\5⤵PID:1956
-
-
C:\Program Files (x86)\Microsoft Sync Framework\data.exe"C:\Program Files (x86)\Microsoft Sync Framework\data.exe" C:\Program Files (x86)\Microsoft Sync Framework\5⤵PID:1648
-
-
C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe"C:\Program Files (x86)\Microsoft Synchronization Services\backup.exe" C:\Program Files (x86)\Microsoft Synchronization Services\5⤵PID:1720
-
-
C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe"C:\Program Files (x86)\Microsoft Visual Studio 8\backup.exe" C:\Program Files (x86)\Microsoft Visual Studio 8\5⤵PID:1704
-
-
-
C:\Users\backup.exeC:\Users\backup.exe C:\Users\4⤵PID:1156
-
-
C:\Windows\backup.exeC:\Windows\backup.exe C:\Windows\4⤵PID:684
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exeC:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\backup.exe C:\Users\Admin\AppData\Local\Temp\hsperfdata_Admin\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:532
-
-
C:\Users\Admin\AppData\Local\Temp\Low\backup.exeC:\Users\Admin\AppData\Local\Temp\Low\backup.exe C:\Users\Admin\AppData\Local\Temp\Low\2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\2⤵
- Modifies visibility of file extensions in Explorer
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1420
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe" C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1632
-
-
C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exeC:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\backup.exe C:\Users\Admin\AppData\Local\Temp\mozilla-temp-files\2⤵
- Modifies visibility of file extensions in Explorer
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1312
-
-
C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe"C:\Users\Admin\AppData\Local\Temp\WPDNSE\System Restore.exe" C:\Users\Admin\AppData\Local\Temp\WPDNSE\2⤵
- Disables RegEdit via registry modification
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1948
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72KB
MD5c7e0ede4ee09e94ed4136f6ae27bdba5
SHA1a54ad1ff170e9f71eebb343b6dbc3714c2108b28
SHA2561fd01b0836b8b2785b085c10a2f08d0076ac887dedf472cddba1495a13addbf0
SHA512b52fddaa2e270f664b45bad9594c98fcb68c9ea6c6ec7f202a210ba60268c41b522d8c1e74a1492c0acb4961380a400df6f0bca7ae1ffed89897b3d782aeeade
-
Filesize
72KB
MD5d2ae3c950c86a2769bbd940dad8b4633
SHA1ff7adbba36b76e78edb11320cf4a3b65941011dc
SHA25638d3ce29225bee97e160cf0a4a2e48cb3d60ceba9952bccbb99fcb3b66ce55d1
SHA512fdf3899788fa2e1e40b5e5dcde11ae2604797181bd0350236fccb46af3002152d29fb3d2a3faccda2e7b281629fe447bce05081844c1c1986318f7858281b2b1
-
Filesize
72KB
MD5d2ae3c950c86a2769bbd940dad8b4633
SHA1ff7adbba36b76e78edb11320cf4a3b65941011dc
SHA25638d3ce29225bee97e160cf0a4a2e48cb3d60ceba9952bccbb99fcb3b66ce55d1
