7282df13...1c55 | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Ransomware
Threat Names:
Gen:Variant.Symmi.31899

pewpew.exe

Windows Exe (x86-32)

Created at 2020-09-15T22:09:00

...

Remarks (1/1)

(0x02000007): The operating system was rebooted during the analysis because the sample modified the master boot record (MBR).

Remarks

(0x0200000C): The maximum memory dump size was exceeded. Some dumps may be missing in the report.

Master Boot Record Changes
»
Sector Number Sector Size Actions
2063 512 Bytes
...


Filters:
Filename Category Type Severity Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\pewpew.exe Sample File Binary
Malicious
...
»
Mime Type application/vnd.microsoft.portable-executable
File Size 1.02 MB
MD5 202bf9be9a4e45526e482f08104717ad Copy to Clipboard
SHA1 1e5bbfb9167150935c6eb25bbbebbe5c77a97aa2 Copy to Clipboard
SHA256 7282df1360af4c028930ffd9fbc30ea9d17f08f14b725f8020677dd9df961c55 Copy to Clipboard
SSDeep 24576:u71XTfGSBd+CBOKBH95XPJS1yQg21Gam:u79TfDBgCB7fJyyQgP Copy to Clipboard
ImpHash 2e5467cba76f44a088d39f78c5e807b6 Copy to Clipboard
PE Information
»
Image Base 0x400000
Entry Point 0x404086
Size Of Code 0x6400
Size Of Initialized Data 0x800
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2020-09-15 19:17:42+00:00
Packer BobSoft Mini Delphi -> BoB / BobSoft
Version Information (11)
»
Assembly Version 1.0.0.0
Comments -
CompanyName -
FileDescription pewpew
FileVersion 1.0.0.0
InternalName pewpew.exe
LegalCopyright Copyright © 2020
LegalTrademarks -
OriginalFilename pewpew.exe
ProductName Abkir
ProductVersion 1.0.0.0
Sections (6)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
- 0x402000 0x8000 0x3400 0x400 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.97
- 0x40a000 0x2000 0x0 0x3800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
- 0x40c000 0x2000 0x200 0x3800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.32
.rsrc 0x40e000 0x2000 0x600 0x3a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 4.04
- 0x410000 0x27e000 0x2ba00 0x4000 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 8.0
.data 0x68e000 0xd6000 0xd5000 0x2fa00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.97
Imports (8)
»
kernel32.dll (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetModuleHandleA 0x0 0x68e0d4 0x28e0d4 0x2fad4 0x0
GetProcAddress 0x0 0x68e0d8 0x28e0d8 0x2fad8 0x0
ExitProcess 0x0 0x68e0dc 0x28e0dc 0x2fadc 0x0
LoadLibraryA 0x0 0x68e0e0 0x28e0e0 0x2fae0 0x0
user32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
MessageBoxA 0x0 0x68e0e8 0x28e0e8 0x2fae8 0x0
advapi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
RegCloseKey 0x0 0x68e0f0 0x28e0f0 0x2faf0 0x0
oleaut32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
SysFreeString 0x0 0x68e0f8 0x28e0f8 0x2faf8 0x0
gdi32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
CreateFontA 0x0 0x68e100 0x28e100 0x2fb00 0x0
shell32.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
ShellExecuteA 0x0 0x68e108 0x28e108 0x2fb08 0x0
version.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
GetFileVersionInfoA 0x0 0x68e110 0x28e110 0x2fb10 0x0
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain 0x0 0x68e118 0x28e118 0x2fb18 0x0
Memory Dumps (33)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point AV YARA Actions
pewpew.exe 1 0x000C0000 0x00423FFF First Execution True 32-bit 0x000C4086 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00232B74 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0023731C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x002349C4 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x000D4354 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x000DED9C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0012414C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00123D54 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00127E64 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00155974 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00167234 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0017D05C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00192F5C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x001B4F8C True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x001BD700 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x000FD7C0 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0024E070 True False
...
buffer 1 0x02280000 0x0237FFFF Content Changed False 32-bit - False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00242BAD True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0025650E True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0024A966 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00257798 True False
...
buffer 1 0x02294000 0x022B7FFF Content Changed False 32-bit - False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x001118B8 True False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x0018B1B8 False False
...
buffer 1 0x022C4000 0x022D3FFF Content Changed False 32-bit - False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x00118CFC False False
...
buffer 1 0x022B4000 0x022C3FFF Content Changed False 32-bit - False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x000DC92C False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x002503CA False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x002446DC False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x002433BB False False
...
pewpew.exe 1 0x000C0000 0x00423FFF Content Changed True 32-bit 0x000C4FD5 False False
...
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml Modified File Text
Whitelisted
...
»
Also Known As C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\IdentityCRL\ppcrlconfig.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\MySite.ico (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeUKR.htm (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\messages.json (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCZE.htm (Modified File)
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico (Modified File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico (Modified File)
