analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
URL:

https://crackedpc.org/ammyy-admin-crack-free-download/

Full analysis: https://app.any.run/tasks/38719fcd-39cf-415c-9fbd-732bd62af348
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 25, 2021, 12:07:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
evasion
rat
redline
stealer
vidar
opendir
Indicators:
MD5:

EC592A2E154D44F18C4135E7315ACBF4

SHA1:

12F5F7E70FECD985CD50D0DDE5852F378FCA40E5

SHA256:

5E0BB31C5994B0BB8EB4E4F38EA22EA5394691F2FA8E6E52650223ECDDF54BEC

SSDEEP:

3:N8KhkzfN7OoAzFmn:2K6T5OdM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_x86_x64_install.exe (PID: 1388)
      • setup_x86_x64_install.exe (PID: 3452)
      • setup_installer.exe (PID: 3892)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • setup_install.exe (PID: 3952)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat0914a238bae2.exe (PID: 3320)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 4388790.scr (PID: 3304)
      • 3307180.scr (PID: 1968)
      • WinHoster.exe (PID: 3456)
      • LzmwAqmV.exe (PID: 2496)
      • ultramediaburner.exe (PID: 2816)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 5027594.scr (PID: 8164)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • UltraMediaBurner.exe (PID: 1744)
      • Install.exe (PID: 10004)
      • install.exe (PID: 9700)
      • gcleaner.exe (PID: 6696)
      • installer.exe (PID: 5168)
      • installer.exe (PID: 8736)
      • autosubplayer.exe (PID: 4020)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • Install.exe (PID: 10760)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • TUldbHb.exe (PID: 12036)
      • 33231236756.exe (PID: 292)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • Install.exe (PID: 5500)
      • Install.exe (PID: 6260)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)
      • 3568351.scr (PID: 13252)
      • 1970878.scr (PID: 2940)
      • 2694936.scr (PID: 12996)
      • 5268981.scr (PID: 5448)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • hpzakXf.exe (PID: 8484)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • Install.exe (PID: 6588)
      • Install.exe (PID: 11356)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • GEGcYbm.exe (PID: 5420)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)

    • Executes PowerShell scripts

      • cmd.exe (PID: 284)
      • cmd.exe (PID: 8996)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3952)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Changes settings of System certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Connects to CnC server

      • setup_install.exe (PID: 3952)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • md8_8eus.exe (PID: 9548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)
      • 5268981.scr (PID: 5448)

    • Actions looks like stealing of personal data

      • 4388790.scr (PID: 3304)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • md8_8eus.exe (PID: 9548)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • 33231236756.exe (PID: 292)
      • 45874656108.exe (PID: 8912)
      • 2694936.scr (PID: 12996)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • hpzakXf.exe (PID: 8484)
      • tmp84F7_tmp.exe (PID: 8824)

    • Changes the autorun value in the registry

      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • verism.exe (PID: 10956)

    • Stealing of credential data

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Disables Windows Defender

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Steals credentials from Web Browsers

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • md8_8eus.exe (PID: 9548)
      • hpzakXf.exe (PID: 8484)

    • REDLINE was detected

      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 33231236756.exe (PID: 292)
      • monns.exe (PID: 6208)
      • 1.exe (PID: 9584)
      • 5268981.scr (PID: 5448)
      • tmp84F7_tmp.exe (PID: 8824)

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 8128)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • schtasks.exe (PID: 13916)
      • installer.exe (PID: 5168)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 11220)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6560)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 11288)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 3092)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 5136)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)

    • VIDAR was detected

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Uses Task Scheduler to run other applications

      • Install.exe (PID: 10760)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • TUldbHb.exe (PID: 12036)
      • cmd.exe (PID: 10376)
      • Install.exe (PID: 6260)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • Install.exe (PID: 11356)
      • cmd.exe (PID: 5368)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 13608)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 7388)

    • Uses Task Scheduler to autorun other applications

      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • hpzakXf.exe (PID: 8484)

    • Runs app for hidden code execution

      • cmd.exe (PID: 11636)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 3912)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 14120)
      • reg.exe (PID: 13984)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 7560)