SHA512fdf3899788fa2e1e40b5e5dcde11ae2604797181bd0350236fccb46af3002152d29fb3d2a3faccda2e7b281629fe447bce05081844c1c1986318f7858281b2b1
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD56858fac2c0b68248dedbb274c0e3fc02
SHA176982a10ef538e1308005c3e28bd4ce0689e1f5a
SHA2564f909070aa0bb7777e34bbd5e4b207b316b4190e79a65f49f33b045bb320f346
SHA512a9ea0426e23ef02e6d8ec071651aabe0f6666d621e6ea4921769edbccdecc38086b6c084335172231066aaf1b8a3b8ff81db07ac29bc4d1d86947ac9702c4c74
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD527ba439d07b221a93d0070eb65b8f890
SHA104a4708d11fecc3d3c5647fac48be1409975764f
SHA2562af24d4eb3f03cd5e466b8a1447b5ff8b77cdf9dbdddb9076447a632a842370f
SHA51232e6635319b49839f13a140f85a152d2d39a6addbbf06f1e820fa8198e6d80e1a463885b888906310c327a2b4825dde5f526724c482ca968ade6f63d8e895803
-
Filesize
72KB
MD527ba439d07b221a93d0070eb65b8f890
SHA104a4708d11fecc3d3c5647fac48be1409975764f
SHA2562af24d4eb3f03cd5e466b8a1447b5ff8b77cdf9dbdddb9076447a632a842370f
SHA51232e6635319b49839f13a140f85a152d2d39a6addbbf06f1e820fa8198e6d80e1a463885b888906310c327a2b4825dde5f526724c482ca968ade6f63d8e895803
-
Filesize
72KB
MD53969a8b10ffcffe6e96d21ec7c5bfc1c
SHA11789ca0d9077512bb72045fd6b56988f3bb1e8fe
SHA256f2eb09157e73ccd016cd88c12ba6eeb6ec7cbc1b765168762dc510f4e994930b
SHA5128149c2b7dfef62f7ddd5580e7e8afc4aba850653dfda7cc36fe5ebe75e440d4b7b3b9834f75c0e8c2c5be40dc7757217f10f4d99a9071fe2a9fc1d57b698806f
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD5afeaea8c047f81619055deb525ff216e
SHA15bc3906214a5a3f4777f1146cff76c747a708ee6
SHA2560d95de03966506afe039d649ff619ee3ef60bfcec0a5996f118dd0a3be743df1
SHA5129b782847cb08181ccc33c9a29d376c37550aa033ae6c7fb639638ef93378918e047ab33ca77e7ab5a49558483cf0d3c80ddaa45c02c8b65238471e72e5217a7d
-
Filesize
72KB
MD5afeaea8c047f81619055deb525ff216e
SHA15bc3906214a5a3f4777f1146cff76c747a708ee6
SHA2560d95de03966506afe039d649ff619ee3ef60bfcec0a5996f118dd0a3be743df1
SHA5129b782847cb08181ccc33c9a29d376c37550aa033ae6c7fb639638ef93378918e047ab33ca77e7ab5a49558483cf0d3c80ddaa45c02c8b65238471e72e5217a7d
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
C:\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD539e316111167532fecb23a17a0b4616c
SHA1011318ba75faf4a49677da71f15a35bfa59c71d2
SHA25672b0d5167288367df236048e0de2845de2158bc56ff3342570b9fc84a6c0cfa9
SHA512457066ed8fc0790de540bc01a2c44e8b3d5ace4291dae29f59ca93f16d6f8cdb4acc8a9ba633ce94b88331126b445c28d4910a121b29a749a5f644493f0469a4
-
Filesize
72KB
MD539e316111167532fecb23a17a0b4616c
SHA1011318ba75faf4a49677da71f15a35bfa59c71d2
SHA25672b0d5167288367df236048e0de2845de2158bc56ff3342570b9fc84a6c0cfa9
SHA512457066ed8fc0790de540bc01a2c44e8b3d5ace4291dae29f59ca93f16d6f8cdb4acc8a9ba633ce94b88331126b445c28d4910a121b29a749a5f644493f0469a4
-
Filesize
72KB
MD5c7e0ede4ee09e94ed4136f6ae27bdba5
