c283c47e...528b | IOCs
Logo
Try VMRay Analyzer
VTI SCORE: 95/100
Dynamic Analysis Report
Classification: Trojan, Dropper, Spyware

c283c47ed7ecb84bdedf5a856374b4a60d48e0d42c0c57d4ff61a16d71f3528b (SHA256)

Mining.exe

Windows Exe (x86-32)

Created at 2019-01-26 02:20:00

...

Notifications (1/1)

Due to a WHOIS service error, no query could be made to get WHOIS data of any contacted domain.

Indicators

File (226)
»
Filename Hash Operations Source
C:\ProgramData\WinSys.exe MD5: dc94ab73eadb420e362697dfdea306a7
SHA1: fdcf1d67eb22b0fac6cb598d0a138c63b79fb0bf
SHA256: ffeeb844993f2fee324a19467d8ed8a36d82084002542674b1f3ee111ca0e643
SSDeep: 3072:SzEWN5IyOrM2MrIfjblaX/g7q0LyejLl77W8rOirJTqX2wA2j8/VE:SxIyTIfj5aW
ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744 		Access Created File
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\360Browser\\Browser\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Amigo\\User\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Chromium\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Chromodo\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\CocCoc\\Browser\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Comodo\\Dragon\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Comodo\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google (x86)\\Chrome\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\Cookies - Access, Read
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\Cookies1 MD5: 238396aae89ede96ac12f6ebe90f36e4
SHA1: 38b7167e1add52c84f9c160694554b4d5891f9d9
SHA256: c23537b8da96bf92eb88380d6b311bc397ddf02328aefd2c64f08af132cf1882
SSDeep: 96:WanSNDXhnQSMqD679/OJm0qZwO8WIjNgIbFrjunl:WRhXyb3fcBvZOl
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\Cookies1-journal - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\Cookies1-wal - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\Login Data - Access, Read
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\LoginData1 MD5: b22b1727c127485e970296265351b582
SHA1: c6f71441e5709ae15583c60ab9f839190b08f59f
SHA256: c6454fe10eaa9e375ee46ed82a2c851f1adae49061234f48c80135bbd17f0f7f
SSDeep: 48:gz+JH3yJUhJCVE9V8FsXhFlNU1V6kxqW:HJH3FC2V8uRFleq
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\LoginData1-journal - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\LoginData1-wal - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\Web Data - Access, Read
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\\Web Data1 MD5: 844cec6a8e7c5513034fc125fc54b803
SHA1: f92eb4fb1df0ceb51b862443ae04f48bac51c9d3
SHA256: 8aee391a40e74ff388cf53f5360e1d38793d4573b9f49e21e607ed3b6428b809
SSDeep: 96:VtyNQIoYnMvqyWx7pnqH+w/fVIrECuKdPraBdUDBBVWqwmKT/WTPepeWbtxYMxCc:rlkMvuzzTP6btttlhS+3
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\Web Data1-journal - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\Google\Chrome\User Data\Default\Web Data1-wal - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Opera Stable\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Profile 1\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Profile 2\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Google\\Chrome\\User Data\\Profile 3\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\K-Melon\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Kometa\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Maxthon3\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Nichrome\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Orbitum\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Sputnik\\Sputnik\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\Temp\SystemDebug.exe MD5: dc94ab73eadb420e362697dfdea306a7
SHA1: fdcf1d67eb22b0fac6cb598d0a138c63b79fb0bf
SHA256: ffeeb844993f2fee324a19467d8ed8a36d82084002542674b1f3ee111ca0e643
SSDeep: 3072:SzEWN5IyOrM2MrIfjblaX/g7q0LyejLl77W8rOirJTqX2wA2j8/VE:SxIyTIfj5aW
ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744 		Access Created File
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Torch\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Uran\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\uy3novuytt14.zip - Access, Read
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Vivaldi\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Local\\Yandex\\YandexBrowser\\User Data\\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\Coins\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\\Desktop\ - Access
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\\google_chrome_default_ccdata.txt MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\\google_chrome_default_cookie.txt MD5: 83af5f4c5f75035b99d0ea54f283743d
SHA1: ff284abdf4d494cb38b98bb29ab7c0eb01a576b2
SHA256: adb6d362bfa54dec0438fd4605f8cc999c4ef5a88d969091032371b3e1c61040
SSDeep: 24:5hgb4FV2EnwDHAXLQQLQQPMw4ORRiv+8bAJpVGkz+b1:SWof2LQQLQQFtRRi8JTGQe
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Local\zgk6mujwue41\\google_chrome_default_logins.txt MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SSDeep: 3::
ImpHash: None 		Access, Read, Write Created File
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\517847183.tmp MD5: 5e137a5cf5138f25f5b3d74e7e694eac
SHA1: 243cac505e430609afd4807534a0ec27792c0796
SHA256: 2ae5e88dc24e02d2e4bb65bdf5be48b5430baa545188af8a6498d14bc3cf4191
SSDeep: 98304:ETVPCviLZiYvlp5pamq//BsIhwOuFL0hyP:IVKviL4Ytpam4ypOG0h
ImpHash: baa93d47220682c04d92f7797d9224ce 		Access Created File