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Viktig.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm (Modified File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest (Modified File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.html.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCT.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000003.log (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMePOL.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCT.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.html (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\LeesMij.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\SharePointPortalSite.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Viktig.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm (Modified File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\Viktigt.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\LueMinut.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\GDIPFONTCACHEV1.DAT.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMe.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeK.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeK.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHUN.htm (Modified File)
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG (Modified File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi (Modified File)
C:\ProgramData\Microsoft\IdentityCRL\ppcrlconfig.dll (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.manifest (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUM.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Filters\offfiltx.dll (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm (Modified File)
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMePOL.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Vigtigt.htm (Modified File)
C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll (Modified File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.PNG.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHRV.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\manifest.json (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF (Modified File)
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\eqnedt32.exe.manifest (Modified File)
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUS.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\tokens.dat (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\messages.json (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\manifest.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeUKR.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\GoogleUpdateSetup.exe (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000003.log.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\messages.json (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Vigtigt.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\CGMIMP32.CFG.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.js.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe (Modified File)
C:\ProgramData\Microsoft\OFFICE\DocumentRepository.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.xml (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\IdentityCRL\ppcrlui.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Leggimi.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Llegiu-me.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCS.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Lisezmoi.htm (Modified File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\messages.json (Modified File)
C:\ProgramData\Microsoft\OFFICE\AssetLibrary.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\SharePointTeamSite.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlkLR.cab.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelLR.cab (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Filters\odffilt.dll (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeJ.htm (Modified File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCS.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUM.htm (Modified File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi (Modified File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL (Modified File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.JPG (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EURO\MSOEURO.DLL (Modified File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.msi (Modified File)
C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMe.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\GoogleUpdateSetup.exe.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeJ.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Benioku.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Berime.htm (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\Viktigt.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\OutlookMUI.xml (Modified File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PubLR.cab (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHRV.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico (Modified File)
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\Setup.xml.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeRUS.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\main.js (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeSKY.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\messages.json.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\ProgramData\Microsoft\OFFICE\MySharePoints.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_16.png (Modified File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PptLR.cab.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Help\msitss55.dll (Modified File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.msi (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\ExcelMUI.msi.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.msi.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeCZE.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Help\ITIRCL55.DLL (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\messages.json (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\UserCache.bin.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap.exe.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Liesmich.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\messages.json (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeHUN.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\LeiaMe.htm (Modified File)
C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\clickonce_bootstrap_unsigned.manifest (Modified File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL (Modified File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\MS.GIF (Modified File)
C:\ProgramData\Microsoft\OFFICE\MySite.ico.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\PublisherMUI.xml (Modified File)
C:\Program Files\Common Files\Microsoft Shared\Filters\msgfilt.dll.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\ReadMeSKY.htm (Modified File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\PowerPointMUI.xml (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_16.png.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\AiodLite.dll (Modified File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\icon_128.png.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL (Modified File)