SHA1a54ad1ff170e9f71eebb343b6dbc3714c2108b28
SHA2561fd01b0836b8b2785b085c10a2f08d0076ac887dedf472cddba1495a13addbf0
SHA512b52fddaa2e270f664b45bad9594c98fcb68c9ea6c6ec7f202a210ba60268c41b522d8c1e74a1492c0acb4961380a400df6f0bca7ae1ffed89897b3d782aeeade
-
Filesize
72KB
MD5c7e0ede4ee09e94ed4136f6ae27bdba5
SHA1a54ad1ff170e9f71eebb343b6dbc3714c2108b28
SHA2561fd01b0836b8b2785b085c10a2f08d0076ac887dedf472cddba1495a13addbf0
SHA512b52fddaa2e270f664b45bad9594c98fcb68c9ea6c6ec7f202a210ba60268c41b522d8c1e74a1492c0acb4961380a400df6f0bca7ae1ffed89897b3d782aeeade
-
Filesize
72KB
MD5d2ae3c950c86a2769bbd940dad8b4633
SHA1ff7adbba36b76e78edb11320cf4a3b65941011dc
SHA25638d3ce29225bee97e160cf0a4a2e48cb3d60ceba9952bccbb99fcb3b66ce55d1
SHA512fdf3899788fa2e1e40b5e5dcde11ae2604797181bd0350236fccb46af3002152d29fb3d2a3faccda2e7b281629fe447bce05081844c1c1986318f7858281b2b1
-
Filesize
72KB
MD5d2ae3c950c86a2769bbd940dad8b4633
SHA1ff7adbba36b76e78edb11320cf4a3b65941011dc
SHA25638d3ce29225bee97e160cf0a4a2e48cb3d60ceba9952bccbb99fcb3b66ce55d1
SHA512fdf3899788fa2e1e40b5e5dcde11ae2604797181bd0350236fccb46af3002152d29fb3d2a3faccda2e7b281629fe447bce05081844c1c1986318f7858281b2b1
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD56858fac2c0b68248dedbb274c0e3fc02
SHA176982a10ef538e1308005c3e28bd4ce0689e1f5a
SHA2564f909070aa0bb7777e34bbd5e4b207b316b4190e79a65f49f33b045bb320f346
SHA512a9ea0426e23ef02e6d8ec071651aabe0f6666d621e6ea4921769edbccdecc38086b6c084335172231066aaf1b8a3b8ff81db07ac29bc4d1d86947ac9702c4c74
-
Filesize
72KB
MD56858fac2c0b68248dedbb274c0e3fc02
SHA176982a10ef538e1308005c3e28bd4ce0689e1f5a
SHA2564f909070aa0bb7777e34bbd5e4b207b316b4190e79a65f49f33b045bb320f346
SHA512a9ea0426e23ef02e6d8ec071651aabe0f6666d621e6ea4921769edbccdecc38086b6c084335172231066aaf1b8a3b8ff81db07ac29bc4d1d86947ac9702c4c74
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD551ce636d376dfda12b01cdd08a31e274
SHA117702120050d7d688c539eedf6d012f881bf565b
SHA256738fefbf269f3bf7cd0f77a0f43cb6e062c344b0ae776f5ac23d4478a76a5a4f
SHA512fbfd21ac0db11f67299511ab7a6b5180d8792e3d3d854d7cf0fb9084dd1f4324749be1ceb75d68ca36a85f6e2bcedb5650a2895624427d988a53e8cb0b9f0f81
-
Filesize
72KB
MD527ba439d07b221a93d0070eb65b8f890
SHA104a4708d11fecc3d3c5647fac48be1409975764f
SHA2562af24d4eb3f03cd5e466b8a1447b5ff8b77cdf9dbdddb9076447a632a842370f
SHA51232e6635319b49839f13a140f85a152d2d39a6addbbf06f1e820fa8198e6d80e1a463885b888906310c327a2b4825dde5f526724c482ca968ade6f63d8e895803
-
Filesize
72KB
MD527ba439d07b221a93d0070eb65b8f890
SHA104a4708d11fecc3d3c5647fac48be1409975764f
SHA2562af24d4eb3f03cd5e466b8a1447b5ff8b77cdf9dbdddb9076447a632a842370f
SHA51232e6635319b49839f13a140f85a152d2d39a6addbbf06f1e820fa8198e6d80e1a463885b888906310c327a2b4825dde5f526724c482ca968ade6f63d8e895803
-
Filesize
72KB
MD53969a8b10ffcffe6e96d21ec7c5bfc1c