    • Modifies files in Chrome extension folder

      • hpzakXf.exe (PID: 8484)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 3732)
      • setup_installer.exe (PID: 3892)
      • setup_x86_x64_install.exe (PID: 1388)
      • cmd.exe (PID: 284)
      • setup_install.exe (PID: 3952)
      • cmd.exe (PID: 2516)
      • powershell.exe (PID: 2864)
      • cmd.exe (PID: 3732)
      • Sat095b4859b0823e.exe (PID: 2440)
      • cmd.exe (PID: 3080)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 2668)
      • cmd.exe (PID: 3624)
      • cmd.exe (PID: 400)
      • Sat0914a238bae2.exe (PID: 3320)
      • cmd.exe (PID: 4036)
      • WinRAR.exe (PID: 2476)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • cmd.exe (PID: 2040)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • cmd.exe (PID: 3852)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • EtalevzaJet.exe (PID: 2624)
      • LzmwAqmV.exe (PID: 2496)
      • 4388790.scr (PID: 3304)
      • 3307180.scr (PID: 1968)
      • WinHoster.exe (PID: 3456)
      • 6658114.scr (PID: 4088)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • UltraMediaBurner.exe (PID: 1744)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • installer.exe (PID: 5168)
      • cmd.exe (PID: 4812)
      • cmd.exe (PID: 10920)
      • cmd.exe (PID: 9460)
      • Install.exe (PID: 10004)
      • install.exe (PID: 9700)
      • Install.exe (PID: 10760)
      • cmd.exe (PID: 2068)
      • cmd.exe (PID: 11944)
      • powershell.exe (PID: 11656)
      • WMIC.exe (PID: 5916)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • WMIC.exe (PID: 2320)
      • cmd.exe (PID: 3680)
      • powershell.exe (PID: 4616)
      • WMIC.exe (PID: 7412)
      • gcleaner.exe (PID: 6696)
      • cmd.exe (PID: 924)
      • cmd.exe (PID: 6644)
      • autosubplayer.exe (PID: 4020)
      • cmd.exe (PID: 9480)
      • installer.exe (PID: 8736)
      • powershell.EXE (PID: 5584)
      • ns72FD.tmp (PID: 9180)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • powershell.exe (PID: 9928)
      • ns79F4.tmp (PID: 11568)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • 7569659.scr (PID: 6400)
      • 6985381.scr (PID: 3704)
      • cmd.exe (PID: 8996)
      • nsA22B.tmp (PID: 9820)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 249old.exe (PID: 9492)
      • 210921.exe (PID: 10700)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • powershell.exe (PID: 9896)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • cmd.exe (PID: 8380)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • md8_8eus.exe (PID: 9548)
      • inst001.exe (PID: 8956)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • RegSvcs.exe (PID: 4352)
      • TUldbHb.exe (PID: 12036)
      • cmd.exe (PID: 11668)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • cmd.exe (PID: 13168)
      • powershell.exe (PID: 5312)
      • 2694936.scr (PID: 12996)
      • 1970878.scr (PID: 2940)
      • WMIC.exe (PID: 13592)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • WMIC.exe (PID: 4392)
      • 33231236756.exe (PID: 292)
      • powershell.exe (PID: 1292)
      • powershell.exe (PID: 5076)
      • Install.exe (PID: 5500)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • Install.exe (PID: 6260)
      • powershell.exe (PID: 7356)
      • WMIC.exe (PID: 13968)
      • cmd.exe (PID: 6716)
      • 45874656108.exe (PID: 8912)
      • cmd.exe (PID: 8816)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 11684)
      • WMIC.exe (PID: 12852)
      • 5268981.scr (PID: 5448)
      • cmd.exe (PID: 12700)
      • 60248097993.exe (PID: 6284)
      • powershell.exe (PID: 6364)
      • 3568351.scr (PID: 13252)
      • cmd.exe (PID: 13660)
      • WMIC.exe (PID: 1892)
      • powershell.EXE (PID: 4280)
      • clipper)).exe (PID: 8224)
      • 1.exe (PID: 9584)
      • cmd.exe (PID: 10376)
      • monns.exe (PID: 6208)
      • powershell.EXE (PID: 7740)
      • File.exe (PID: 6948)
      • verism.exe (PID: 10956)
      • cmd.exe (PID: 10056)
      • cmd.exe (PID: 11636)
      • cmd.exe (PID: 11428)
      • Puo.exe.com (PID: 11440)
      • Puo.exe.com (PID: 11260)
      • powershell.exe (PID: 6768)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 13516)
      • cmd.exe (PID: 13244)
      • wscript.exe (PID: 13616)
      • hpzakXf.exe (PID: 8484)
      • cmd.exe (PID: 8492)
      • powershell.exe (PID: 2340)
      • WMIC.exe (PID: 8664)
      • powershell.exe (PID: 5324)
      • powershell.exe (PID: 9588)
      • WMIC.exe (PID: 9344)
      • powershell.exe (PID: 5476)
      • WMIC.exe (PID: 11416)
      • WMIC.exe (PID: 5996)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 6156)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • mshta.exe (PID: 12792)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • cmd.exe (PID: 11464)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • cmd.exe (PID: 4440)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • mshta.exe (PID: 6444)
      • tmp84F7_tmp.exe (PID: 6184)
      • cmd.exe (PID: 7064)
      • Install.exe (PID: 6588)
      • Install.exe (PID: 11356)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • WMIC.exe (PID: 4968)
      • powershell.exe (PID: 7512)
      • tmp84F7_tmp.exe (PID: 8824)
      • WMIC.exe (PID: 3984)
      • powershell.exe (PID: 7624)
      • WMIC.exe (PID: 7744)
      • GEGcYbm.exe (PID: 5420)
      • cmd.exe (PID: 4752)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • WMIC.exe (PID: 8900)
      • WMIC.exe (PID: 7180)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 10352)
      • powershell.exe (PID: 12372)
      • WMIC.exe (PID: 13680)
      • service.exe (PID: 14120)
      • cmd.exe (PID: 5368)
      • cmd.exe (PID: 11160)
      • cmd.exe (PID: 7496)

