URL:

https://crackedpc.org/ammyy-admin-crack-free-download/

Full analysis: https://app.any.run/tasks/38719fcd-39cf-415c-9fbd-732bd62af348
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 25, 2021, 12:07:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
evasion
rat
redline
stealer
vidar
opendir
Indicators:
MD5:

EC592A2E154D44F18C4135E7315ACBF4

SHA1:

12F5F7E70FECD985CD50D0DDE5852F378FCA40E5

SHA256:

5E0BB31C5994B0BB8EB4E4F38EA22EA5394691F2FA8E6E52650223ECDDF54BEC

SSDEEP:

3:N8KhkzfN7OoAzFmn:2K6T5OdM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_x86_x64_install.exe (PID: 3452)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • setup_install.exe (PID: 3952)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat0914a238bae2.exe (PID: 3320)
      • Sat093d607fbd.exe (PID: 1784)
      • 4388790.scr (PID: 3304)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • WinHoster.exe (PID: 3456)
      • ultramediaburner.exe (PID: 2816)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • UltraMediaBurner.exe (PID: 1744)
      • install.exe (PID: 9700)
      • Install.exe (PID: 10004)
      • gcleaner.exe (PID: 6696)
      • installer.exe (PID: 5168)
      • installer.exe (PID: 8736)
      • autosubplayer.exe (PID: 4020)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 6985381.scr (PID: 3704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • Install.exe (PID: 10760)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • TUldbHb.exe (PID: 12036)
      • 33231236756.exe (PID: 292)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • Install.exe (PID: 5500)
      • Install.exe (PID: 6260)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)
      • 3568351.scr (PID: 13252)
      • 5268981.scr (PID: 5448)
      • 2694936.scr (PID: 12996)
      • 1970878.scr (PID: 2940)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • hpzakXf.exe (PID: 8484)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • Install.exe (PID: 6588)
      • Install.exe (PID: 11356)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • GEGcYbm.exe (PID: 5420)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)

    • Executes PowerShell scripts

      • cmd.exe (PID: 284)
      • cmd.exe (PID: 8996)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3952)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Changes settings of System certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Connects to CnC server

      • setup_install.exe (PID: 3952)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • md8_8eus.exe (PID: 9548)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 33231236756.exe (PID: 292)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)

    • Actions looks like stealing of personal data

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • md8_8eus.exe (PID: 9548)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • 45874656108.exe (PID: 8912)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • hpzakXf.exe (PID: 8484)
      • tmp84F7_tmp.exe (PID: 8824)

    • Changes the autorun value in the registry

      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • verism.exe (PID: 10956)

    • Stealing of credential data

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Disables Windows Defender

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Steals credentials from Web Browsers

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • md8_8eus.exe (PID: 9548)
      • hpzakXf.exe (PID: 8484)

    • REDLINE was detected

      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 33231236756.exe (PID: 292)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 8128)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • installer.exe (PID: 5168)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 11220)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6560)
      • schtasks.exe (PID: 11288)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 3092)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 5136)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)

    • VIDAR was detected

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Uses Task Scheduler to run other applications

      • Install.exe (PID: 10760)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • TUldbHb.exe (PID: 12036)
      • cmd.exe (PID: 10376)
      • Install.exe (PID: 6260)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • Install.exe (PID: 11356)
      • cmd.exe (PID: 5368)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 13608)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 7388)

    • Uses Task Scheduler to autorun other applications

      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • hpzakXf.exe (PID: 8484)

    • Runs app for hidden code execution

      • cmd.exe (PID: 11636)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 3912)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 7560)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 13984)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 14120)

    • Modifies files in Chrome extension folder

      • hpzakXf.exe (PID: 8484)