C:\Program Files (x86)\Adobe\Reader 10.0\IrakHau.htm.id-9C354B42.[pewpew@TuTa.io].abkir (Dropped File)
Mime Type text/html
File Size 32 Bytes
MD5 70bc8f4b72a86921468bf8e8441dce51 Copy to Clipboard
SHA1 de8a847bff8c343d69b853a215e6ee775ef2ef96 Copy to Clipboard
SHA256 66687aadf862bd776c8fc18b8e9f8e20089714856ee233b3902a591d0d5f2925 Copy to Clipboard
SSDeep 3:: Copy to Clipboard
ImpHash -
Error Remark Could not parse sample file: No HTML root found
File Reputation Information
»
Severity
Whitelisted
C:\Config.Msi\info-decrypt.txt Dropped File Text
Unknown
...
»
Also Known As C:\MSOCache\info-decrypt.txt (Dropped File)
C:\PerfLogs\info-decrypt.txt (Dropped File)
C:\Boot\info-decrypt.txt (Dropped File)
C:\Windows\info-decrypt.txt (Dropped File)
C:\ProgramData\info-decrypt.txt (Dropped File)
C:\info-decrypt.txt (Dropped File)
C:\Users\info-decrypt.txt (Dropped File)
C:\Program Files\info-decrypt.txt (Dropped File)
C:\Program Files (x86)\info-decrypt.txt (Dropped File)
C:\Recovery\info-decrypt.txt (Dropped File)
C:\$Recycle.Bin\info-decrypt.txt (Dropped File)
Mime Type text/plain
File Size 1.21 KB
MD5 e848f7b3e283e496bbe0d11ca2ee240a Copy to Clipboard
SHA1 e5a34c2d99917b3021910cee2a3de307ed306ca5 Copy to Clipboard
SHA256 7cf2dd9337a940287339cea688a39aef96633a94803e24295eb52eaaf142c177 Copy to Clipboard
SSDeep 24:qFM90XI2pTiT/kQE82HtdnRy/eHz41GpwRGkc3dtmNk9:qqOXz5pXEYz4cpZkc3KNa Copy to Clipboard
ImpHash -
C:\Boot\zh-CN\info-decrypt.hta Dropped File Text
Unknown
...
»
Also Known As C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\Cache\info-decrypt.hta (Dropped File)
C:\Boot\cs-CZ\info-decrypt.hta (Dropped File)
C:\Boot\zh-TW\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ca\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\DESIGNER\info-decrypt.hta (Dropped File)
C:\Boot\de-DE\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\info-decrypt.hta (Dropped File)
C:\Boot\el-GR\info-decrypt.hta (Dropped File)
C:\Boot\ru-RU\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\DW\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\GRPHFLT\info-decrypt.hta (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Filters\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\ink\info-decrypt.hta (Dropped File)
C:\Boot\info-decrypt.hta (Dropped File)
C:\Users\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\info-decrypt.hta (Dropped File)
C:\Boot\pt-BR\info-decrypt.hta (Dropped File)
C:\MSOCache\All Users\{90140000-001B-0409-1000-0000000FF1CE}-C\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\en-US\info-decrypt.hta (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\Esl\info-decrypt.hta (Dropped File)
C:\Boot\da-DK\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Network\Downloader\info-decrypt.hta (Dropped File)
C:\Boot\ko-KR\info-decrypt.hta (Dropped File)
C:\Boot\it-IT\info-decrypt.hta (Dropped File)
C:\MSOCache\All Users\{90140000-0018-0409-1000-0000000FF1CE}-C\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EURO\info-decrypt.hta (Dropped File)
C:\Boot\fr-FR\info-decrypt.hta (Dropped File)
C:\Boot\tr-TR\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\ar\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\el\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\info-decrypt.hta (Dropped File)
C:\Boot\hu-HU\info-decrypt.hta (Dropped File)
C:\Boot\nb-NO\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Adobe\Acrobat\10.0\info-decrypt.hta (Dropped File)
C:\Boot\es-ES\info-decrypt.hta (Dropped File)
C:\Recovery\e9e23962-4a25-11e7-88e8-91fb2ec43f0b\info-decrypt.hta (Dropped File)
C:\Boot\Fonts\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Task\{e35be42d-f742-4d96-a50a-1775fb1a7a42}\info-decrypt.hta (Dropped File)
C:\Program Files (x86)\info-decrypt.hta (Dropped File)
C:\MSOCache\All Users\{90140000-001A-0409-1000-0000000FF1CE}-C\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\en-US\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\OFFICE\info-decrypt.hta (Dropped File)
C:\Boot\nl-NL\info-decrypt.hta (Dropped File)
C:\MSOCache\All Users\{90140000-0016-0409-1000-0000000FF1CE}-C\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\info-decrypt.hta (Dropped File)
C:\Program Files (x86)\Adobe\Reader 10.0\info-decrypt.hta (Dropped File)
C:\Boot\en-US\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\info-decrypt.hta (Dropped File)
C:\Boot\pl-PL\info-decrypt.hta (Dropped File)
C:\MSOCache\All Users\{90140000-0019-0409-1000-0000000FF1CE}-C\info-decrypt.hta (Dropped File)
C:\Program Files\info-decrypt.hta (Dropped File)
C:\Boot\ja-JP\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\info-decrypt.hta (Dropped File)
C:\Boot\zh-HK\info-decrypt.hta (Dropped File)
C:\Boot\fi-FI\info-decrypt.hta (Dropped File)
C:\Boot\sv-SE\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extension State\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\OfficeSoftwareProtectionPlatform\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\manifests\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\de\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Apps\2.0\DQQ19BCJ.JAX\YVORLGOR.PNT\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\cs\info-decrypt.hta (Dropped File)
C:\Program Files\Common Files\Microsoft Shared\Help\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\da\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\IdentityCRL\info-decrypt.hta (Dropped File)
C:\Boot\pt-PT\info-decrypt.hta (Dropped File)
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.9_0\_locales\bg\info-decrypt.hta (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Crashpad\info-decrypt.hta (Dropped File)
Mime Type text/html
File Size 5.34 KB
MD5 1248e6a21ae2ffc5366c49b278cce958 Copy to Clipboard
SHA1 bca85567483168eb20960dc5c946a9e5ab5e4633 Copy to Clipboard
SHA256 9fcff6dd5c7962b490faeab225af26de98ec0f2e3f9cf142ede61597438865b1 Copy to Clipboard
SSDeep 96:mHg7bGs1Q9vQXTTVWKt+1I7Dz64m2OwGyTH/Cit2+44o4cdgNYnX:eg7RQAn7fkEH6644ordgNYX Copy to Clipboard
ImpHash -
Parser Error Remark Static engine was unable to completely parse the analyzed file
Embedded URLs (2)
»
URL First Seen Categories Threat Names Reputation Status WHOIS Data Actions
https://localbitcoins.com/buy_bitcoins - - -
Unknown
Not Queried
...
http://www.coindesk.com/information/how-can-i-buy-bitcoins/ - - -
Unknown
Not Queried
...
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image