    • Reads the computer name

      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • powershell.exe (PID: 2864)
      • WinRAR.exe (PID: 2476)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • setup_install.exe (PID: 3952)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • 4388790.scr (PID: 3304)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • WinHoster.exe (PID: 3456)
      • EtalevzaJet.exe (PID: 2624)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat0914a238bae2.exe (PID: 3320)
      • 6658114.scr (PID: 4088)
      • UltraMediaBurner.exe (PID: 1744)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • ultramediaburner.tmp (PID: 1704)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • installer.exe (PID: 5168)
      • Install.exe (PID: 10760)
      • powershell.exe (PID: 11656)
      • WMIC.exe (PID: 5916)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 2320)
      • powershell.exe (PID: 4616)
      • WMIC.exe (PID: 7412)
      • gcleaner.exe (PID: 6696)
      • autosubplayer.exe (PID: 4020)
      • powershell.EXE (PID: 5584)
      • installer.exe (PID: 8736)
      • powershell.exe (PID: 9928)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 7569659.scr (PID: 6400)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 6985381.scr (PID: 3704)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • 249old.exe (PID: 9492)
      • powershell.exe (PID: 9896)
      • 210921.exe (PID: 10700)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • md8_8eus.exe (PID: 9548)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • TUldbHb.exe (PID: 12036)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • powershell.exe (PID: 5312)
      • 1970878.scr (PID: 2940)
      • WMIC.exe (PID: 13592)
      • 2694936.scr (PID: 12996)
      • powershell.exe (PID: 1292)
      • 33231236756.exe (PID: 292)
      • WMIC.exe (PID: 4392)
      • powershell.exe (PID: 5076)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • Install.exe (PID: 6260)
      • WMIC.exe (PID: 13968)
      • powershell.exe (PID: 7356)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 11684)
      • WMIC.exe (PID: 12852)
      • powershell.exe (PID: 6364)
      • 5268981.scr (PID: 5448)
      • 3568351.scr (PID: 13252)
      • 45874656108.exe (PID: 8912)
      • WMIC.exe (PID: 1892)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • RegSvcs.exe (PID: 4352)
      • clipper)).exe (PID: 8224)
      • 1.exe (PID: 9584)
      • powershell.EXE (PID: 7740)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • Puo.exe.com (PID: 11440)
      • powershell.exe (PID: 6768)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • wscript.exe (PID: 13616)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 5324)
      • WMIC.exe (PID: 8664)
      • WMIC.exe (PID: 5996)
      • powershell.exe (PID: 9588)
      • WMIC.exe (PID: 9344)
      • WMIC.exe (PID: 11416)
      • powershell.exe (PID: 2340)
      • powershell.exe (PID: 5476)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • mshta.exe (PID: 12792)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • mshta.exe (PID: 6444)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • tmp84F7_tmp.exe (PID: 6184)
      • Install.exe (PID: 11356)
      • powershell.exe (PID: 7512)
      • WMIC.exe (PID: 4968)
      • powershell.exe (PID: 10244)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 12540)
      • tmp84F7_tmp.exe (PID: 8824)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • powershell.exe (PID: 7624)
      • WMIC.exe (PID: 3984)
      • WMIC.exe (PID: 7744)
      • GEGcYbm.exe (PID: 5420)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • WMIC.exe (PID: 8900)
      • powershell.exe (PID: 2876)
      • WMIC.exe (PID: 7180)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 10352)
      • WMIC.exe (PID: 13680)
      • powershell.exe (PID: 12372)
      • service.exe (PID: 14120)

    • Application launched itself

      • WinRAR.exe (PID: 2132)
      • msiexec.exe (PID: 8296)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • cmd.exe (PID: 11636)
      • Puo.exe.com (PID: 11260)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • tmp84F7_tmp.exe (PID: 6184)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Install.exe (PID: 10760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 3892)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • EtalevzaJet.exe (PID: 2624)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3952)
      • Lapenyvove.exe (PID: 2224)
      • Sat09964f7c03.exe (PID: 2604)
      • Install.exe (PID: 10760)
      • forfiles.exe (PID: 11360)
      • forfiles.exe (PID: 5432)
      • forfiles.exe (PID: 13708)
      • forfiles.exe (PID: 4068)
      • forfiles.exe (PID: 10584)
      • forfiles.exe (PID: 10884)
      • nsA22B.tmp (PID: 9820)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • TUldbHb.exe (PID: 12036)
      • forfiles.exe (PID: 12232)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • forfiles.exe (PID: 14072)
      • forfiles.exe (PID: 6880)
      • forfiles.exe (PID: 4760)
      • Install.exe (PID: 6260)
      • forfiles.exe (PID: 6940)
      • forfiles.exe (PID: 10224)
      • forfiles.exe (PID: 11180)
      • forfiles.exe (PID: 12584)
      • forfiles.exe (PID: 6176)
      • forfiles.exe (PID: 5896)
      • clipper)).exe (PID: 8224)
      • 45874656108.exe (PID: 8912)
      • verism.exe (PID: 10956)
      • cmd.exe (PID: 11636)
      • hpzakXf.exe (PID: 8484)
      • forfiles.exe (PID: 7768)
      • forfiles.exe (PID: 8792)
      • forfiles.exe (PID: 10800)
      • forfiles.exe (PID: 11364)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)
      • Install.exe (PID: 11356)
      • forfiles.exe (PID: 10148)
      • forfiles.exe (PID: 3028)
      • forfiles.exe (PID: 6324)
      • forfiles.exe (PID: 12836)
      • forfiles.exe (PID: 4268)
      • forfiles.exe (PID: 4296)
      • GEGcYbm.exe (PID: 5420)
      • forfiles.exe (PID: 9532)
      • forfiles.exe (PID: 10116)
      • forfiles.exe (PID: 12056)
      • forfiles.exe (PID: 12856)
      • service.exe (PID: 14120)

    • Reads the date of Windows installation

      • powershell.exe (PID: 2864)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 4616)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 5312)
      • powershell.exe (PID: 1292)
      • powershell.exe (PID: 5076)
      • powershell.exe (PID: 4332)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 5324)
      • powershell.exe (PID: 9588)
      • powershell.exe (PID: 2340)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5856)
      • powershell.exe (PID: 12372)

    • Reads Environment values

      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat098ac2475eba09.exe (PID: 1948)
      • EtalevzaJet.exe (PID: 2624)
      • 4388790.scr (PID: 3304)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • installer.exe (PID: 5168)
      • 5027594.scr (PID: 8164)
      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
      • 7199766.scr (PID: 5300)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 7569659.scr (PID: 6400)
      • powershell.exe (PID: 9896)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 1970878.scr (PID: 2940)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 45874656108.exe (PID: 8912)
      • 33231236756.exe (PID: 292)
      • 3568351.scr (PID: 13252)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • tmp84F7_tmp.exe (PID: 8824)

    • Reads Windows owner or organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • msiexec.exe (PID: 8296)
      • installer.exe (PID: 5168)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)

    • Reads the Windows organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)

    • Creates files in the user directory

      • powershell.exe (PID: 2864)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • installer.exe (PID: 5168)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 4616)
      • autosubplayer.exe (PID: 4020)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5856)
      • powershell.exe (PID: 12372)

    • Adds / modifies Windows certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Starts application with an unusual extension

      • Sat098ac2475eba09.exe (PID: 1948)
      • autosubplayer.exe (PID: 4020)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • cmd.exe (PID: 11428)
      • Puo.exe.com (PID: 11260)

    • Starts itself from another location

      • 3307180.scr (PID: 1968)
      • install.exe (PID: 9700)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)