  • SUSPICIOUS

    • Reads the computer name

      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 3732)
      • WinRAR.exe (PID: 2476)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • powershell.exe (PID: 2864)
      • setup_install.exe (PID: 3952)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • 4388790.scr (PID: 3304)
      • 3307180.scr (PID: 1968)
      • LzmwAqmV.exe (PID: 2496)
      • WinHoster.exe (PID: 3456)
      • EtalevzaJet.exe (PID: 2624)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • ultramediaburner.tmp (PID: 1704)
      • 6658114.scr (PID: 4088)
      • UltraMediaBurner.exe (PID: 1744)
      • Sat0914a238bae2.exe (PID: 3320)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • installer.exe (PID: 5168)
      • Install.exe (PID: 10760)
      • powershell.exe (PID: 11656)
      • WMIC.exe (PID: 5916)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • WMIC.exe (PID: 2320)
      • powershell.exe (PID: 4616)
      • WMIC.exe (PID: 7412)
      • gcleaner.exe (PID: 6696)
      • autosubplayer.exe (PID: 4020)
      • powershell.EXE (PID: 5584)
      • installer.exe (PID: 8736)
      • powershell.exe (PID: 9928)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 7569659.scr (PID: 6400)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • 249old.exe (PID: 9492)
      • powershell.exe (PID: 9896)
      • 210921.exe (PID: 10700)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • md8_8eus.exe (PID: 9548)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • TUldbHb.exe (PID: 12036)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • 1970878.scr (PID: 2940)
      • WMIC.exe (PID: 13592)
      • 2694936.scr (PID: 12996)
      • powershell.exe (PID: 5312)
      • powershell.exe (PID: 1292)
      • 33231236756.exe (PID: 292)
      • WMIC.exe (PID: 4392)
      • powershell.exe (PID: 5076)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • Install.exe (PID: 6260)
      • WMIC.exe (PID: 13968)
      • powershell.exe (PID: 7356)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • 5268981.scr (PID: 5448)
      • WMIC.exe (PID: 12852)
      • 3568351.scr (PID: 13252)
      • 45874656108.exe (PID: 8912)
      • WMIC.exe (PID: 1892)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • clipper)).exe (PID: 8224)
      • 1.exe (PID: 9584)
      • RegSvcs.exe (PID: 4352)
      • powershell.EXE (PID: 7740)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • Puo.exe.com (PID: 11440)
      • powershell.exe (PID: 6768)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • wscript.exe (PID: 13616)
      • powershell.exe (PID: 5324)
      • hpzakXf.exe (PID: 8484)
      • WMIC.exe (PID: 5996)
      • powershell.exe (PID: 9588)
      • powershell.exe (PID: 2340)
      • WMIC.exe (PID: 8664)
      • powershell.exe (PID: 5476)
      • WMIC.exe (PID: 11416)
      • WMIC.exe (PID: 9344)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • mshta.exe (PID: 12792)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • mshta.exe (PID: 6444)
      • tmp84F7_tmp.exe (PID: 6184)
      • Install.exe (PID: 11356)
      • powershell.exe (PID: 7512)
      • WMIC.exe (PID: 4968)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • tmp84F7_tmp.exe (PID: 8824)
      • WMIC.exe (PID: 3984)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • powershell.exe (PID: 7624)
      • WMIC.exe (PID: 7744)
      • GEGcYbm.exe (PID: 5420)
      • powershell.exe (PID: 7116)
      • WMIC.exe (PID: 8900)
      • powershell.exe (PID: 2876)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 10352)
      • WMIC.exe (PID: 7180)
      • WMIC.exe (PID: 13680)
      • powershell.exe (PID: 12372)
      • service.exe (PID: 14120)

    • Checks supported languages

      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2476)
      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • setup_install.exe (PID: 3952)
      • powershell.exe (PID: 2864)
      • cmd.exe (PID: 284)
      • cmd.exe (PID: 3080)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 2516)
      • Sat095b4859b0823e.exe (PID: 2440)
      • cmd.exe (PID: 3608)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • cmd.exe (PID: 400)
      • cmd.exe (PID: 3624)
      • cmd.exe (PID: 4036)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • cmd.exe (PID: 2668)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • cmd.exe (PID: 2040)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat0914a238bae2.exe (PID: 3320)
      • Sat093d607fbd.exe (PID: 1784)
      • cmd.exe (PID: 3852)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • 4388790.scr (PID: 3304)
      • EtalevzaJet.exe (PID: 2624)
      • 3307180.scr (PID: 1968)
      • LzmwAqmV.exe (PID: 2496)
      • WinHoster.exe (PID: 3456)
      • 6658114.scr (PID: 4088)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • UltraMediaBurner.exe (PID: 1744)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • cmd.exe (PID: 4812)
      • installer.exe (PID: 5168)
      • cmd.exe (PID: 10920)
      • cmd.exe (PID: 9460)
      • install.exe (PID: 9700)
      • Install.exe (PID: 10004)
      • Install.exe (PID: 10760)
      • cmd.exe (PID: 2068)
      • powershell.exe (PID: 11656)
      • cmd.exe (PID: 11944)
      • WMIC.exe (PID: 5916)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • WMIC.exe (PID: 2320)
      • cmd.exe (PID: 3680)
      • powershell.exe (PID: 4616)
      • cmd.exe (PID: 6644)
      • WMIC.exe (PID: 7412)
      • gcleaner.exe (PID: 6696)
      • cmd.exe (PID: 924)
      • autosubplayer.exe (PID: 4020)
      • cmd.exe (PID: 9480)
      • powershell.EXE (PID: 5584)
      • installer.exe (PID: 8736)
      • ns79F4.tmp (PID: 11568)
      • powershell.exe (PID: 9928)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • ns72FD.tmp (PID: 9180)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 7569659.scr (PID: 6400)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • cmd.exe (PID: 8996)
      • 249old.exe (PID: 9492)
      • powershell.exe (PID: 9896)
      • 210921.exe (PID: 10700)
      • nsA22B.tmp (PID: 9820)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • cmd.exe (PID: 8380)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • md8_8eus.exe (PID: 9548)
      • inst001.exe (PID: 8956)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • RegSvcs.exe (PID: 4352)
      • TUldbHb.exe (PID: 12036)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • cmd.exe (PID: 11668)
      • powershell.exe (PID: 5312)
      • cmd.exe (PID: 13168)
      • 1970878.scr (PID: 2940)
      • WMIC.exe (PID: 13592)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • 2694936.scr (PID: 12996)
      • powershell.exe (PID: 1292)
      • 33231236756.exe (PID: 292)
      • WMIC.exe (PID: 4392)
      • powershell.exe (PID: 5076)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • Install.exe (PID: 6260)
      • cmd.exe (PID: 6716)
      • Install.exe (PID: 5500)
      • WMIC.exe (PID: 13968)
      • powershell.exe (PID: 7356)
      • cmd.exe (PID: 8816)
      • 45874656108.exe (PID: 8912)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 11684)
      • 5268981.scr (PID: 5448)
      • powershell.exe (PID: 6364)
      • WMIC.exe (PID: 12852)
      • cmd.exe (PID: 12700)
      • 60248097993.exe (PID: 6284)
      • 3568351.scr (PID: 13252)
      • cmd.exe (PID: 13660)
      • powershell.EXE (PID: 4280)
      • WMIC.exe (PID: 1892)
      • clipper)).exe (PID: 8224)
      • cmd.exe (PID: 10376)
      • 1.exe (PID: 9584)
      • powershell.EXE (PID: 7740)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • cmd.exe (PID: 10056)
      • verism.exe (PID: 10956)
      • Puo.exe.com (PID: 11260)
      • Puo.exe.com (PID: 11440)
      • cmd.exe (PID: 11636)
      • cmd.exe (PID: 11428)
      • powershell.exe (PID: 6768)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 13516)
      • wscript.exe (PID: 13616)
      • cmd.exe (PID: 13244)
      • hpzakXf.exe (PID: 8484)
      • cmd.exe (PID: 8492)
      • powershell.exe (PID: 5324)
      • WMIC.exe (PID: 8664)
      • WMIC.exe (PID: 5996)
      • powershell.exe (PID: 9588)
      • powershell.exe (PID: 2340)
      • powershell.exe (PID: 5476)
      • WMIC.exe (PID: 9344)
      • WMIC.exe (PID: 11416)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 6156)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • mshta.exe (PID: 12792)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • mshta.exe (PID: 6444)
      • cmd.exe (PID: 11464)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • Install.exe (PID: 6588)
      • tmp84F7_tmp.exe (PID: 6184)
      • Install.exe (PID: 11356)
      • cmd.exe (PID: 4440)
      • cmd.exe (PID: 7064)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 7512)
      • WMIC.exe (PID: 4968)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 12540)
      • tmp84F7_tmp.exe (PID: 8824)
      • WMIC.exe (PID: 3984)
      • WMIC.exe (PID: 7744)
      • powershell.exe (PID: 7624)
      • GEGcYbm.exe (PID: 5420)
      • cmd.exe (PID: 4752)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • WMIC.exe (PID: 8900)
      • powershell.exe (PID: 2876)
      • WMIC.exe (PID: 7180)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 10352)
      • WMIC.exe (PID: 13680)
      • powershell.exe (PID: 12372)
      • service.exe (PID: 14120)
      • cmd.exe (PID: 5368)
      • cmd.exe (PID: 7496)
      • cmd.exe (PID: 11160)

