04c9cc0d...aa87

VTI SCORE: 100/100

Dynamic Analysis Report

Classification:

Threat Names:

Gen:Variant.Ransom.Ragnar.11

Mal/Generic-S

rxodge.exe

Windows Exe (x86-32)

Created at 2020-07-30T12:04:00

Remarks (1/1)

Process Crash (0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

Indicators

File (84)

Filename	Hash	Operations	Category	Severity
C:\Users\FD1HVy\Desktop\rxodge.exe	MD5: 574f3513f6d7e15f102e82e4d35bf164 SHA1: f7a38385fe41bcd154fc7b6da034bfe719d6a0a7 SHA256: 04c9cc0d1577d5ee54a4e2d4dd12f17011d13703cdd0e6efd46718d14fd9aa87 SSDeep: 768:Y+qVvyh4GpndLLngeVyIz2yOVn/fqsOSljJ+/:JqYBdLTgfs3RSljJK ImpHash: 2c2aab89a4cba444cf2729e2ed61ed4f		Sample File	Malicious
C:\Users\Public\Documents\!$R4GN4R_B8CF767A$!.txt	MD5: f404b04194e67dec4e42b2027b2484da SHA1: 85d07ad4115c52d7a87f886ce51437a7612c7db6 SHA256: 046ee39ba91ca3d6f636258184e08d4e0a86ba4a41f7e80169680037d46a471e SSDeep: 48:5nnQ7LyK/TbSNXvy1tconUbPF3NODXa/BdbWKMqyvBCJZdtC39zMZC7i1FTzsvb8:5nyfEY6bNMDavWhj033kbYNsqHebE ImpHash: -	Access, Create, Write	Dropped File	Unknown
C:\WINDOWS\System32\spp\store\2.0\data.dat.tmp	MD5: 2168280f3735fc96efc2644257b14021 SHA1: 3e034ea3e396a395b4dcef5a58e239b68a27674c SHA256: bc8d09f26b0af7bd45738f5405b9060409e49fb9e0bd885058a4a6b0559e8d54 SSDeep: 768:/JJSEM2TSoM5URI5cZuTTjODuSDiC5wfnaumO:/n/jTdRUcsqDWF+O ImpHash: -	Access, Create, Delete, Write	Dropped File	Unknown
\\?\C:\$GetCurrent\Logs\PartnerSetupCompleteResult.log	MD5: fe19069f6725832ab0703018f6ea1b04 SHA1: 2251088955d58f971b3872edc57f46830d958d21 SHA256: fc540fadbf7199100cc6e53e77624f10752a27fea7935485b1258f83fa2b3d7b SSDeep: 12:L5WoDKYOxbv/b7v7udGwDsV7OR7pu7eoU69Hh:woLOxb3n6yZOR7p+L9Hh ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\$GetCurrent\Logs\downlevel_2017_09_07_02_02_39_766.log	MD5: 619544d001d7f467184619b9a15fc3d6 SHA1: fe15ffa1d0fbc998961146f87e545d366f9d9889 SHA256: abdafcdc7c0adb735c20d78b232a675bcf90f13f2e192a626e0e4cd0bab882c1 SSDeep: 768:LTahfTTFUlG5VY8KqIJOvbczCHuxeAYlFwhFMO+1JRgM+kyGMH1znPbAWf:L2JHFUeVY3qIJxzCaY+ryxsVH1zPcc ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\$GetCurrent\Logs\oobe_2017_09_07_03_08_57_737.log	MD5: 36ed7c9d0ca478a09cd60988b8099569 SHA1: 685e77d8027d1672d2855295a19c09b5e90ffd0f SHA256: ea283cc5cf77a16ffcf65a9d10c51a941bc3b99185b90092d781e0fd3fc1a1da SSDeep: 96:RgIa2IpoXS5diArT2LbJhqj4HiquL8GetZhAhKs0p9AWORqG1X3e0VmpQIpvNNKj:RgIazpoX4dh6qLquoJoK1OLMeI5u7t8A ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\$GetCurrent\SafeOS\GetCurrentRollback.ini	MD5: 5ab018d2000831fe1ff089c68cf0bc76 SHA1: e68a47f47530c25e0f56a13cde2a580ed8649ab8 