    • Searches for installed software

      • 4388790.scr (PID: 3304)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 1.exe (PID: 9584)
      • 2694936.scr (PID: 12996)
      • 5268981.scr (PID: 5448)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Reads the cookies of Mozilla Firefox

      • 4388790.scr (PID: 3304)
      • md8_8eus.exe (PID: 9548)

    • Checks for external IP

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Creates a directory in Program Files

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)
      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Starts Internet Explorer

      • SHubekuxosi.exe (PID: 2508)

    • Creates files in the program directory

      • Sat09964f7c03.exe (PID: 2604)
      • msiexec.exe (PID: 8296)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • autosubplayer.exe (PID: 4020)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • md8_8eus.exe (PID: 9548)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2832)
      • powershell.exe (PID: 9896)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Reads CPU info

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)

    • Executed as Windows Service

      • msiexec.exe (PID: 8296)

    • Starts Microsoft Installer

      • installer.exe (PID: 5168)

    • Starts CMD.EXE for self-deleting

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 10920)
      • MsiExec.exe (PID: 11540)
      • cmd.exe (PID: 8380)
      • cmd.exe (PID: 13660)
      • cmd.exe (PID: 11464)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • hpzakXf.exe (PID: 8484)

    • Executes PowerShell scripts

      • cmd.exe (PID: 11588)
      • cmd.exe (PID: 12144)
      • cmd.exe (PID: 13832)
      • cmd.exe (PID: 4208)
      • ns72FD.tmp (PID: 9180)
      • cmd.exe (PID: 6580)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7084)
      • cmd.exe (PID: 9892)
      • cmd.exe (PID: 11468)
      • cmd.exe (PID: 3336)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 8592)
      • cmd.exe (PID: 10916)
      • cmd.exe (PID: 11872)
      • cmd.exe (PID: 10368)
      • cmd.exe (PID: 9128)
      • cmd.exe (PID: 2440)
      • cmd.exe (PID: 14052)
      • cmd.exe (PID: 11988)
      • cmd.exe (PID: 6904)
      • cmd.exe (PID: 12712)
      • cmd.exe (PID: 3744)

    • Executes application which crashes

      • cmd.exe (PID: 11944)
      • cmd.exe (PID: 3680)
      • 60248097993.exe (PID: 6284)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 11068)
      • cmd.exe (PID: 11504)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 7064)
      • cmd.exe (PID: 13516)
      • cmd.exe (PID: 8668)
      • wscript.exe (PID: 13616)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 11160)
      • cmd.exe (PID: 7496)

    • PowerShell script executed

      • powershell.EXE (PID: 5584)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.EXE (PID: 8864)

    • Executed via Task Scheduler

      • powershell.EXE (PID: 5584)
      • TUldbHb.exe (PID: 12036)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • GEGcYbm.exe (PID: 5420)
      • powershell.EXE (PID: 8864)
      • service.exe (PID: 14120)
      • chrome.exe (PID: 3492)

    • Creates files in the Windows directory

      • schtasks.exe (PID: 13608)
      • cmd.exe (PID: 13244)
      • TUldbHb.exe (PID: 12036)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6504)
      • hpzakXf.exe (PID: 8484)
      • schtasks.exe (PID: 9992)

    • Reads the cookies of Google Chrome

      • md8_8eus.exe (PID: 9548)

    • Reads mouse settings

      • Puo.exe.com (PID: 11260)
      • Puo.exe.com (PID: 11440)

    • Executes scripts

      • TUldbHb.exe (PID: 12036)

    • Removes files from Windows directory

      • TUldbHb.exe (PID: 12036)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Uses RUNDLL32.EXE to load library

      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3492)

  • INFO

    • Reads the computer name

      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 2828)
      • msiexec.exe (PID: 9308)
      • taskkill.exe (PID: 11180)
      • MsiExec.exe (PID: 11540)
      • taskkill.exe (PID: 12312)
      • MsiExec.exe (PID: 8128)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • gpupdate.exe (PID: 7080)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 13608)
      • taskkill.exe (PID: 2240)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • schtasks.exe (PID: 2996)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 4420)
      • gpupdate.exe (PID: 9476)
      • schtasks.exe (PID: 11220)
      • schtasks.exe (PID: 14092)
      • gpupdate.exe (PID: 2996)
      • schtasks.exe (PID: 13976)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6560)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 11468)
      • chrome.exe (PID: 4672)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • schtasks.exe (PID: 5828)
      • chrome.exe (PID: 1040)
      • chrome.exe (PID: 1120)
      • schtasks.exe (PID: 11288)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 2492)
      • taskkill.exe (PID: 8120)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 9992)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 3092)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • gpupdate.exe (PID: 9340)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 8088)
      • chrome.exe (PID: 3492)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 5136)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 2672)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)
      • schtasks.exe (PID: 7132)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2068)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • 4388790.scr (PID: 3304)
      • EtalevzaJet.exe (PID: 2624)
      • Sat09964f7c03.exe (PID: 2604)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • iexplore.exe (PID: 2832)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • installer.exe (PID: 5168)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 8296)
      • 5027594.scr (PID: 8164)
      • MsiExec.exe (PID: 11540)
      • 7199766.scr (PID: 5300)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • powershell.exe (PID: 9896)
      • 7569659.scr (PID: 6400)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 210921.exe (PID: 10700)
      • md8_8eus.exe (PID: 9548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • 1970878.scr (PID: 2940)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 33231236756.exe (PID: 292)
      • 60248097993.exe (PID: 6284)
      • 3568351.scr (PID: 13252)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • chrome.exe (PID: 4672)
      • hpzakXf.exe (PID: 8484)
      • chrome.exe (PID: 8768)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • tmp84F7_tmp.exe (PID: 8824)
      • chrome.exe (PID: 12660)