    • Application launched itself

      • WinRAR.exe (PID: 2132)
      • msiexec.exe (PID: 8296)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • cmd.exe (PID: 11636)
      • Puo.exe.com (PID: 11260)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • tmp84F7_tmp.exe (PID: 6184)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • 3307180.scr (PID: 1968)
      • LzmwAqmV.exe (PID: 2496)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Install.exe (PID: 10760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)
      • ultramediaburner.exe (PID: 2816)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 3892)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • EtalevzaJet.exe (PID: 2624)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3952)
      • Lapenyvove.exe (PID: 2224)
      • Sat09964f7c03.exe (PID: 2604)
      • Install.exe (PID: 10760)
      • forfiles.exe (PID: 11360)
      • forfiles.exe (PID: 5432)
      • forfiles.exe (PID: 13708)
      • forfiles.exe (PID: 4068)
      • forfiles.exe (PID: 10584)
      • forfiles.exe (PID: 10884)
      • nsA22B.tmp (PID: 9820)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • TUldbHb.exe (PID: 12036)
      • forfiles.exe (PID: 12232)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • forfiles.exe (PID: 14072)
      • forfiles.exe (PID: 6880)
      • forfiles.exe (PID: 4760)
      • Install.exe (PID: 6260)
      • forfiles.exe (PID: 6940)
      • forfiles.exe (PID: 10224)
      • forfiles.exe (PID: 11180)
      • forfiles.exe (PID: 12584)
      • forfiles.exe (PID: 5896)
      • forfiles.exe (PID: 6176)
      • clipper)).exe (PID: 8224)
      • verism.exe (PID: 10956)
      • cmd.exe (PID: 11636)
      • 45874656108.exe (PID: 8912)
      • hpzakXf.exe (PID: 8484)
      • forfiles.exe (PID: 7768)
      • forfiles.exe (PID: 10800)
      • forfiles.exe (PID: 8792)
      • forfiles.exe (PID: 11364)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)
      • Install.exe (PID: 11356)
      • forfiles.exe (PID: 3028)
      • forfiles.exe (PID: 10148)
      • forfiles.exe (PID: 6324)
      • forfiles.exe (PID: 4268)
      • forfiles.exe (PID: 12836)
      • forfiles.exe (PID: 4296)
      • GEGcYbm.exe (PID: 5420)
      • forfiles.exe (PID: 9532)
      • forfiles.exe (PID: 10116)
      • forfiles.exe (PID: 12056)
      • forfiles.exe (PID: 12856)
      • service.exe (PID: 14120)