SHA256: 723cae9edff4406075e575cdfe497fb0ec421d41c1d21b1764af27aa8f4d6b01 SSDeep: 12:eEI8rUx56P7iQUA82YlrHbLTWInMtTV3SJZXAQmUkYZupPYxW0Q8A4h:0oZ82Y5Q/yh9NkJmBA4h ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\$GetCurrent\SafeOS\PartnerSetupComplete.cmd	MD5: 816bdcfa649bcf18813fe00e514ddc79 SHA1: e5a42192826f73d05ca45ebd7864a1691902a5fb SHA256: c3bea0b509039e8614388ac793a81bff6cd28f8160926fb5401b2aa97861d6c8 SSDeep: 24:QU7mtlzACNRbw1CMdxw9UaqIt/lWjSHASCzu58zjNKk2HmJ1h:QUQaCGw9UaZttWtSCzu5RS1h ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\$GetCurrent\SafeOS\SetupComplete.cmd	MD5: 9b309ee850cebeebb23610cb68f694dd SHA1: 3b1403c287bf0037377146b1c4eafc95f38491ac SHA256: 8bd231fff14331e54ac07aa73b23ca1a8029f0c050b13e5a9ac7b6b97b0b080f SSDeep: 12:4zRUski52hUGKmXAIHYoiDWzPNb6/lAY0ZjU7xBf1bvz4LwThUxyfwwUh:anGbAK9ioFbO29Svdb88TeZ7h ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\$GetCurrent\SafeOS\preoobe.cmd	MD5: 960d34c6815ac5a14e093fd2e8e415a7 SHA1: 5544e5a536471eac9bada079f87001529db04063 SHA256: a5cae6fcf02e982f69a4e9a9bf2ec9402fdb04426763b89e3b923941889ce04b SSDeep: 12:dI34Mdvo3CM1MvM29cdTh7sZVfKPtfA1TflAgrtiUTW9XQUDHKQMBqMuah:deXmQNy4zm21TfagrtiUTWppfMBqBah ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1025\LocalizedData.xml	MD5: 18f54f13ad179756f6f6069e2ffe368b SHA1: 2b577a7537cac2b49c5fb05569c952568efeb782 SHA256: cbf5a960be3417b6eca7dc9f0e11e5afc4e3997bf5a63577e9249b701aa93936 SSDeep: 1536:y81Im5hg2QRXd+eDYA5Uym802bcFJIxi9YMHFQCNJc:7N5i2QRXd+eL2Ixi9lFFNJc ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1025\eula.rtf	MD5: a370318e50146461c73c42eadeae3924 SHA1: dec14d277b0640b6855dd089780e0d0a625cf514 SHA256: 441ba48e8e06fb6c2490f1cb29e133a20f0af0629fbe04f0f81c9bb6cb784acf SSDeep: 192:Tgy8la4QvWuwszmtAfQw2ViKC1aMAXOjCen32oTfnRlnA:TCrFN8Qm91aoe/oTPRlnA ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1028\LocalizedData.xml	MD5: ff1e7c35fa27c4a245451a75cddd4ebf SHA1: 9d4a1841a2375c859e824c3c189911b6df8c9d5a SHA256: af3891c285f8808ee2e33beb968d9839101d2c59ba300dab1a6acfeecd199394 SSDeep: 1536:wjtXJjJ7LumOpIDeWXEHWV9kqVguWPrTCe2YXLMeJCmQ:wZXJjlipIJ0HWgqVguWPrTRLM5 ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1028\eula.rtf	MD5: 76eb5bede371f304cbfb9c58a9afc4da SHA1: 0c5d86191b29f69bb29b5e14ad3239fef3c86a46 SHA256: 6a127353d5cdd08710f103377119fdb6fdad592abce38c4a631dd5dc4093fa62 SSDeep: 192:SDOzA8YDfK1rga2d7lMBTWE7HczRXX8uGm9PDPs/nuso:S93TK1r3oIW/Gm97URo ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1029\LocalizedData.xml	MD5: b9d4941fe43aded121e89bdf968cad04 SHA1: 