1dd788c0...ee50

File (29)

»

Filename	Hash	Operations
C:\temp	-	Access
C:\temp\tempgh.exe	MD5: b4f28747a0a9317123f0ef109c580844 SHA1: 295fee553b1e703722cd1923697284bac3061190 SHA256: 1dd788c038b4d8d2d3302d7a33162322d0896c7d17888e2fa34204b66c9aee50	Access, Write
C:\Users	-	Access
C:\Users\CIiHmnxMn6Ps	-	Access
C:\Users\CIiHmnxMn6Ps\AppData	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Geo.dat	MD5: 578cfdf82faec2371534ddb644d01e8f SHA1: 87f61df7bb172cff6ea6ab62015b529cbfd17351 SHA256: 5962c24909ba9bc4c23fe69431b361a81e56cf1771186d9d8705f912b73b88fe	Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Logs\	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Logs\04-04-2018	MD5: 33be604f8044d5984e8e3e3b694d710a SHA1: 512c5f801e9fbd73aeefd8e7eaa5ad86bfe2df09 SHA256: 3f785f1cc535b0987139623200c7910b2b28f92dfe3309e8e071c091d0ce7313	Access, Read, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Monitoring\	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Monitoring\network.dat	MD5: 7e6fcf7a603fc7483139540b7aae5c4d SHA1: a89d3174f2757e2effafc3333d6e6fbeccfeb7e5 SHA256: 8975b8f79e75bf1e0518e5eee7089a74db3a412899916e42513ddea655d56c09	Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Monitoring\system.dat	MD5: 4bbe01de8b5c05457fe0e2d00b92a4f5 SHA1: 57fadd9d52fafafac33e12cfac0a940ebda920ac SHA256: a1093478b098fcf27c8f1a43c3a33128120bc4d878a7516e7a081138f2907bef	Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Imminent\Path.dat	MD5: dec2ea43741c17cdc573e1b22def8a03 SHA1: 5503298bf3e0482687610416190c400d100d73de SHA256: 9e901ac2a4eda4d90bb3b81407d28bff737d92d0fb16e685940021e6a4cd2fd0	Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\Microsoft\CLR Security Config\v2.0.50727.312\security.config.default	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\temp	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\temp\tempgh.exe	MD5: b4f28747a0a9317123f0ef109c580844 SHA1: 295fee553b1e703722cd1923697284bac3061190 SHA256: 1dd788c038b4d8d2d3302d7a33162322d0896c7d17888e2fa34204b66c9aee50	Access, Write
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vfggggg.config	-	Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vfggggg.exe	MD5: b4f28747a0a9317123f0ef109c580844 SHA1: 295fee553b1e703722cd1923697284bac3061190 SHA256: 1dd788c038b4d8d2d3302d7a33162322d0896c7d17888e2fa34204b66c9aee50	Access, Read
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\vfggggg.exe:Zone.Identifier	-	Access
C:\Users\CIiHmnxMn6Ps\Desktop\gabkrj.jpg.config	-	Access
C:\Users\CIiHmnxMn6Ps\Desktop\gabkrj.jpg.exe	MD5: b4f28747a0a9317123f0ef109c580844 SHA1: 295fee553b1e703722cd1923697284bac3061190 SHA256: 1dd788c038b4d8d2d3302d7a33162322d0896c7d17888e2fa34204b66c9aee50	Access
C:\Users\CIiHmnxMn6Ps\Desktop\gabkrj.jpg.exe:Zone.Identifier	-	Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config	-	Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\enterprisesec.config.default	-	Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\Config\machine.config	-	Access, Read
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config	-	Access
C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config.default	-	Access

Registry (21)

»

Registry Key Name	Operations
HKEY_CURRENT_USER	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\control.exe	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Access, Read, Write
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v2.0.50727	Access, Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings	Access
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.NET CLR Networking\Performance	Access, Read
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\.net clr networking\Performance	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\MediaPermission	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\Internet\WebBrowserPermission	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet	Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\MediaPermission	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\Security\Policy\Extensions\NamedPermissionSets\LocalIntranet\WebBrowserPermission	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Wbem\Scripting	Access, Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion	Access, Read

Mutex (2)

»

Mutex Name	Operations
Global\.net clr networking	Access, Delete
d6255d76-fd1b-49c2-b1bf-bb2df53c6c67	Access

IP (2)

»

IP	Protocols
91.192.100.59	DNS
45.55.57.244	DNS, TCP

Indicators

Before

After