URL:

https://crackedpc.org/ammyy-admin-crack-free-download/

Full analysis: https://app.any.run/tasks/38719fcd-39cf-415c-9fbd-732bd62af348
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 25, 2021, 12:07:33
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
trojan
loader
evasion
rat
redline
stealer
vidar
opendir
Indicators:
MD5:

EC592A2E154D44F18C4135E7315ACBF4

SHA1:

12F5F7E70FECD985CD50D0DDE5852F378FCA40E5

SHA256:

5E0BB31C5994B0BB8EB4E4F38EA22EA5394691F2FA8E6E52650223ECDDF54BEC

SSDEEP:

3:N8KhkzfN7OoAzFmn:2K6T5OdM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • setup_x86_x64_install.exe (PID: 3452)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • setup_install.exe (PID: 3952)
      • Sat0914a238bae2.exe (PID: 3320)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • 4388790.scr (PID: 3304)
      • WinHoster.exe (PID: 3456)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • ultramediaburner.exe (PID: 2816)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • UltraMediaBurner.exe (PID: 1744)
      • Install.exe (PID: 10004)
      • install.exe (PID: 9700)
      • gcleaner.exe (PID: 6696)
      • installer.exe (PID: 5168)
      • installer.exe (PID: 8736)
      • autosubplayer.exe (PID: 4020)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • Install.exe (PID: 10760)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • TUldbHb.exe (PID: 12036)
      • 33231236756.exe (PID: 292)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • Install.exe (PID: 5500)
      • Install.exe (PID: 6260)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)
      • 3568351.scr (PID: 13252)
      • 1970878.scr (PID: 2940)
      • 2694936.scr (PID: 12996)
      • 5268981.scr (PID: 5448)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • hpzakXf.exe (PID: 8484)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • Install.exe (PID: 6588)
      • Install.exe (PID: 11356)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • GEGcYbm.exe (PID: 5420)

    • Drops executable file immediately after starts

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)

    • Executes PowerShell scripts

      • cmd.exe (PID: 284)
      • cmd.exe (PID: 8996)

    • Loads dropped or rewritten executable

      • setup_install.exe (PID: 3952)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Changes settings of System certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Connects to CnC server

      • setup_install.exe (PID: 3952)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • md8_8eus.exe (PID: 9548)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • tmp84F7_tmp.exe (PID: 8824)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)

    • Actions looks like stealing of personal data

      • 4388790.scr (PID: 3304)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • 5027594.scr (PID: 8164)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • md8_8eus.exe (PID: 9548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • 45874656108.exe (PID: 8912)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • hpzakXf.exe (PID: 8484)
      • tmp84F7_tmp.exe (PID: 8824)

    • Stealing of credential data

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Changes the autorun value in the registry

      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • verism.exe (PID: 10956)

    • Disables Windows Defender

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Steals credentials from Web Browsers

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • md8_8eus.exe (PID: 9548)
      • hpzakXf.exe (PID: 8484)

    • REDLINE was detected

      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)

    • Loads the Task Scheduler COM API

      • MsiExec.exe (PID: 8128)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • installer.exe (PID: 5168)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 7336)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 11220)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6560)
      • schtasks.exe (PID: 11288)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 3092)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5364)
      • schtasks.exe (PID: 5136)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)

    • VIDAR was detected

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

    • Uses Task Scheduler to run other applications

      • Install.exe (PID: 10760)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • TUldbHb.exe (PID: 12036)
      • cmd.exe (PID: 10376)
      • Install.exe (PID: 6260)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • Install.exe (PID: 11356)
      • cmd.exe (PID: 5368)

    • Loads the Task Scheduler DLL interface

      • schtasks.exe (PID: 13608)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 7388)

    • Uses Task Scheduler to autorun other applications

      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • hpzakXf.exe (PID: 8484)

    • Runs app for hidden code execution

      • cmd.exe (PID: 11636)

    • Modifies exclusions in Windows Defender

      • reg.exe (PID: 3912)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 7560)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 14120)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 13984)