9f85a740b73de24984cbcb51a7ab0441e9d52bda SHA256: 9844e7300dd33b6e9364e5664b0d9deed36f8accc9340f9a9fefaa36af4e1ced SSDeep: 1536:Q6w0vqp6/rpH8JxETWZbSRf1XYghvdLCOKkFagn9sQuM:Q6w0i0JUCTCb+BYg3WOJas2+ ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1029\eula.rtf	MD5: df823e56cc0d0aa4350956787db394e9 SHA1: b8e748b9a6e671bac8762deda463b25e88acc72e SHA256: 46931a04d04dc20804236bf28063cb1b76a41c103218a4bad5eaf6e7643c703e SSDeep: 96:2G67nq0xXvKgFrUHTld4EOFwSAmVWaHMqunBC6ia/h:D6RBvfFYHpxcwhmVWas26RZ ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1030\LocalizedData.xml	MD5: d3ac4ff514fab4ed31d77008614e0abd SHA1: 240c59a06a2c75d94efa918f32e9bfa86fe23dd2 SHA256: 58fdce456f8d90e91e0dc904d4c9846fd1d277c343d568fa0c00bf5512b5d361 SSDeep: 1536:JY81CeGHxCBqAMqZ2z9F5rg3o0FF5tt9qHWvBFVWF0vz8DF2Q9WEh:JY8Ae4ctMWefgvrRRBuOvz8t9WE ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1030\eula.rtf	MD5: 21ae894dfcd321f7163dc2f926f5df20 SHA1: e54be991a0d70b79d97b95fa18c33e419a41e8bb SHA256: 9e855370d3f01d84c22964400b50bc465c97b506838b6347e52478336bad843d SSDeep: 96:pSDXrd/8zf1zxZklRBkdTIWahvomvLGPa96EIx2nUh:8rJ/8zNzxurBQcwPa45OE ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1031\LocalizedData.xml	MD5: 5a98e0bbec419b60b0ff2ce2e64e6670 SHA1: 89b0b36e032a770e809120b9e3e3dc181903991d SHA256: f93ea5ba47e5c22af5bf53f0b70e3d3970a8556bd9ebd65e8dfb65d7d561e02f SSDeep: 1536:p8c05E/eyeolXEqN3V8e5C54UGI1U/NidmBbrzvheDyf68uAAGhvmkG/nS7Ije24:Ci/ey5ZxiGJMdmBbrzMyt1BmLS8t/e ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1031\eula.rtf	MD5: b9092f62c218e3941a018251dffd745b SHA1: 56b8443449fec26f61396857ce4b23901c2730d4 SHA256: bfc032ff8dd82c91c6857053a0854fe527b66cac4c12ea28a2d2abddae47d773 SSDeep: 96:OCvf6AUtFV3npwjtm6A1iJRnHAAYaKaSplod6d7UqUKy9h:OlXnpwjYj+VAIQl8Sm ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1032\LocalizedData.xml	MD5: 9461e19c3fca8a3b631982ddd208e70a SHA1: b1d0b82ed1e684b218ed42abbd32de1fad59f71d SHA256: 1b4e02245aa1a6f3d96c2eb01413b17e3af73555fccd9ea21cd26d76bbc7afbc SSDeep: 1536:9QVCuyi+FrsIlGC0ZSXTsVgMl8j04rzG62M23juFMxnRntmUHY5pTsGMs:9ceFZZTygdAP62M2zuFwRnQRpT7h ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1032\eula.rtf	MD5: f32fd6b0fd2760bf6221adf7aab3623f SHA1: ada30d6702dedb49765db9f2d15dfb56622be2c3 SHA256: 98ad8bef038552a492c5c1e43164ccdb0fa39fc4292ab0636160f461f038777b SSDeep: 192:O29NxGbAUivLHkw8FtN2vMpqufIaXQ1EsQFu0zno1IbBbmYsU:O2xSAjzkNtxpqgIakMu0znoQl ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1033\LocalizedData.xml	MD5: 4fddc4d1c2c8c2e881f7bc5ef2ae8b1e SHA1: 6caad58c7b725c3aed13ecc6c55fb77b7e8e7865 SHA256: 