    • Reads the date of Windows installation

      • powershell.exe (PID: 2864)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 4616)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 5312)
      • powershell.exe (PID: 1292)
      • powershell.exe (PID: 5076)
      • powershell.exe (PID: 4332)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 5324)
      • powershell.exe (PID: 2340)
      • powershell.exe (PID: 9588)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.exe (PID: 2876)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 5856)
      • powershell.exe (PID: 12372)

    • Creates files in the user directory

      • powershell.exe (PID: 2864)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • installer.exe (PID: 5168)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 13912)
      • autosubplayer.exe (PID: 4020)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 4616)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5856)
      • powershell.exe (PID: 12372)

    • Reads Environment values

      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat098ac2475eba09.exe (PID: 1948)
      • EtalevzaJet.exe (PID: 2624)
      • 4388790.scr (PID: 3304)
      • Lapenyvove.exe (PID: 2224)
      • SHubekuxosi.exe (PID: 2508)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • installer.exe (PID: 5168)
      • 5027594.scr (PID: 8164)
      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
      • 7199766.scr (PID: 5300)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 7569659.scr (PID: 6400)
      • powershell.exe (PID: 9896)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • 1970878.scr (PID: 2940)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 45874656108.exe (PID: 8912)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • 3568351.scr (PID: 13252)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • tmp84F7_tmp.exe (PID: 8824)

    • Reads the Windows organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)

    • Reads Windows owner or organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)

    • Adds / modifies Windows certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Starts application with an unusual extension

      • Sat098ac2475eba09.exe (PID: 1948)
      • autosubplayer.exe (PID: 4020)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • Puo.exe.com (PID: 11260)
      • cmd.exe (PID: 11428)

    • Starts itself from another location

      • 3307180.scr (PID: 1968)
      • install.exe (PID: 9700)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)

    • Reads the cookies of Mozilla Firefox

      • 4388790.scr (PID: 3304)
      • md8_8eus.exe (PID: 9548)

    • Searches for installed software

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 5027594.scr (PID: 8164)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • 2694936.scr (PID: 12996)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • 5268981.scr (PID: 5448)
      • tmp84F7_tmp.exe (PID: 8824)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Creates a directory in Program Files

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)
      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Checks for external IP

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Creates files in the program directory

      • Sat09964f7c03.exe (PID: 2604)
      • msiexec.exe (PID: 8296)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • autosubplayer.exe (PID: 4020)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • md8_8eus.exe (PID: 9548)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Starts Internet Explorer

      • SHubekuxosi.exe (PID: 2508)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2832)
      • powershell.exe (PID: 9896)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Reads CPU info

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)

    • Starts Microsoft Installer

      • installer.exe (PID: 5168)

    • Starts CMD.EXE for self-deleting

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)

    • Uses TASKKILL.EXE to kill process

      • MsiExec.exe (PID: 11540)
      • cmd.exe (PID: 10920)
      • cmd.exe (PID: 8380)
      • cmd.exe (PID: 13660)
      • cmd.exe (PID: 11464)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • hpzakXf.exe (PID: 8484)

    • Executes PowerShell scripts

      • cmd.exe (PID: 11588)
      • cmd.exe (PID: 12144)
      • cmd.exe (PID: 13832)
      • cmd.exe (PID: 4208)
      • ns72FD.tmp (PID: 9180)
      • cmd.exe (PID: 6580)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7084)
      • cmd.exe (PID: 9892)
      • cmd.exe (PID: 11468)
      • cmd.exe (PID: 3336)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 8592)
      • cmd.exe (PID: 11872)
      • cmd.exe (PID: 10916)
      • cmd.exe (PID: 10368)
      • cmd.exe (PID: 9128)
      • cmd.exe (PID: 2440)
      • cmd.exe (PID: 14052)
      • cmd.exe (PID: 11988)
      • cmd.exe (PID: 6904)
      • cmd.exe (PID: 12712)
      • cmd.exe (PID: 3744)

    • Executes application which crashes

      • cmd.exe (PID: 11944)
      • cmd.exe (PID: 3680)
      • 60248097993.exe (PID: 6284)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 11068)
      • cmd.exe (PID: 11504)
      • cmd.exe (PID: 7064)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 13516)
      • wscript.exe (PID: 13616)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 11160)
      • cmd.exe (PID: 7496)

    • Executed via Task Scheduler

      • powershell.EXE (PID: 5584)
      • TUldbHb.exe (PID: 12036)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • GEGcYbm.exe (PID: 5420)
      • powershell.EXE (PID: 8864)
      • chrome.exe (PID: 3492)
      • service.exe (PID: 14120)

    • PowerShell script executed

      • powershell.EXE (PID: 5584)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.EXE (PID: 8864)

    • Executed as Windows Service

      • msiexec.exe (PID: 8296)

    • Creates files in the Windows directory

      • schtasks.exe (PID: 13608)
      • cmd.exe (PID: 13244)
      • TUldbHb.exe (PID: 12036)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6504)
      • hpzakXf.exe (PID: 8484)
      • schtasks.exe (PID: 9992)

    • Reads the cookies of Google Chrome

      • md8_8eus.exe (PID: 9548)

    • Reads mouse settings

      • Puo.exe.com (PID: 11440)
      • Puo.exe.com (PID: 11260)