    • Checks supported languages

      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 2392)
      • chrome.exe (PID: 3040)
      • chrome.exe (PID: 2496)
      • chrome.exe (PID: 2768)
      • chrome.exe (PID: 3624)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 3188)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 828)
      • chrome.exe (PID: 1596)
      • chrome.exe (PID: 3112)
      • chrome.exe (PID: 2544)
      • chrome.exe (PID: 2952)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 3152)
      • NOTEPAD.EXE (PID: 3908)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 2828)
      • msiexec.exe (PID: 9308)
      • taskkill.exe (PID: 11180)
      • taskkill.exe (PID: 12312)
      • timeout.exe (PID: 11808)
      • MsiExec.exe (PID: 11540)
      • MsiExec.exe (PID: 8128)
      • forfiles.exe (PID: 11360)
      • cmd.exe (PID: 11588)
      • ntvdm.exe (PID: 12348)
      • forfiles.exe (PID: 5432)
      • cmd.exe (PID: 12144)
      • forfiles.exe (PID: 13708)
      • cmd.exe (PID: 13832)
      • ntvdm.exe (PID: 2304)
      • cmd.exe (PID: 4208)
      • forfiles.exe (PID: 4068)
      • forfiles.exe (PID: 10584)
      • cmd.exe (PID: 11504)
      • reg.exe (PID: 11660)
      • cmd.exe (PID: 11068)
      • reg.exe (PID: 11264)
      • schtasks.exe (PID: 5020)
      • schtasks.exe (PID: 4324)
      • gpupdate.exe (PID: 7080)
      • forfiles.exe (PID: 10884)
      • schtasks.exe (PID: 13608)
      • schtasks.exe (PID: 13916)
      • timeout.exe (PID: 7600)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • taskkill.exe (PID: 2240)
      • forfiles.exe (PID: 12232)
      • cmd.exe (PID: 6580)
      • forfiles.exe (PID: 14072)
      • cmd.exe (PID: 7912)
      • forfiles.exe (PID: 6880)
      • cmd.exe (PID: 5564)
      • forfiles.exe (PID: 4760)
      • cmd.exe (PID: 7660)
      • forfiles.exe (PID: 6940)
      • cmd.exe (PID: 7084)
      • forfiles.exe (PID: 10224)
      • cmd.exe (PID: 9892)
      • forfiles.exe (PID: 11180)
      • cmd.exe (PID: 11468)
      • forfiles.exe (PID: 12584)
      • cmd.exe (PID: 3336)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 4420)
      • forfiles.exe (PID: 5896)
      • cmd.exe (PID: 6464)
      • forfiles.exe (PID: 6176)
      • cmd.exe (PID: 7064)
      • gpupdate.exe (PID: 9476)
      • reg.exe (PID: 7056)
      • reg.exe (PID: 5948)
      • schtasks.exe (PID: 11220)
      • ntvdm.exe (PID: 5632)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • gpupdate.exe (PID: 2996)
      • timeout.exe (PID: 10320)
      • dllhost.exe (PID: 11264)
      • findstr.exe (PID: 11432)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • reg.exe (PID: 3912)
      • reg.exe (PID: 13872)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 13984)
      • reg.exe (PID: 7560)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 14120)
      • reg.exe (PID: 6884)
      • reg.exe (PID: 960)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 3640)
      • reg.exe (PID: 8292)
      • reg.exe (PID: 2936)
      • reg.exe (PID: 8072)
      • reg.exe (PID: 2452)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6560)
      • cmd.exe (PID: 11872)
      • cmd.exe (PID: 8592)
      • forfiles.exe (PID: 8792)
      • cmd.exe (PID: 10916)
      • forfiles.exe (PID: 11364)
      • chrome.exe (PID: 11468)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 12504)
      • cmd.exe (PID: 600)
      • forfiles.exe (PID: 7768)
      • chrome.exe (PID: 9736)
      • forfiles.exe (PID: 10800)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 5176)
      • chrome.exe (PID: 10780)
      • chrome.exe (PID: 12816)
      • chrome.exe (PID: 13728)
      • chrome.exe (PID: 4692)
      • chrome.exe (PID: 1040)
      • schtasks.exe (PID: 11288)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 5828)
      • reg.exe (PID: 2428)
      • reg.exe (PID: 6576)
      • schtasks.exe (PID: 6504)
      • chrome.exe (PID: 9504)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 4628)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 11120)
      • chrome.exe (PID: 10992)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 10848)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 1144)
      • chrome.exe (PID: 4688)
      • taskkill.exe (PID: 8120)
      • chrome.exe (PID: 4340)
      • chrome.exe (PID: 7772)
      • rundll32.exe (PID: 12176)
      • cmd.exe (PID: 10368)
      • forfiles.exe (PID: 10148)
      • forfiles.exe (PID: 3028)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • forfiles.exe (PID: 6324)
      • cmd.exe (PID: 2440)
      • cmd.exe (PID: 9128)
      • schtasks.exe (PID: 12488)
      • cmd.exe (PID: 14052)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • forfiles.exe (PID: 12836)
      • forfiles.exe (PID: 4268)
      • schtasks.exe (PID: 7724)
      • forfiles.exe (PID: 4296)
      • cmd.exe (PID: 3520)
      • reg.exe (PID: 4600)
      • cmd.exe (PID: 7728)
      • reg.exe (PID: 8212)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 3092)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • forfiles.exe (PID: 9532)
      • cmd.exe (PID: 11988)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • forfiles.exe (PID: 10116)
      • cmd.exe (PID: 6904)
      • gpupdate.exe (PID: 9340)
      • cmd.exe (PID: 12712)
      • forfiles.exe (PID: 12056)
      • cmd.exe (PID: 3744)
      • forfiles.exe (PID: 12856)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 7968)
      • chrome.exe (PID: 3492)
      • chrome.exe (PID: 4336)
      • schtasks.exe (PID: 5136)
      • schtasks.exe (PID: 5364)
      • chrome.exe (PID: 5800)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 2672)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 9096)
      • chrome.exe (PID: 13424)
      • chrome.exe (PID: 6420)
      • chrome.exe (PID: 13704)
      • chrome.exe (PID: 4332)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)
      • chrome.exe (PID: 964)
      • chrome.exe (PID: 312)
      • reg.exe (PID: 10796)
      • chrome.exe (PID: 12228)
      • chrome.exe (PID: 8516)
      • chrome.exe (PID: 12332)
      • chrome.exe (PID: 11864)
      • chrome.exe (PID: 13820)
      • reg.exe (PID: 9188)
      • chrome.exe (PID: 13264)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 10644)
      • chrome.exe (PID: 696)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 4340)
      • chrome.exe (PID: 4404)