82ba91f471c91e79dbcb3fb326b333b44189a57c5ce166ba568d80395897b7a0 SSDeep: 1536:JLQ22zRrquq547P7vIqo0G0GnYgjoqgAHjNXIhdTiZMqC1bG/Pk/x2:RJ2z1qobIqFIoqgADuTiZMqCxGE/x2 ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1033\eula.rtf	MD5: e4a061f80aacf80bd3aeaff4ec95b8d9 SHA1: 76f9b85d78fc8d156cd2c59cd95396287016d2c5 SHA256: ad54176751df03dc82afc977a0556c2f5d302efafe1895c5f7b5c40e215e95fa SSDeep: 96:7N/TufSMoTE9A/vakMP5CqXXIHhkkgcW9mBSFX1eAh:7N/afD9aGkVHPtDY ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1035\LocalizedData.xml	MD5: a25e95ddfa172e146e2fb4643bc9db86 SHA1: 85c6e6e7a22ae3be95da1686ec44302fac8a1037 SHA256: 6f4ff79c5f43a20ed17464204198db035baf4fe73150197013dd6f96221c21bd SSDeep: 1536:nbHxIC5yZfDHx8J3b/EVVTVpTlXjinD3vc7hEoxg8lSP4BDt3nL:npUWt8VTVlhGnbc7pS4BBXL ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1035\eula.rtf	MD5: 23525a3fb5106d7d18590edc535d9f50 SHA1: 1451bec24b37bb74fe10b016fd3b00cb995ee5da SHA256: c63365faef84546f2592c9fe909439edfaf7cec81da1b2e74fb55b214a8602ea SSDeep: 96:lU++scdYcB2CtH6mhWUiSqraEVvmDtT+CVyMrO2sYBtyZQ0zeh:y91dD2mBiSMaEVv09lcMRsmEK ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1036\LocalizedData.xml	MD5: 876316bbec5a4b1cdf090bd462e5dcbe SHA1: 19e997d4a89de01540031b9824294b06d75d193f SHA256: 03c28412e49f5bf01c136d2c21e68fc28224484f28f9afee3f4ac3e7a460c49c SSDeep: 1536:vTMvzLoY0A0b5gj3gW7KGwvmE1egS1hRWeuIssTh3LR9KqSsDiG:Y7M0W2jjMX0hRpJh3LDNSGiG ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1036\eula.rtf	MD5: 0410c2705f64dbc0c955575a2b17798b SHA1: 3509c90f2338ee3e725f510cd10584724f90d19c SHA256: 572e7167b1d27787c376330080039d117361c9026ec63beb8d0eb832f64dfd44 SSDeep: 96:wlYswiqRiYZz7gXy3IyfGMokaB6C0dqz58IByp1Gh:wlr6zayTuwm6C0d6JBL ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1037\LocalizedData.xml	MD5: c1d0622f657ca4247ddeabc80476e5b2 SHA1: 1c47d9a40ec698340b8c981f8a6533a7e741992e SHA256: f172546e37432868a5af2bbe655a043ab59015e13646061808f8399336618abc SSDeep: 1536:lYdYJT/Yj+zQ8krAZSNerFx7H6ljT9+vhutcSTLY0LfdLySO:6dYVACz/+BNervvc6SQGd6 ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1037\eula.rtf	MD5: 7b3cbde8f320bd822b8b2eecbb78eb8b SHA1: 9365689bf6f431d397092708f6c81ff1c3822b4e SHA256: 76145cad2cb7d3c161aad2f039bbc4da1f9243789065ed5d1570a0a7a01b4b36 SSDeep: 96:eVTmfWd742wa/tkD3IYWj9lGfTozsSmoINVRpzq9/t9W3RtUO+YuBuakyZp2ApFm:YTmOu23lkDC87E2dy63R6O1j/MayshT ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1038\LocalizedData.xml	MD5: 835a3b5504d86d96792cbb17fe10ed9d SHA1: fcc9767550f94f8d17d5dfb78fc888afa2f7628a SHA256: 9ba6ed43d4a431614c625a99dc6330661130ecba3dc39b67db6048965552d7ed