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Anoncoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Armory\\wallets\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\BBQCoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Bitcoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Bitcoin\\wallets\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\DashCore\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\devcoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\digitalcoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\ElectronCash\\wallets\\default_wallet - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum-LTC\\wallets\\default_wallet - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum\\wallets\\default_wallet - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Electrum\\wallets\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\ethereum wallet\\keystore - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Ethereum\\keystore - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\exodus.wallet - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\passphrase.json - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Exodus\\seed.seco - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FileZilla\recentservers.xml - Access
C:\Users\CIiHmnxMn6Ps\AppData\Roaming\FileZilla\sitemanager.xml - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Florincoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Franko\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Freicoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\GoldCoin (GLD)\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Infinitecoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\IOCoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Ixcoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Litecoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Megacoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Mincoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\monero-project\\keystore - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\monero-project\\wallets\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\mSIGNA_Bitcoin\\wallets\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\MultiDoge\\multidoge.wallet - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Namecoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Opera Software\\ - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Primecoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Terracoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\YACoin\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\\AppData\\Roaming\\Zcash\\wallet.dat - Access
C:\Users\CIiHmnxMn6Ps\Desktop - Access
C:\Users\CIiHmnxMn6Ps\Desktop\18jnma3B6wuLf95.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Desktop\2mJtsm60nn2j5QJsI.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\2SdJFUJ3QcigRje1.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\desktop.ini - Access
C:\Users\CIiHmnxMn6Ps\Desktop\DWBGUTID.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\FGITMr.avi - Access
C:\Users\CIiHmnxMn6Ps\Desktop\gCgINgfUhblgdtEy0U.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\gF- u.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\hBtwHSisB60-Xgcl.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\hJ-x23vCcYTp8Kc6U.csv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\htSGnnW4JpPCITcKP2.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\HWDisbS1QNhaWpm.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\J-k6n.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\jgZ4.pdf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\jWzINLZVsoiWer2ST.mp3 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\KBf9mkpw7.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\kvAy_.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\l394 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\l394\ANRt9-FGo-n4CEbi.pps - Access
C:\Users\CIiHmnxMn6Ps\Desktop\l394\IPJ s0JVt.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\l394\Lehz0J.wav - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mc 5AFKDPYEmc3MLPj.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\CxWh-xBX1wCvo72wky.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\gJjRqPmSBkBkWg.mp4 - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\nn8SdT3X3elZEs.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\rd0gXUDUAcACs - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\rd0gXUDUAcACs\4fQnrkTzw96p.xls - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\rd0gXUDUAcACs\_N7lr 3CQR5J7iZRE LH.bmp - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\rd0gXUDUAcACs\u_p4zMGHb0kifah6_u.png - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\rd0gXUDUAcACs\vzjDwRP82awwx8-.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\mFH_98lXfoVAf-9M\YWXL.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Mining.exe MD5: 201ef232bdb38e1012f1484858cfed7b
SHA1: 97652f4c778beca9f23a98ce47cf872483e122fd
SHA256: c283c47ed7ecb84bdedf5a856374b4a60d48e0d42c0c57d4ff61a16d71f3528b
SSDeep: 98304:r2cPK8QvA0g+Yo/aV6t56Y2e9EppIRYPzmm39bGOUOjLfU:iCKD40Co/3EvppIaP/VGOnnfU
ImpHash: None 		Access Sample File
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr\7bp3AQu3i4dy1.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr\8j7q3kHOQ.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr\KJ11.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr\SNlWtxM6kYgAQev78.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\PxEr\T5HEfd16HKMZ.avi - Access