    • Reads the hosts file

      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 3492)

    • Application launched itself

      • chrome.exe (PID: 3408)
      • iexplore.exe (PID: 2764)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 3492)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)

    • Manual execution by user

      • setup_x86_x64_install.exe (PID: 3452)
      • setup_x86_x64_install.exe (PID: 1388)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)

    • Checks Windows Trust Settings

      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09964f7c03.exe (PID: 2604)
      • iexplore.exe (PID: 2832)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)
      • iexplore.exe (PID: 2764)
      • MsiExec.exe (PID: 11540)
      • powershell.exe (PID: 9928)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • wscript.exe (PID: 13616)
      • hpzakXf.exe (PID: 8484)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)

    • Dropped object may contain Bitcoin addresses

      • Sat098ac2475eba09.exe (PID: 1948)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)

    • Application was dropped or rewritten from another process

      • EtalevzaJet.exe (PID: 2624)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)

    • Loads dropped or rewritten executable

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)

    • Creates files in the program directory

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)

    • Creates a software uninstall entry

      • ultramediaburner.tmp (PID: 1704)

    • Changes internet zones settings

      • iexplore.exe (PID: 2764)

    • Creates files in the user directory

      • iexplore.exe (PID: 2832)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2832)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Check for Java to be installed

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
642
Monitored processes
437
Malicious processes
94
Suspicious processes
40

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs winrar.exe setup_x86_x64_install.exe no specs setup_x86_x64_install.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs sat09cd7ecbe4e.exe cmd.exe no specs cmd.exe no specs #REDLINE sat095b4859b0823e.exe cmd.exe no specs cmd.exe no specs sat09127dfa8681ede0.exe cmd.exe no specs cmd.exe no specs sat098ac2475eba09.exe sat093d607fbd.exe sat09f20f74a817fc59.exe sat0914a238bae2.exe #VIDAR sat09964f7c03.exe sat0942d118661ebeaa8.exe sat09127dfa8681ede0.tmp etalevzajet.exe 4388790.scr lzmwaqmv.exe 3307180.scr winhoster.exe no specs #REDLINE 6658114.scr ultramediaburner.exe ultramediaburner.tmp ultramediaburner.exe no specs shubekuxosi.exe lapenyvove.exe iexplore.exe iexplore.exe #REDLINE 7199766.scr 5027594.scr cmd.exe no specs installer.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs taskkill.exe no specs msiexec.exe timeout.exe no specs taskkill.exe no specs msiexec.exe no specs cmd.exe no specs install.exe no specs install.exe no specs install.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs ntvdm.exe wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs ntvdm.exe forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs cmd.exe no specs gcleaner.exe forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs autosubplayer.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs cmd.exe no specs installer.exe no specs ns72fd.tmp no specs powershell.exe no specs ns79f4.tmp no specs lighteningplayer-cache-gen.exe euzsb_bjurtcdp6kqs2wkbp5.exe no specs ox9jys5qmra4edjjp5pcijza.exe no specs #REDLINE ox9jys5qmra4edjjp5pcijza.exe noa5rq9gjz9fn7lw27xwjwjw.exe z8uf9bjp_axpsqti78ukbx2c.exe #VIDAR 2lpsnf_krteguli6fizw2wzf.exe euzsb_bjurtcdp6kqs2wkbp5.exe no specs z9pg6mcdby8d3vse11c1atjo.exe 7569659.scr 6985381.scr no specs 4t_yeqfda0nbyaglcztvlciu.exe qf78g1sahkxt44nnbtmpu81z.exe no specs nsa22b.tmp no specs cmd.exe no specs #REDLINE 210921.exe 249old.exe powershell.exe iyzn0cpcfs0nsq3scm46cox_.exe no specs schtasks.exe no specs schtasks.exe no specs #REDLINE djclxhxqzducgquw8kbgdpv5.exe #REDLINE 0z3pord1tua6orxeylbftu7w.exe cmd.exe no specs taskkill.exe no specs timeout.exe no specs pklom0fhgofdrsgp96rofqju.exe no specs #REDLINE y9ftciyuv8_r8ww73ekprvox.exe khgadhafx5fqt6outvp7_foc.exe no specs qt3dwybp7zsuorww4zcubjl6.exe schtasks.exe no specs schtasks.exe no specs md8_8eus.exe inst001.exe no specs 7yk9wuyh89zhvxf_xvv51ua7.exe #REDLINE hu_ubw8xekvulegr_i9oqfoh.exe _wrr_3qx3wu3x4k5kimithoc.exe no specs #REDLINE _wrr_3qx3wu3x4k5kimithoc.exe regsvcs.exe no specs tuldbhb.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs #REDLINE 2694936.scr cmd.exe no specs #REDLINE 33231236756.exe 1970878.scr wmic.exe no specs bjas93ow5clri8rnmwfw9oae.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs install.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs install.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs cmd.exe no specs 45874656108.exe wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs 60248097993.exe #REDLINE 5268981.scr forfiles.exe no specs cmd.exe no specs powershell.exe no specs 3568351.scr cmd.exe no specs taskkill.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs gpupdate.exe no specs clipper)).exe no specs #REDLINE 1.exe cmd.exe no specs schtasks.exe no specs ntvdm.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs #REDLINE monns.exe gpupdate.exe no specs file.exe no specs cmd.exe no specs timeout.exe no specs verism.exe dllhost.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs puo.exe.com no specs ping.exe no specs puo.exe.com no specs powershell.exe no specs iyzn0cpcfs0nsq3scm46cox_.exe schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs hpzakxf.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs chrome.exe chrome.exe no specs 8tencntk3p2acyomkhft29uc.exe jnomgixrx3rzeus304ojesew.exe fnrsm2t4ilbsb_sjgtk07nuj.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs 9ywba4j7t4d6vrc6bbnwaprt.exe no specs fnrsm2t4ilbsb_sjgtk07nuj.exe no specs mshta.exe no specs 7hukpthyi7hchmi4pxcd6eqq.exe mjx3l73uw0re3b2iyze4pyjm.exe chrome.exe no specs chrome.exe no specs cmd.exe no specs chrome.exe no specs y1fuy5tjk7fr.exe no specs taskkill.exe no specs mshta.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs drbvaw4sceaymhzxhbakps6l.exe no specs rundll32.exe no specs install.exe no specs tmp84f7_tmp.exe no specs #REDLINE tmp84f7_tmp.exe install.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs schtasks.exe no specs schtasks.exe no specs wmic.exe no specs schtasks.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs schtasks.exe no specs wmic.exe no specs schtasks.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs rundll32.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs gegcybm.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs schtasks.exe no specs powershell.exe no specs schtasks.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs gpupdate.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs service.exe no specs schtasks.exe no specs cmd.exe no specs chrome.exe chrome.exe no specs schtasks.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3408"C:\Program Files\Google\Chrome\Application\chrome.exe" --disk-cache-dir=null --disk-cache-size=1 --media-cache-size=1 --disable-gpu-shader-disk-cache --disable-background-networking "https://crackedpc.org/ammyy-admin-crack-free-download/"C:\Program Files\Google\Chrome\Application\chrome.exe
Explorer.EXE
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
3221225547
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3852"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win32 --annotation=prod=Chrome --annotation=ver=86.0.4240.198 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd4,0x6e6fd988,0x6e6fd998,0x6e6fd9a4C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1192"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1060 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
2068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1228 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
1012"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1220 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2768"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1820 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3040"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2180 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
4068"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --gpu-preferences=MAAAAAAAAADgACAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2668 /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
3188"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
3624"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2876 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
585 861
Read events
581 838
Write events
0
Delete events
0