SSDeep: 1536:uJTwyTdSeXvlp/hshtK4rq7bqWkfs0CeepVyEocNHEzrdshZN0LDBoAKX:Esyjflp5/4rq7bokp5HEHdH6t ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1038\eula.rtf	MD5: 0224022a17fc690c7686862aec9d1727 SHA1: cbc98de8fb6fb7fd6d5f0845273ba3e644b9af0e SHA256: 1791006486569276dd085d6a0831ebe6a02f11abfd3a9ce1d50c84afc038ba6c SSDeep: 96:x114qT9U0uoPLFPl6345oqRjalbR4epWv1vNKVYxbPjg8KZYHAZcURkB/MPxh:L14X0/DFPl63yH+lbROdvoCxLjg8DAko ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1040\LocalizedData.xml	MD5: 0e638ae2e7f69fe4b34d108c0118069c SHA1: 36212ab5c02e216e1208f85caab0a5a44f42bb7d SHA256: accd1ab57748fd069216621c358e1f483e4d91a9bceb88754e4e4bc9b2488631 SSDeep: 1536:9K/80UqiaEo4JB2rY5PuhCaPEQhDGGtHnnFzWxLOiFHbQ+VK7CkJo8UC:9K/l4YY5PQC9QhjHF9iFHb3Ieo+C ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1040\eula.rtf	MD5: 1d8bf3764472acfc86d190126e8ad386 SHA1: eadcb633d6c31f388ec39d72c4c41a09dc6980f7 SHA256: 14d642f5c9531996d177aba704db7dc9e6c9483b57a220bae374c3850bc61a0e SSDeep: 96:wtI/Y98FM0x0hUUD/kXedDmcOFF13sCyLTjiRQfA56gwh:jjFWhU6DmZBKDQ6go ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1041\LocalizedData.xml	MD5: 5274319035d72aa58dc827e330c54ca7 SHA1: 21d650ee18bddaf134d931d6c2570d657ae82e53 SHA256: 7a94ef1140ff1a6cd2cd12a0d098ccf0b6d8605e4c34752c03b94e95b0c787be SSDeep: 1536:RIwgsPfZ7cXAB+jTIaMbxdIuCY3Tam+ZFVscDSwlRqmw3Xd:GzJ0+NM7MYWRXSGqd ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1041\eula.rtf	MD5: 7961de1e030f66467cbb5f452919766c SHA1: f6c28ebefefcf0d50b979e18f71db242154947cb SHA256: 9e3cd3361ecb9996df8f6f9b7c24ae360d645f1866dadeb146eef9264d373ff5 SSDeep: 192:YFV3zWJJPzVn056bGImjC210F78q4glgJ411E6DrWGYniAQP6S7H7W60zHbgrYp0:YFV36zPxQ6ynjJ0eq4nwLDMXQbH7v07I ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1042\LocalizedData.xml	MD5: 6800d5f0f6b803a237b2fd7f9c8d0392 SHA1: a27c9d72a4b93d5135d3343585f5118bb1f87e4b SHA256: 848339659fbf63c0d42d1f53df15398ad3bb937746a4db6f50bbc42e6039b90a SSDeep: 1536:R+5Aeu8EMNSKTcHn07ihKbWSgkV/Slqnj7Ng1SbG:VeJlSK0n07EnutjPbG ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1042\eula.rtf	MD5: a9a52a1878abd7e37b9c8f49b0a70a15 SHA1: ab59f301badb1e96790bddab2f37cce9ce301871 SHA256: 7e9e73fa67fedac5d51688098bef790284439d30d23786ac1778a6fbb0b7f85e SSDeep: 384:qKUrmqtmT3NvLL66P7kGJgirwgQwW2aFLboN/3:iaqK35LLxPAGJgihQw0mN/3 ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1043\LocalizedData.xml	MD5: 49e5167a903d6df1b51d19af167b5ee7 SHA1: edc1eb4b6751aec3c7432310dcd00650b4e4c8a1 SHA256: 5b13b6363ae5b4023c52ab28b920ebbd9625d24bf3464298b702b825cd59ad22 SSDeep: 