C:\Users\CIiHmnxMn6Ps\Desktop\qKGT5tsYg3Y4-2.ots - Access
C:\Users\CIiHmnxMn6Ps\Desktop\qqlRDHBXtHhZ.doc - Access
C:\Users\CIiHmnxMn6Ps\Desktop\RFPCBqkh_x.mkv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\S4Q3cA0WBPl6X - Access
C:\Users\CIiHmnxMn6Ps\Desktop\S4Q3cA0WBPl6X\KTZ9.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\S4Q3cA0WBPl6X\r pCdnKEWp6D51EeOX 1.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\S4Q3cA0WBPl6X\rd0rKyb.m4a - Access
C:\Users\CIiHmnxMn6Ps\Desktop\S4Q3cA0WBPl6X\XvvcPoLwXH0.flv - Access
C:\Users\CIiHmnxMn6Ps\Desktop\tXvmVTqXXNByY05.pptx - Access
C:\Users\CIiHmnxMn6Ps\Desktop\U80VGJPNM.gif - Access
C:\Users\CIiHmnxMn6Ps\Desktop\WozKdnD.swf - Access
C:\Users\CIiHmnxMn6Ps\Desktop\Ww-dQfUi.jpg - Access
C:\Users\CIiHmnxMn6Ps\Desktop\z_3Kra5cmE57PxsVB5.m4a - Access
Zero_Two.tmp MD5: dc94ab73eadb420e362697dfdea306a7
SHA1: fdcf1d67eb22b0fac6cb598d0a138c63b79fb0bf
SHA256: ffeeb844993f2fee324a19467d8ed8a36d82084002542674b1f3ee111ca0e643
SSDeep: 3072:SzEWN5IyOrM2MrIfjblaX/g7q0LyejLl77W8rOirJTqX2wA2j8/VE:SxIyTIfj5aW
ImpHash: f34d5f2d4577ed6d9ceec516c1f5a744 		Access, Write Created File
C:\Users\CIiHmnxMn6Ps\Desktop\Zero_Two.tmp.config - Access
C:\Users\CIiHmnxMn6Ps\Desktop\zqsB0mfxVN2YzK.mkv - Access
C:\Users\CIiHmnxMn6Ps\Documents\ - Access
C:\Users\CIiHmnxMn6Ps\Documents\0gXXaUFM0-oK8ASWVeB2.odt - Access
C:\Users\CIiHmnxMn6Ps\Documents\474Aa-gWj7KzBTd.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\4FDCScX 2-THZ.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\_ujogiH.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\AOOPjkYG.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\bDORZAiJr.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\ca9SVssXOq.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\cKtMEtjnjEDfMU zbt6j.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Database1.accdb - Access
C:\Users\CIiHmnxMn6Ps\Documents\desktop.ini - Access
C:\Users\CIiHmnxMn6Ps\Documents\Jw m_Mb8OQ9Wq.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Jxv-rzXyEE19FAyQX M9.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\k0tYWAc4dttDx3JlJZkG.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\krFCKYCSAG9moR.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\KwryMsWE5_ey2mlC6PT.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\LqzHI0iYpnfWYJs_8l.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\mopisQ6oP.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Music - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Pictures - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\_private\folder.ico - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\desktop.ini - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Shapes\Favorites.vssx - Access
C:\Users\CIiHmnxMn6Ps\Documents\My Videos - Access, Write
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks - Access
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook - Access
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2 - Access
C:\Users\CIiHmnxMn6Ps\Documents\OneNote Notebooks\My Notebook\Quick Notes.one - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv\-3fAJrCVRX8Z_.pdf - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv\2zz6XD.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv\ff4vv.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv\M88XZ_9wxNc7qto8l9A.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\Oqg3kW8P6jKJo_Usv\YgeNEaLqCMGtQe2U.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files - Access
C:\Users\CIiHmnxMn6Ps\Documents\Outlook Files\lcfkj@kiekc.df.pst - Access
C:\Users\CIiHmnxMn6Ps\Documents\qt3bnoZWo2hd8JC - Access
C:\Users\CIiHmnxMn6Ps\Documents\qt3bnoZWo2hd8JC\eSl6PLPg.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\qt3bnoZWo2hd8JC\J0tU_uAif-0.csv - Access
C:\Users\CIiHmnxMn6Ps\Documents\qt3bnoZWo2hd8JC\YaSOjCr.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\qt3bnoZWo2hd8JC\zWJfCn63h.ots - Access
C:\Users\CIiHmnxMn6Ps\Documents\s0_cMgCwVuXzkTaEQg.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\swHXblMQ.xlsx - Access
C:\Users\CIiHmnxMn6Ps\Documents\T1aUiNcB6vFXJ--CGqod - Access
C:\Users\CIiHmnxMn6Ps\Documents\T1aUiNcB6vFXJ--CGqod\7Y2KU.odt - Access
C:\Users\CIiHmnxMn6Ps\Documents\T1aUiNcB6vFXJ--CGqod\Fu4M.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\26GucFoE - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\26GucFoE\fVI5YTPfuh.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\26GucFoE\pAJfw48xGeJZG-0b.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\26GucFoE\Sw_iOiUInGypOnydn.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\26GucFoE\vZDFl6zVO0pP.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\bdDE.odt - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\cXcMGyPbl.ppt - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\j1cn9NvnJH9.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\JxlVX0MRaEd hFblBqQd.xls - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\LZS2R4KdG.odp - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\M5TeHLkrBV3p - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\M5TeHLkrBV3p\oTa7wOUOPb3nj3.pptx - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\M5TeHLkrBV3p\PCTUmYJVI.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\M5TeHLkrBV3p\RaI9fNRmP vymY.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\MM8.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\NYCSLit_gX_h1xe.odp - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\sNxcAApPrgIsmmQkx.xls - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\wgc9Z7T.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\tCIBbqQlETcBgm4LZJco\yVa67kWGu4a5d29.pps - Access