Modification events

No data
Executable files
114
Suspicious files
80
Text files
134
Unknown types
149

Dropped files

PID
Process
Filename
Type
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-614F1111-D50.pma —
MD5:—
SHA256:—
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:1202FCD0945706CAC68EBBB6CCDFC2D2
SHA256:FABD834D27C7306E4325B98B1D35B7222DA0FE2016EC678CA1EC0D09AED27164
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\0aa30825-c9c1-4d21-856d-163734d044b9.tmptext
MD5:1202FCD0945706CAC68EBBB6CCDFC2D2
SHA256:FABD834D27C7306E4325B98B1D35B7222DA0FE2016EC678CA1EC0D09AED27164
3852chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.oldtext
MD5:EF1D5606A483BB6C72C81A3F649BEB18
SHA256:BA083E7585ADA9936944FE56BC0141A544F18A01C3424E5C9F02375B34FE3D45
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:5BD3C311F2136A7A88D3E197E55CF902
SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFfd3d1.TMPtext
MD5:8304B8F42465198890090F52D3F80A4C
SHA256:80C32AC2585E7E81200104B1630F19560A156C4ABF51B5888B0FBF07323FAB34
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old~RFfd5b6.TMPtext
MD5:D0BA19096D6C8F8DE58312E8D938E893
SHA256:AADE90A7B0984F3C719D528E4E6FAE3854E28B30363BDD4DF65037E69784A078
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
197
TCP/UDP connections
471
DNS requests
193
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
chrome.exe
GET
301
104.21.39.132:80
http://krmcean.xyz/?s=7&q=SpyHunter+5+Crack+%5BEmail+&dedica=18&hmac=WyJjN2Y0M2Q3MzAwZGE1OGUzZmQ1MmQyZGY1M2M5NGVmNDFmZGUzYmUzIiwiZjhmZjQ0ZDc2N2NmNTNkMDI4ZWQyNmU4YjE5MDE4Zjg5ZDA3YjQwMyIsIjhlZWJmMDUwMTIxMmMwNDIyZjI2MDc5ZjY4MGQxNmIyZjEwNDYwMzIiLCJkYTIxNWYwMTRmYWM5YjgwYWViZDY3YjhiNDQ0NjhiMThkM2M1Mzk1IiwiNGM2MzhhYzU3NDgzMmY1OTA1ZjhjNjQ4ODM5YjIzNzYxNTI2MDE5ZSIsIjZhODgxODFiYWFiODEzYjIyNmFkOTUyMTRjNzVhYzhiNTRkZjEwN2UiLCIxODAzNTZlYzY4MDFiMWU2NWRlOTY2MWE1MzIwYjVhNGVjNmI3ZTc5IiwiOTQ2NzNhNzdjYjNhYWFmYzc5N2RhZmJlNzA4NTRlM2UxMjhjYzE4MSIsIjhkYzYwN2UzMWI5MWExY2NiMDcwNGNmYjk1MTg5NjNmYjMyOTZlN2YiLCIzZjlkNDYyMDAyYTJmMWM1MWQ1OWIwYWY1Y2E2Y2Y1ZGE2Y2Y3M2YwIiwiNDIxZmE2MzUwYWI1NDBhYzQ0ZGRhY2E0YzMzNDg1Y2NlYWM4YmYwMCJd
US
—
—
malicious
1908
Sat09127dfa8681ede0.tmp
HEAD
200
162.0.214.42:80
http://safialinks.com/Installer_Provider/UltraMediaBurner.exe
CA
—
—
whitelisted
2068
chrome.exe
GET
301
172.67.187.223:80
http://ljhjdh.xyz/?s=7&q=Ammyy+Admin+3.10+Crack+++Key+Full+Version&dedica=18&hmac=WyI1MDdmMzFiYzdmMzliNWIyMDkyMTAyYjVkNjNlZThkZDJiNzdhMTZkIiwiNTkzOTc4YWU4NmE1MWFlZDYzYmU5NjcwNzZlNmQ5NzY1MWQ4ZTA1MyIsIjlkZTMyOTMwMWQ0YThiODYwYTNlYzcwMmM5NjM0NTQxODUxY2ViNjQiLCIzMDBiZWE0ZjVlNjhjYTk3YzY1ZTk4MjdkYmE5YTQ0OGY5MjE0YzgzIiwiMzM3YjY5YjJiODY1NGI4MDAyMzVkNmM1MTMzZjgwZTlhZGU1NTdkYiIsIjRkMmNlMDgzMzNjNmYwMzA0ODAzNjUyZWRjY2RiMjQ3ODg0MmFlZTkiLCJlMjM5ZmM2MjJhMGM1YmQ2ZDZlZGNkNWU0NDI5ZGUxYmE1OWY0MmNlIiwiMTU5NWNlNjA1NDcwN2Q3MWQ5YjkyMjEyZDBkNWVlODYwMmYwNzk5MCIsIjQ0OTg4YjJkM2MxNGJhOTdjNDViYjliZWVhN2VjYTg2MWI4YjBkYzQiLCI4MjVlZDU3NWYwZWU3ODJjMzIwMDhkMjlhN2Y1NWYwZTE2OGI0NjUzIiwiZGI3NTQwOGI0YzNiMGYwYzczNWE0ZmEwM2Y0MTM1Y2JkY2QwYWQ2NSJd
US
—
—
malicious
2704
Sat0942d118661ebeaa8.exe
GET
200
45.133.1.182:80
http://45.133.1.182/proxies.txt
unknown
text
2.45 Kb
suspicious
2068
chrome.exe
GET
302
18.237.46.89:80
http://18.237.46.89/?614f11180510c=c4e394d73d4c90664fde851cfc376696ebe73101Array&m=7&q=Ammyy%20Admin%203.10%20Crack%20%20%20Key%20Full%20Version&dedica=18&
US
html
19.0 Kb
unknown
2068
chrome.exe
POST
200
18.237.46.89:80