1536:Y0lp1TxKKFj5/wU1YGrIAnLgFX3GeLk5W+Bu2gx/N3fbt7BM/:FlpdxKY5/kGEkLSH/MS/N3fhBM/ ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1043\eula.rtf	MD5: c065c7502a9777a4b11e8a319a7ca63d SHA1: 2a7269f468cb41acc844ece3cf7d17c993371ba8 SHA256: 3e4cdc529dbc4edb1257f5d0232040d8de66b569e464fbb12fec16d8b0b79946 SSDeep: 96:/uafSw3XHeFEFK6TmLkGjC4o9jmPEXy2IW92VcDwEfRgOzKsV6o4/CNh:/uMSwnHFFK6TevFosPcyZWrwkRFNV6ry ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1044\LocalizedData.xml	MD5: 0d5bb6249eecf443d328f531eb7bd4b0 SHA1: 57b4f3653d9055f60721ebdf47e0d3eb9629a6df SHA256: 65e71d44e40c6bf9a825e7051f1b8f2980b1f441bd7b197a292bc453d467abcf SSDeep: 1536:Q6YeuIfEMGdn7VDlr4YTNGl56xQ1ghg5Ifb2K7ow241Ztr4PbfBOKjfejm2R7Q:QvMq77r7TK6u1EY6b2K7Y41ZxWfBOWGC ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1044\eula.rtf	MD5: 4fb95a1323561a1d4bf744f5c34c558d SHA1: 8ef906a2b0c68dc70221eb7c2f3c1eee3c74119c SHA256: f810af3e86afaaedeccbff95529594a1c11f0b724dcc0ade0749422789057f99 SSDeep: 96:eZBOshwGTt4WDDwNomuQC70DPXHsDHvEfKCh:ZODooLHIP8DHOb ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1045\LocalizedData.xml	MD5: bc7e98e91514903c2c5ef9eea465a463 SHA1: 7a8db32ad843a6b917f7e3685f7c9e9d9543b09f SHA256: b9d9506a273e578646cd2f031755531b1f114bc249af99ac4a13173eb345bffb SSDeep: 1536:t4PwotRGJmj7AyL6PxEf+V8XnZlzJc+aTzXYxgy1gwbfctYHVStbUmIRZ:mhGgV4xEfo8XnZ9aYxgyuwTjHVStbUnZ ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1045\eula.rtf	MD5: 97548d5b9ed9ca520a552e119a8e2356 SHA1: 71eb309c3588e7334c0cbfcf7dc3d80bf901705f SHA256: fcbe53ffc587c68736bcba9754c3bd7553b68bcac7c88ebf51b6daecdd9b29f9 SSDeep: 96:9HxyYhR2ZHjshMQhr2c2kID3pcJzcFhZvPYiC09xgj7Qh:9HxyYh4ZDsCQhr2c7a36hcF7PPbfgj7I ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1046\LocalizedData.xml	MD5: 182f23d1ebef62aa8abbcde6fb7c35a8 SHA1: 0133af740eb094f4fa07a433613fda2d118649f9 SHA256: 2c043511dca2777ba12467df82c843374d4c987116b0168efe0a51c0f30ccbb8 SSDeep: 1536:XTPg/MLkymS/jxwsdZcuXHl2ZKjM//o8sM1JjysB9xjX4sG:jPAwpm84uXHwMjM//vscJj19xju ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1046\eula.rtf	MD5: 19664f282f6408a7475e2ea5edf2bfd0 SHA1: 9f199ee8b010513b258429d66db9faa6755501cb SHA256: 5a808fecde34feb21aaf650da7b56723dc58667afb72e8d11927a5228fe4a8e3 SSDeep: 96:fML5TwdpCxDpaDXF3q0grYsgywdp9Usmws0Tdh:fM9TQE+F3u0XUsU0Tb ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1049\LocalizedData.xml	MD5: 3d2f71da4afeab4bf0a52a74ba38928a SHA1: 6489d54d3e5c4ba2910a0a8c686c8238829525ab SHA256: 170bee5200136ed00a9dc9863c9ae305a97674c232806687be843575f06fc216 SSDeep: 