    • Executes scripts

      • TUldbHb.exe (PID: 12036)

    • Removes files from Windows directory

      • TUldbHb.exe (PID: 12036)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Uses RUNDLL32.EXE to load library

      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3492)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 2768)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 2496)
      • chrome.exe (PID: 3040)
      • chrome.exe (PID: 3188)
      • chrome.exe (PID: 3624)
      • chrome.exe (PID: 2392)
      • chrome.exe (PID: 828)
      • chrome.exe (PID: 2952)
      • chrome.exe (PID: 3112)
      • chrome.exe (PID: 1596)
      • chrome.exe (PID: 2544)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 3152)
      • NOTEPAD.EXE (PID: 3908)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • MsiExec.exe (PID: 2828)
      • msiexec.exe (PID: 9308)
      • MsiExec.exe (PID: 11540)
      • timeout.exe (PID: 11808)
      • taskkill.exe (PID: 12312)
      • taskkill.exe (PID: 11180)
      • MsiExec.exe (PID: 8128)
      • forfiles.exe (PID: 11360)
      • ntvdm.exe (PID: 12348)
      • cmd.exe (PID: 12144)
      • forfiles.exe (PID: 5432)
      • cmd.exe (PID: 11588)
      • forfiles.exe (PID: 13708)
      • cmd.exe (PID: 13832)
      • ntvdm.exe (PID: 2304)
      • forfiles.exe (PID: 4068)
      • cmd.exe (PID: 4208)
      • forfiles.exe (PID: 10584)
      • cmd.exe (PID: 11068)
      • forfiles.exe (PID: 10884)
      • reg.exe (PID: 11264)
      • cmd.exe (PID: 11504)
      • reg.exe (PID: 11660)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • msiexec.exe (PID: 8296)
      • gpupdate.exe (PID: 7080)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 13608)
      • taskkill.exe (PID: 2240)
      • timeout.exe (PID: 7600)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • forfiles.exe (PID: 12232)
      • cmd.exe (PID: 6580)
      • forfiles.exe (PID: 14072)
      • forfiles.exe (PID: 6880)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 7912)
      • forfiles.exe (PID: 4760)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7084)
      • forfiles.exe (PID: 6940)
      • forfiles.exe (PID: 11180)
      • cmd.exe (PID: 11468)
      • forfiles.exe (PID: 10224)
      • cmd.exe (PID: 9892)
      • forfiles.exe (PID: 12584)
      • cmd.exe (PID: 3336)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 2996)
      • forfiles.exe (PID: 5896)
      • forfiles.exe (PID: 6176)
      • cmd.exe (PID: 7064)
      • reg.exe (PID: 7056)
      • gpupdate.exe (PID: 9476)
      • cmd.exe (PID: 6464)
      • reg.exe (PID: 5948)
      • schtasks.exe (PID: 11220)
      • ntvdm.exe (PID: 5632)
      • schtasks.exe (PID: 14092)
      • schtasks.exe (PID: 13976)
      • gpupdate.exe (PID: 2996)
      • timeout.exe (PID: 10320)
      • dllhost.exe (PID: 11264)
      • findstr.exe (PID: 11432)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • reg.exe (PID: 3912)
      • reg.exe (PID: 13872)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 7560)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 13984)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 6884)
      • reg.exe (PID: 3640)
      • reg.exe (PID: 2452)
      • reg.exe (PID: 8292)
      • reg.exe (PID: 2936)
      • reg.exe (PID: 8072)
      • schtasks.exe (PID: 6424)
      • reg.exe (PID: 14120)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 960)
      • forfiles.exe (PID: 7768)
      • cmd.exe (PID: 600)
      • schtasks.exe (PID: 6560)
      • forfiles.exe (PID: 8792)
      • forfiles.exe (PID: 10800)
      • cmd.exe (PID: 11872)
      • cmd.exe (PID: 8592)
      • cmd.exe (PID: 10916)
      • chrome.exe (PID: 9736)
      • chrome.exe (PID: 11468)
      • forfiles.exe (PID: 11364)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 13728)
      • chrome.exe (PID: 5176)
      • chrome.exe (PID: 10780)
      • chrome.exe (PID: 12816)
      • chrome.exe (PID: 1040)
      • chrome.exe (PID: 4692)
      • chrome.exe (PID: 4628)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 11288)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 12504)
      • reg.exe (PID: 6576)
      • reg.exe (PID: 2428)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 6504)
      • chrome.exe (PID: 9504)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 11120)
      • chrome.exe (PID: 10848)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 10992)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 4340)
      • chrome.exe (PID: 1144)
      • chrome.exe (PID: 7772)
      • chrome.exe (PID: 4688)
      • rundll32.exe (PID: 12176)
      • forfiles.exe (PID: 3028)
      • cmd.exe (PID: 10368)
      • forfiles.exe (PID: 10148)
      • cmd.exe (PID: 9128)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 8748)
      • forfiles.exe (PID: 6324)
      • cmd.exe (PID: 2440)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • forfiles.exe (PID: 12836)
      • cmd.exe (PID: 14052)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • forfiles.exe (PID: 4268)
      • cmd.exe (PID: 3520)
      • forfiles.exe (PID: 4296)
      • cmd.exe (PID: 7728)
      • schtasks.exe (PID: 3092)
      • reg.exe (PID: 4600)
      • reg.exe (PID: 8212)
      • schtasks.exe (PID: 9992)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 13352)
      • cmd.exe (PID: 11988)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • forfiles.exe (PID: 9532)
      • forfiles.exe (PID: 10116)
      • cmd.exe (PID: 6904)
      • gpupdate.exe (PID: 9340)
      • cmd.exe (PID: 12712)
      • forfiles.exe (PID: 12856)
      • forfiles.exe (PID: 12056)
      • schtasks.exe (PID: 8088)
      • cmd.exe (PID: 3744)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 7968)
      • chrome.exe (PID: 3492)
      • schtasks.exe (PID: 5364)
      • chrome.exe (PID: 4336)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 9096)
      • chrome.exe (PID: 6420)
      • chrome.exe (PID: 5800)
      • chrome.exe (PID: 13424)
      • chrome.exe (PID: 13704)
      • schtasks.exe (PID: 5136)
      • reg.exe (PID: 9188)
      • reg.exe (PID: 10796)
      • schtasks.exe (PID: 9108)
      • chrome.exe (PID: 2672)
      • chrome.exe (PID: 4332)
      • schtasks.exe (PID: 7380)
      • chrome.exe (PID: 964)
      • chrome.exe (PID: 12332)
      • chrome.exe (PID: 11864)
      • chrome.exe (PID: 13264)
      • chrome.exe (PID: 13820)
      • chrome.exe (PID: 10644)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 4340)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 696)
      • chrome.exe (PID: 4404)
      • chrome.exe (PID: 312)
      • chrome.exe (PID: 8516)
      • chrome.exe (PID: 12228)
      • taskkill.exe (PID: 8120)