SHA11789ca0d9077512bb72045fd6b56988f3bb1e8fe
SHA256f2eb09157e73ccd016cd88c12ba6eeb6ec7cbc1b765168762dc510f4e994930b
SHA5128149c2b7dfef62f7ddd5580e7e8afc4aba850653dfda7cc36fe5ebe75e440d4b7b3b9834f75c0e8c2c5be40dc7757217f10f4d99a9071fe2a9fc1d57b698806f
-
Filesize
72KB
MD53969a8b10ffcffe6e96d21ec7c5bfc1c
SHA11789ca0d9077512bb72045fd6b56988f3bb1e8fe
SHA256f2eb09157e73ccd016cd88c12ba6eeb6ec7cbc1b765168762dc510f4e994930b
SHA5128149c2b7dfef62f7ddd5580e7e8afc4aba850653dfda7cc36fe5ebe75e440d4b7b3b9834f75c0e8c2c5be40dc7757217f10f4d99a9071fe2a9fc1d57b698806f
-
Filesize
72KB
MD53969a8b10ffcffe6e96d21ec7c5bfc1c
SHA11789ca0d9077512bb72045fd6b56988f3bb1e8fe
SHA256f2eb09157e73ccd016cd88c12ba6eeb6ec7cbc1b765168762dc510f4e994930b
SHA5128149c2b7dfef62f7ddd5580e7e8afc4aba850653dfda7cc36fe5ebe75e440d4b7b3b9834f75c0e8c2c5be40dc7757217f10f4d99a9071fe2a9fc1d57b698806f
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD50a7a9aa8be3775b127231a540e3d0528
SHA1391c537e1d6bf0599eeeda5d727297f712496057
SHA256231b54db81a2b76f788f6d92f0067f3885705cb96ec3676d43a8de3500aa617c
SHA5127c8a37a0d9c42f58cf2ce8cdd1a705afdbc241214d27f297fcf1152c91fead98df06fb48b446a2c7dcc32cbc8353fad336028121d6c5c09f19d72fc272713a28
-
Filesize
72KB
MD5afeaea8c047f81619055deb525ff216e
SHA15bc3906214a5a3f4777f1146cff76c747a708ee6
SHA2560d95de03966506afe039d649ff619ee3ef60bfcec0a5996f118dd0a3be743df1
SHA5129b782847cb08181ccc33c9a29d376c37550aa033ae6c7fb639638ef93378918e047ab33ca77e7ab5a49558483cf0d3c80ddaa45c02c8b65238471e72e5217a7d
-
Filesize
72KB
MD5afeaea8c047f81619055deb525ff216e
SHA15bc3906214a5a3f4777f1146cff76c747a708ee6
SHA2560d95de03966506afe039d649ff619ee3ef60bfcec0a5996f118dd0a3be743df1
SHA5129b782847cb08181ccc33c9a29d376c37550aa033ae6c7fb639638ef93378918e047ab33ca77e7ab5a49558483cf0d3c80ddaa45c02c8b65238471e72e5217a7d
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x64 Redistributable Setup_10.0.40219\update.exe
Filesize72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
\Users\Admin\AppData\Local\Temp\Microsoft Visual C++ 2010 x86 Redistributable Setup_10.0.40219\backup.exe
Filesize72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5229fb894242a7379c193f48a752a425a
SHA145b040d7b3ba55b8a2f857fd07a449f17fa62cd0
SHA256e92f7965238c391a2d66d43b14f6a00c93a7730048351e6d1eed0c1de079b447
SHA512ed57b6440005981e56fed733d85367377eb5556f00ed6d6636cbbf0f2fec5949039a5d5658a2fa0c790a83e820c6311e94406b090c6533625fe655273df00c79
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0
-
Filesize
72KB
MD5def5965963ef2efa5d753fd15ddbe5c0
SHA134b489a48b2c8ed889626c6fd571eca23eeef4af
SHA2566b689aa1a477e753656539f8ebff92beae79fcaa55a8c9279f84a1836f2b2852
SHA51217e89f5a35ddf1142cdaf54fc089f090ccc65818bb7b9daa61571d37b9c8c720b1a07c6513b48a4514ac11eff898b6c294cdd5f2fc186e34b81cfc69eb119cf0