1536:sRzVb/SLEee1555wTqUUVTUFnGHHOZxlz28iFKaOPoppX7MrEztj:61zIqZTUhGnOvlq8iFKagnwztj ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1049\eula.rtf	MD5: 5b4371b489a6ec5aa46790e57fc4d2f8 SHA1: 8e5536f8a700dc721c0dc2a34df1b3bb24cb889d SHA256: 62a5095d59a9bdd3ed609ee6297208b2089915c916728938f6bf62ac65db19e1 SSDeep: 1536:Yao+gC7OaCBwBst5eGRbUTc8mzGOvdImNiHziqsj:/g7aLst59Fx8mFdZ0HzI ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1053\LocalizedData.xml	MD5: e5ed11fe127b4340fa51cecb2d6496db SHA1: aaf3d95c467e47636ad8ce4d1e3862cba1a39d7c SHA256: 5d87692b626ed7d991b475584eaa81f151c5fc48b9bed28d5c8372a953aef255 SSDeep: 1536:tugH4NgRxxSoTYudHjmgMsHiJfE+REy5EZ52miwIBz3i6TNAc9:5ggRxnxHjrHMs+S7v2A+iIAc9 ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1053\eula.rtf	MD5: b2a8667c2b52e7ed4746cd887ffee8c4 SHA1: f20594c1356b217b1e19414debad5946b7efd24f SHA256: 4856116fd24e62c3a25b8d229b0adb8af9bece57c3d6eb0dbc9dbf9074553a56 SSDeep: 96:22TnSke8JProAZeiZNMQG5+A7ORzlzck4xw/gf8C1Bu57xdObh:FTnSlgMY0TalztZSSdON ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\1055\LocalizedData.xml	MD5: 4c1ae768891fe52aa35da8cf7279f7cc SHA1: e32631840dacfc5412206118044876db0cb52cde SHA256: e8cf2451da54c0e6c2665e23988ac716a458e9c309755fad86b8debdea733202 SSDeep: 1536:pV8uUpH4mN7Djp6bILnPZ/+UeRM6GvR1IIDGLLJdfa6GeYUoJb3DGCay4RgQS:kuG4GfSILxzam7GfffElb3ay4s ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\1055\eula.rtf	MD5: 9b0d61160d9e0955421b862ea7a24009 SHA1: 2dbda774b4c0a1b0e43ec0b0e427f0eab23127df SHA256: 5a491abf603e461bbc204e22c51b445c16c226653260ff8417867ce303117069 SSDeep: 96:y9sx0hBrGLhnLP88t5I0Jz1KM/1XpteX3Mq+sAtou9eNZO8Pe/1iBeP2FIzrh:79fI60g1X3eHdrAr9iJPe/nP2qp ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\2052\LocalizedData.xml	MD5: a7fa084d89a524f401a1fe8b3c8a8165 SHA1: b0c2c743b73c70b0b0a506aaf9e0650e77e64017 SHA256: e464cf7d7d481603417f26fc0a5147c346f5d5506829584f84608a94e86dba9c SSDeep: 1536:QOZDEVcqRJyE84M5p8zycpv7sh26Vtsdheg/R:1icZEZWp8GkoPt2r/R ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
\\?\C:\588bce7c90097ed212\2052\eula.rtf	MD5: 9c34fc9be5a6059fbbbddf371fe52607 SHA1: 91f878305d6c0975b6b59f45e3b1ff636c469036 SHA256: 3d0ab96f276a053a59548f9c726e633f48d1a57ad9a4c15a4f3ad9043dbbaeca SSDeep: 96:2yinR0Iu5qyo3rTsYYWppYFh+EGS0IPUx6tGLoRfzccKQuQ7jDANXh:2/na5qRnspWpOyEj0+kLoZrKtCjDANx ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\2070\LocalizedData.xml	MD5: 24b77ab74015b3802f6b38f5222562e0 SHA1: e83e82a13cd961c6a723c28a66b9d5d1ad0a78cb SHA256: 688af0242d95d81296e074312fef2c4e6397fa03e9a41b20c7aff2814246fcfa SSDeep: 1536:PUVl6j/LVkT2JBzOJ82VcQueEpRsXZrSxw8MWrA41kA:sepdOvVvuziZrAsWs41kA ImpHash: -	Access, Create, Delete, Read, Write	Modified File	Unknown