    • Application launched itself

      • chrome.exe (PID: 3408)
      • iexplore.exe (PID: 2764)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 3492)

    • Reads the hosts file

      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 3492)

    • Reads the computer name

      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 2828)
      • msiexec.exe (PID: 9308)
      • taskkill.exe (PID: 11180)
      • MsiExec.exe (PID: 11540)
      • taskkill.exe (PID: 12312)
      • MsiExec.exe (PID: 8128)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • gpupdate.exe (PID: 7080)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 13608)
      • taskkill.exe (PID: 2240)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 11220)
      • gpupdate.exe (PID: 9476)
      • schtasks.exe (PID: 14092)
      • schtasks.exe (PID: 13976)
      • gpupdate.exe (PID: 2996)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6560)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1040)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 11288)
      • chrome.exe (PID: 11468)
      • chrome.exe (PID: 4672)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 6504)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 2492)
      • taskkill.exe (PID: 8120)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 3092)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 11764)
      • schtasks.exe (PID: 6660)
      • gpupdate.exe (PID: 9340)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5364)
      • chrome.exe (PID: 3492)
      • schtasks.exe (PID: 5136)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 2672)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)
      • schtasks.exe (PID: 7132)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2068)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • EtalevzaJet.exe (PID: 2624)
      • Sat09964f7c03.exe (PID: 2604)
      • 4388790.scr (PID: 3304)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • iexplore.exe (PID: 2832)
      • 6658114.scr (PID: 4088)
      • Sat095b4859b0823e.exe (PID: 2440)
      • installer.exe (PID: 5168)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 8296)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • MsiExec.exe (PID: 11540)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 7569659.scr (PID: 6400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • powershell.exe (PID: 9896)
      • 210921.exe (PID: 10700)
      • md8_8eus.exe (PID: 9548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • 1970878.scr (PID: 2940)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 2694936.scr (PID: 12996)
      • 33231236756.exe (PID: 292)
      • 3568351.scr (PID: 13252)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • chrome.exe (PID: 4672)
      • hpzakXf.exe (PID: 8484)
      • chrome.exe (PID: 8768)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • tmp84F7_tmp.exe (PID: 8824)
      • chrome.exe (PID: 12660)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)

    • Manual execution by user

      • setup_x86_x64_install.exe (PID: 3452)
      • setup_x86_x64_install.exe (PID: 1388)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)

    • Checks Windows Trust Settings

      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09964f7c03.exe (PID: 2604)
      • iexplore.exe (PID: 2832)
      • installer.exe (PID: 5168)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 11540)
      • powershell.exe (PID: 9928)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • wscript.exe (PID: 13616)
      • hpzakXf.exe (PID: 8484)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)

    • Dropped object may contain Bitcoin addresses

      • Sat098ac2475eba09.exe (PID: 1948)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)

    • Application was dropped or rewritten from another process

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)

    • Loads dropped or rewritten executable

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)

    • Creates files in the program directory

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)

    • Creates a software uninstall entry

      • ultramediaburner.tmp (PID: 1704)

    • Changes internet zones settings

      • iexplore.exe (PID: 2764)

    • Creates files in the user directory

      • iexplore.exe (PID: 2832)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2832)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Check for Java to be installed

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
642
Monitored processes
437
Malicious processes
94
Suspicious processes
40