C:\Users\CIiHmnxMn6Ps\Documents\VH h8C1yZasfM.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\Vl6bQQ.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2 - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0 - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0\0xI5fMN1PN - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0\0xI5fMN1PN\MZ-9QigFKDnFEHDX5Rf.xls - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0\Gzsosc - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0\Gzsosc\AN-9MFF84r4wx4rFhO4.odt - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\3jjrzMl0 vUKj2POJT0\sNwfmXP-WKMx-mH.rtf - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\dZBwx8S4Mnz.docx - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\G9cdn4hkzfdlc2XWfx7.ods - Access
C:\Users\CIiHmnxMn6Ps\Documents\vzsx2\s1gZwO.odp - Access
C:\Users\CIiHmnxMn6Ps\Documents\WFkwOdvoA7Vk.doc - Access
C:\Users\CIiHmnxMn6Ps\Documents\X9PEQy53-SCiln9P3.xlsx - Access
C:\Users\CIIHMN~1\AppData\Local\Temp\autED97.tmp MD5: 5e137a5cf5138f25f5b3d74e7e694eac
SHA1: 243cac505e430609afd4807534a0ec27792c0796
SHA256: 2ae5e88dc24e02d2e4bb65bdf5be48b5430baa545188af8a6498d14bc3cf4191
SSDeep: 98304:ETVPCviLZiYvlp5pamq//BsIhwOuFL0hyP:IVKviL4Ytpam4ypOG0h
ImpHash: baa93d47220682c04d92f7797d9224ce 		Access, Write Created File
C:\Users\CIIHMN~1\AppData\Local\Temp\autF2F7.tmp MD5: eb5b9cf9564f4d506c3a59fbb5efdf10
SHA1: eca33a3e475db1e9f62b99503fa2e7bf8ffbbe8a
SHA256: 321c4580be28e5c71a40f0c9e3e005410fa6cdff335a53b16ef13470b3ea8278
SSDeep: 768:qy/MVdhrNfHPgdTjXm2X0Bwn6yfCHBW+wQ0zS7JuwvYywBT+ugKPNlMwJM/KYVHK:2bbP6j22X0SnfChJw1q+B6ugS2KYI
ImpHash: None 		Access, Read, Write Created File
C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config - Access, Read
Registry (55)
»
Registry Key Name Operations
HKEY_CURRENT_USER Access
HKEY_CURRENT_USER\Control Panel\Mouse Access
HKEY_CURRENT_USER\Control Panel\Mouse\SwapMouseButtons Read
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_CURRENT_USER\SOFTWARE\\Valve\\Steam Access
HKEY_CURRENT_USER\SOFTWARE\\Valve\\Steam\steampath Read
HKEY_CURRENT_USER\Software\AutoIt v3\AutoIt Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor Access
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\AutoRun Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_CURRENT_USER\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\System Access
HKEY_CURRENT_USER\Software\Wine Access
HKEY_CURRENT_USER\Software\\Classes\\tdesktop.tg\\shell\\open\\command Access, Read
HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Access
HKEY_LOCAL_MACHINE\Hardware\description\System Access
HKEY_LOCAL_MACHINE\Hardware\description\System\SystemBiosVersion Read
HKEY_LOCAL_MACHINE\Hardware\description\System\VideoBiosVersion Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\AppContext Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\LegacyWPADSupport Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319 Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\HWRPortReuseOnSocketBind Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319\SchUseStrongCrypto Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST Access
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2007 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\2008 Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\FirstEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\Dynamic DST\LastEntry Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Display Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Dlt Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\MUI_Std Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\AUS Eastern Standard Time\TZI Read
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Access
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000 Access
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000\DriverDesc Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework Access
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgJITDebugLaunchSetting Read
HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework\DbgManagedDebugger Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\AutoRun Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\CompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DefaultColor Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DelayedExpansion Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\DisableUNCCheck Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\EnableExtensions Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Command Processor\PathCompletionChar Read
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion Access
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\InstallationType Read
Mutex (1)
»
Mutex Name Operations
f6a845a7-3909-486d-8d82-29892b2a38d4 Access
Domain (2)
»
Domain Sources
u2884418ra.ha002.t.justns.ru Function Log
iplogger.org Function Log
IP (2)
»
IP Protocols Sources
185.22.155.227 TCP Function Log
88.99.66.31 TCP Function Log
Export IOCs
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image