http://18.237.46.89/?cloudx=bedf03089e0c21458177c34&dedica=18&verify-id=7&verify-hash=902ba3cda1883801594b6e1b452790cc53948fda&verify-msch=U3B5SHVudGVyIDUgQ3JhY2sgW0VtYWlsIA==&download=1&xtrans=MTUw
US
compressed
3.53 Mb
unknown
2068
chrome.exe
GET
302
18.237.46.89:80
http://18.237.46.89/?614f112c991b2=afd9000f759b98c8ff000d8953fe153ff826b14bArray&m=7&q=SpyHunter%205%20Crack%20[Email%20&dedica=18&
US
html
19.0 Kb
unknown
2704
Sat0942d118661ebeaa8.exe
GET
200
37.0.8.119:80
http://37.0.8.119/base/api/statistics.php
NL
binary
96 b
malicious
2068
chrome.exe
POST
200
18.237.46.89:80
http://18.237.46.89/?go=a880512d1d5ae&dedica=18
US
html
694 b
unknown
1908
Sat09127dfa8681ede0.tmp
GET
200
162.0.214.42:80
http://safialinks.com/Installer_Provider/UltraMediaBurner.exe
CA
executable
474 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2068
chrome.exe
172.217.23.106:443
content-autofill.googleapis.com
Google Inc.
US
whitelisted
2068
chrome.exe
192.0.76.3:443
stats.wp.com
Automattic, Inc
US
suspicious
2068
chrome.exe
216.58.212.142:443
clients2.google.com
Google Inc.
US
whitelisted
2068
chrome.exe
172.67.214.180:443
crackedpc.org
—
US
suspicious
2068
chrome.exe
157.240.236.1:443
connect.facebook.net
—
US
unknown
2068
chrome.exe
192.0.77.2:443
i0.wp.com
Automattic, Inc
US
suspicious
2068
chrome.exe
142.250.184.237:443
accounts.google.com
Google Inc.
US
suspicious
2068
chrome.exe
142.250.186.168:443
www.googletagmanager.com
Google Inc.
US
suspicious
2068
chrome.exe
142.250.186.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
2068
chrome.exe
172.67.180.127:443
vbdhjtgve.xyz
—
US
unknown

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 216.58.212.142
  • 172.217.23.110
whitelisted
crackedpc.org
  • 172.67.214.180
  • 104.21.23.244
whitelisted
accounts.google.com
  • 142.250.184.237
  • 142.250.184.205
shared
www.google.com
  • 142.250.186.36
whitelisted
stats.wp.com
  • 192.0.76.3
whitelisted
vbdhjtgve.xyz
  • 172.67.180.127
  • 104.21.83.183
malicious
c0.wp.com
  • 192.0.77.37
whitelisted
content-autofill.googleapis.com
  • 172.217.23.106
whitelisted
connect.facebook.net
  • 157.240.236.1
whitelisted
i0.wp.com
  • 192.0.77.2
whitelisted

Threats

PID
Process
Class
Message
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3952
setup_install.exe
A Network Trojan was detected
AV TROJAN GCleaner Downloader CnC Activity
3952
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2704
Sat0942d118661ebeaa8.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
1908
Sat09127dfa8681ede0.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
199 ETPRO signatures available at the full report
Process
Message
lighteningplayer-cache-gen.exe
main libvlc debug: VLC media player - 3.0.7 Vetinari
lighteningplayer-cache-gen.exe
main libvlc debug: Copyright � 1996-2018 the VideoLAN team
lighteningplayer-cache-gen.exe
main libvlc debug: revision 3.0.2-225-gc9e3360dd4
lighteningplayer-cache-gen.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
lighteningplayer-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
lighteningplayer-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
lighteningplayer-cache-gen.exe
main libvlc debug: searching plug-in modules
lighteningplayer-cache-gen.exe
main libvlc debug: ignoring plugins cache file
lighteningplayer-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
lighteningplayer-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://crackedpc.org/ammyy-admin-crack-free-download/