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp"C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
284C:\Users\admin\Documents\OX9JYS5qmRA4EdjjP5PCiJZA.exeC:\Users\admin\Documents\OX9JYS5qmRA4EdjjP5PCiJZA.exe
OX9JYS5qmRA4EdjjP5PCiJZA.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\documents\ox9jys5qmra4edjjp5pcijza.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
292"C:\Users\admin\AppData\Local\Temp\{tQsj-gMeFV-hlnn-vNX1x}\33231236756.exe" C:\Users\admin\AppData\Local\Temp\{tQsj-gMeFV-hlnn-vNX1x}\33231236756.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{tqsj-gmefv-hlnn-vnx1x}\33231236756.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
312"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
400C:\Windows\system32\cmd.exe /c Sat0914a238bae2.exe /mixoneC:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225477
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\7zs43fd7ad0\sat0914a238bae2.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
600/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=TrueC:\Windows\system32\cmd.exe—forfiles.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4184 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
768"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=TrueC:\Windows\System32\Wbem\WMIC.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
2147749902
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
828"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
Total events
585 861
Read events
581 838
Write events
3 956
Delete events
67

Modification events

(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
114
Suspicious files
80
Text files
134
Unknown types
149

Dropped files

PID
Process
Filename
Type
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-614F1111-D50.pma —
MD5:—
SHA256:—
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\0aa30825-c9c1-4d21-856d-163734d044b9.tmptext
MD5:1202FCD0945706CAC68EBBB6CCDFC2D2
SHA256:FABD834D27C7306E4325B98B1D35B7222DA0FE2016EC678CA1EC0D09AED27164
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:1202FCD0945706CAC68EBBB6CCDFC2D2
SHA256:FABD834D27C7306E4325B98B1D35B7222DA0FE2016EC678CA1EC0D09AED27164
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RFfd279.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\c5c19f89-7920-4c1f-94b1-63ae09cb4b14.tmpbinary
MD5:5058F1AF8388633F609CADB75A75DC9D
SHA256:CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.oldtext
MD5:5BD3C311F2136A7A88D3E197E55CF902
SHA256:FA331915E1797E59979A3E4BCC2BD0D3DEAA039B94D4DB992BE251FD02A224B9
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENTtext
MD5:46295CAC801E5D4857D09837238A6394
SHA256:0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\pkedcjkdefgpdelpbcmbmeomcjbeemfm\LOG.old~RFfd5b6.TMPtext
MD5:D0BA19096D6C8F8DE58312E8D938E893
SHA256:AADE90A7B0984F3C719D528E4E6FAE3854E28B30363BDD4DF65037E69784A078
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
197
TCP/UDP connections
471
DNS requests
193
Threats
436