\\?\C:\588bce7c90097ed212\2070\eula.rtf	MD5: 6b0909f68329a45254fd76c29242efaf SHA1: ffef33757a432720bee27fd2427913e0ea90ea10 SHA256: 4ed6bc1851cead1545b7ce8137e451b9b4c394b7374d2a1d2ecb58bfbd61cca7 SSDeep: 96:zzcGpiyjz74zcQ01sL3qGI28/VhNSz/HdHXf6Xh:HcJyQ01sDqGagv6x ImpHash: -	Access, Create, Delete, Read, Write	Dropped File	Unknown
D:\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available
\\.\PHYSICALDRIVE0	-	Access		Not Available
\\.\PHYSICALDRIVE1	-	Access		Not Available
\\.\PHYSICALDRIVE10	-	Access		Not Available
\\.\PHYSICALDRIVE11	-	Access		Not Available
\\.\PHYSICALDRIVE12	-	Access		Not Available
\\.\PHYSICALDRIVE13	-	Access		Not Available
\\.\PHYSICALDRIVE14	-	Access		Not Available
\\.\PHYSICALDRIVE15	-	Access		Not Available
\\.\PHYSICALDRIVE2	-	Access		Not Available
\\.\PHYSICALDRIVE3	-	Access		Not Available
\\.\PHYSICALDRIVE4	-	Access		Not Available
\\.\PHYSICALDRIVE5	-	Access		Not Available
\\.\PHYSICALDRIVE6	-	Access		Not Available
\\.\PHYSICALDRIVE7	-	Access		Not Available
\\.\PHYSICALDRIVE8	-	Access		Not Available
\\.\PHYSICALDRIVE9	-	Access		Not Available
\\?\D:\$RECYCLE.BIN\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available
\\?\D:\$RECYCLE.BIN\S-1-5-21-1051304884-625712362-2192934891-1000\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available
\\?\D:\Recovery\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available
\\?\D:\Recovery\WindowsRE\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available
\\?\D:\Recovery\WindowsRE\ReAgent.xml	-	Access, Delete, Read, Write		Not Available
\\?\D:\Recovery\WindowsRE\ReAgent.xml.ragn@r_B8CF767A	-	Access, Create		Not Available
\\?\D:\Recovery\WindowsRE\Winre.wim	-	Access, Delete, Read, Write		Not Available
\\?\D:\Recovery\WindowsRE\Winre.wim.ragn@r_B8CF767A	-	Access, Create		Not Available
\\?\D:\Recovery\WindowsRE\boot.sdi	-	Access, Delete, Read, Write		Not Available
\\?\D:\Recovery\WindowsRE\boot.sdi.ragn@r_B8CF767A	-	Access, Create		Not Available
\\?\D:\System Volume Information\!$R4GN4R_B8CF767A$!.txt	-	Access, Create		Not Available

Registry (8)

Registry Key Name	Operations
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Log File Max Size	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Wbem\CIMOM\Logging Directory	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProductName	Access, Read

Export to TXT Export to JSON

Function Logfile

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".

Remarks (1/1)

Indicators

Before

After