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
chrome.exe
GET
302
18.237.46.89:80
http://18.237.46.89/?614f11180510c=c4e394d73d4c90664fde851cfc376696ebe73101Array&m=7&q=Ammyy%20Admin%203.10%20Crack%20%20%20Key%20Full%20Version&dedica=18&
US
html
19.0 Kb
unknown
2068
chrome.exe
GET
301
172.67.187.223:80
http://ljhjdh.xyz/?s=7&q=Ammyy+Admin+3.10+Crack+++Key+Full+Version&dedica=18&hmac=WyI1MDdmMzFiYzdmMzliNWIyMDkyMTAyYjVkNjNlZThkZDJiNzdhMTZkIiwiNTkzOTc4YWU4NmE1MWFlZDYzYmU5NjcwNzZlNmQ5NzY1MWQ4ZTA1MyIsIjlkZTMyOTMwMWQ0YThiODYwYTNlYzcwMmM5NjM0NTQxODUxY2ViNjQiLCIzMDBiZWE0ZjVlNjhjYTk3YzY1ZTk4MjdkYmE5YTQ0OGY5MjE0YzgzIiwiMzM3YjY5YjJiODY1NGI4MDAyMzVkNmM1MTMzZjgwZTlhZGU1NTdkYiIsIjRkMmNlMDgzMzNjNmYwMzA0ODAzNjUyZWRjY2RiMjQ3ODg0MmFlZTkiLCJlMjM5ZmM2MjJhMGM1YmQ2ZDZlZGNkNWU0NDI5ZGUxYmE1OWY0MmNlIiwiMTU5NWNlNjA1NDcwN2Q3MWQ5YjkyMjEyZDBkNWVlODYwMmYwNzk5MCIsIjQ0OTg4YjJkM2MxNGJhOTdjNDViYjliZWVhN2VjYTg2MWI4YjBkYzQiLCI4MjVlZDU3NWYwZWU3ODJjMzIwMDhkMjlhN2Y1NWYwZTE2OGI0NjUzIiwiZGI3NTQwOGI0YzNiMGYwYzczNWE0ZmEwM2Y0MTM1Y2JkY2QwYWQ2NSJd
US
—
—
malicious
2068
chrome.exe
GET
301
104.21.39.132:80
http://krmcean.xyz/?s=7&q=SpyHunter+5+Crack+%5BEmail+&dedica=18&hmac=WyJjN2Y0M2Q3MzAwZGE1OGUzZmQ1MmQyZGY1M2M5NGVmNDFmZGUzYmUzIiwiZjhmZjQ0ZDc2N2NmNTNkMDI4ZWQyNmU4YjE5MDE4Zjg5ZDA3YjQwMyIsIjhlZWJmMDUwMTIxMmMwNDIyZjI2MDc5ZjY4MGQxNmIyZjEwNDYwMzIiLCJkYTIxNWYwMTRmYWM5YjgwYWViZDY3YjhiNDQ0NjhiMThkM2M1Mzk1IiwiNGM2MzhhYzU3NDgzMmY1OTA1ZjhjNjQ4ODM5YjIzNzYxNTI2MDE5ZSIsIjZhODgxODFiYWFiODEzYjIyNmFkOTUyMTRjNzVhYzhiNTRkZjEwN2UiLCIxODAzNTZlYzY4MDFiMWU2NWRlOTY2MWE1MzIwYjVhNGVjNmI3ZTc5IiwiOTQ2NzNhNzdjYjNhYWFmYzc5N2RhZmJlNzA4NTRlM2UxMjhjYzE4MSIsIjhkYzYwN2UzMWI5MWExY2NiMDcwNGNmYjk1MTg5NjNmYjMyOTZlN2YiLCIzZjlkNDYyMDAyYTJmMWM1MWQ1OWIwYWY1Y2E2Y2Y1ZGE2Y2Y3M2YwIiwiNDIxZmE2MzUwYWI1NDBhYzQ0ZGRhY2E0YzMzNDg1Y2NlYWM4YmYwMCJd
US
—
—
malicious
2704
Sat0942d118661ebeaa8.exe
GET
200
37.0.8.119:80
http://37.0.8.119/base/api/statistics.php
NL
binary
96 b
malicious
2068
chrome.exe
GET
302
18.237.46.89:80
http://18.237.46.89/?614f112c991b2=afd9000f759b98c8ff000d8953fe153ff826b14bArray&m=7&q=SpyHunter%205%20Crack%20[Email%20&dedica=18&
US
html
19.0 Kb
unknown
2068
chrome.exe
GET
404
18.237.46.89:80
http://18.237.46.89/favicon.ico
US
html
548 b
unknown
2068
chrome.exe
GET
200
104.16.19.94:80
http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
US
text
6.71 Kb
whitelisted
2068
chrome.exe
GET
200
104.16.19.94:80
http://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
US
text
6.71 Kb
whitelisted
2068
chrome.exe
GET
200
104.16.19.94:80
http://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/css/bootstrap.min.css
US
text
20.4 Kb
whitelisted
2068
chrome.exe
POST
200
18.237.46.89:80
http://18.237.46.89/?go=a880512d1d5ae&dedica=18
US
html
694 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2068
chrome.exe
142.250.184.237:443
accounts.google.com
Google Inc.
US
suspicious
2068
chrome.exe
172.67.214.180:443
crackedpc.org
—
US
suspicious
2068
chrome.exe
192.0.76.3:443
stats.wp.com
Automattic, Inc
US
suspicious
2068
chrome.exe
142.250.186.36:443
www.google.com
Google Inc.
US
whitelisted
2068
chrome.exe
172.217.23.106:443
content-autofill.googleapis.com
Google Inc.
US
whitelisted
2068
chrome.exe
157.240.236.1:443
connect.facebook.net
—
US
unknown
2068
chrome.exe
192.0.77.37:443
c0.wp.com
Automattic, Inc
US
suspicious
2068
chrome.exe
35.190.80.1:443
a.nel.cloudflare.com
Google Inc.
US
suspicious
2068
chrome.exe
172.67.180.127:443
vbdhjtgve.xyz
—
US
unknown
2068
chrome.exe
192.0.77.2:443
i0.wp.com
Automattic, Inc
US
suspicious

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 216.58.212.142
  • 172.217.23.110
whitelisted
crackedpc.org
  • 172.67.214.180
  • 104.21.23.244
whitelisted
accounts.google.com
  • 142.250.184.237
  • 142.250.184.205
shared
www.google.com
  • 142.250.186.36
malicious
stats.wp.com
  • 192.0.76.3
whitelisted
vbdhjtgve.xyz
  • 172.67.180.127
  • 104.21.83.183
malicious
c0.wp.com
  • 192.0.77.37
whitelisted
content-autofill.googleapis.com
  • 172.217.23.106
whitelisted
connect.facebook.net
  • 157.240.236.1
whitelisted
i0.wp.com
  • 192.0.77.2
whitelisted

Threats

PID
Process
Class
Message
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3952
setup_install.exe
A Network Trojan was detected
AV TROJAN GCleaner Downloader CnC Activity
3952
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2704
Sat0942d118661ebeaa8.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
1908
Sat09127dfa8681ede0.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
199 ETPRO signatures available at the full report
Process
Message
lighteningplayer-cache-gen.exe
main libvlc debug: VLC media player - 3.0.7 Vetinari
lighteningplayer-cache-gen.exe
main libvlc debug: Copyright � 1996-2018 the VideoLAN team
lighteningplayer-cache-gen.exe
main libvlc debug: revision 3.0.2-225-gc9e3360dd4
lighteningplayer-cache-gen.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
lighteningplayer-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
lighteningplayer-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
lighteningplayer-cache-gen.exe
main libvlc debug: searching plug-in modules
lighteningplayer-cache-gen.exe
main libvlc debug: ignoring plugins cache file
lighteningplayer-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
lighteningplayer-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://crackedpc.org/ammyy-admin-crack-free-download/