    • Modifies files in Chrome extension folder

      • hpzakXf.exe (PID: 8484)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2476)
      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • setup_install.exe (PID: 3952)
      • cmd.exe (PID: 2516)
      • powershell.exe (PID: 2864)
      • cmd.exe (PID: 284)
      • Sat095b4859b0823e.exe (PID: 2440)
      • cmd.exe (PID: 3080)
      • cmd.exe (PID: 3732)
      • cmd.exe (PID: 3608)
      • cmd.exe (PID: 2668)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • cmd.exe (PID: 3624)
      • cmd.exe (PID: 400)
      • cmd.exe (PID: 4036)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat0914a238bae2.exe (PID: 3320)
      • Sat093d607fbd.exe (PID: 1784)
      • cmd.exe (PID: 3852)
      • Sat09f20f74a817fc59.exe (PID: 3100)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • cmd.exe (PID: 2040)
      • EtalevzaJet.exe (PID: 2624)
      • 4388790.scr (PID: 3304)
      • 3307180.scr (PID: 1968)
      • LzmwAqmV.exe (PID: 2496)
      • WinHoster.exe (PID: 3456)
      • 6658114.scr (PID: 4088)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • UltraMediaBurner.exe (PID: 1744)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • cmd.exe (PID: 4812)
      • installer.exe (PID: 5168)
      • cmd.exe (PID: 10920)
      • Install.exe (PID: 10760)
      • install.exe (PID: 9700)
      • cmd.exe (PID: 9460)
      • Install.exe (PID: 10004)
      • cmd.exe (PID: 2068)
      • powershell.exe (PID: 11656)
      • cmd.exe (PID: 11944)
      • WMIC.exe (PID: 5916)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • cmd.exe (PID: 3680)
      • WMIC.exe (PID: 2320)
      • powershell.exe (PID: 4616)
      • gcleaner.exe (PID: 6696)
      • WMIC.exe (PID: 7412)
      • cmd.exe (PID: 6644)
      • cmd.exe (PID: 924)
      • autosubplayer.exe (PID: 4020)
      • powershell.exe (PID: 9928)
      • powershell.EXE (PID: 5584)
      • cmd.exe (PID: 9480)
      • installer.exe (PID: 8736)
      • ns72FD.tmp (PID: 9180)
      • ns79F4.tmp (PID: 11568)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 7569659.scr (PID: 6400)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • cmd.exe (PID: 8996)
      • nsA22B.tmp (PID: 9820)
      • 210921.exe (PID: 10700)
      • powershell.exe (PID: 9896)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • 249old.exe (PID: 9492)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • cmd.exe (PID: 8380)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • inst001.exe (PID: 8956)
      • md8_8eus.exe (PID: 9548)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • RegSvcs.exe (PID: 4352)
      • TUldbHb.exe (PID: 12036)
      • cmd.exe (PID: 11668)
      • powershell.exe (PID: 5312)
      • 2694936.scr (PID: 12996)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • WMIC.exe (PID: 13592)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • cmd.exe (PID: 13168)
      • 1970878.scr (PID: 2940)
      • WMIC.exe (PID: 4392)
      • powershell.exe (PID: 5076)
      • powershell.exe (PID: 1292)
      • 33231236756.exe (PID: 292)
      • Install.exe (PID: 5500)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • Install.exe (PID: 6260)
      • cmd.exe (PID: 6716)
      • WMIC.exe (PID: 13968)
      • powershell.exe (PID: 7356)
      • cmd.exe (PID: 8816)
      • 45874656108.exe (PID: 8912)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • WMIC.exe (PID: 12852)
      • cmd.exe (PID: 12700)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 6364)
      • 3568351.scr (PID: 13252)
      • cmd.exe (PID: 13660)
      • WMIC.exe (PID: 1892)
      • powershell.EXE (PID: 4280)
      • clipper)).exe (PID: 8224)
      • 1.exe (PID: 9584)
      • powershell.EXE (PID: 7740)
      • monns.exe (PID: 6208)
      • verism.exe (PID: 10956)
      • File.exe (PID: 6948)
      • cmd.exe (PID: 10056)
      • cmd.exe (PID: 11428)
      • cmd.exe (PID: 11636)
      • powershell.exe (PID: 6768)
      • Puo.exe.com (PID: 11260)
      • Puo.exe.com (PID: 11440)
      • cmd.exe (PID: 8668)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • cmd.exe (PID: 13244)
      • wscript.exe (PID: 13616)
      • cmd.exe (PID: 13516)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 5324)
      • WMIC.exe (PID: 8664)
      • powershell.exe (PID: 9588)
      • cmd.exe (PID: 8492)
      • WMIC.exe (PID: 5996)
      • powershell.exe (PID: 2340)
      • WMIC.exe (PID: 9344)
      • WMIC.exe (PID: 11416)
      • powershell.exe (PID: 5476)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 6156)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • cmd.exe (PID: 10376)
      • mshta.exe (PID: 12792)
      • cmd.exe (PID: 11464)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
      • mshta.exe (PID: 6444)
      • cmd.exe (PID: 4440)
      • Install.exe (PID: 6588)
      • tmp84F7_tmp.exe (PID: 6184)
      • Install.exe (PID: 11356)
      • cmd.exe (PID: 7064)
      • powershell.exe (PID: 7512)
      • WMIC.exe (PID: 4968)
      • powershell.exe (PID: 10244)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 12540)
      • tmp84F7_tmp.exe (PID: 8824)
      • WMIC.exe (PID: 3984)
      • powershell.exe (PID: 7624)
      • WMIC.exe (PID: 7744)
      • GEGcYbm.exe (PID: 5420)
      • cmd.exe (PID: 4752)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • WMIC.exe (PID: 8900)
      • powershell.exe (PID: 2876)
      • WMIC.exe (PID: 7180)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 10352)
      • powershell.exe (PID: 12372)
      • WMIC.exe (PID: 13680)
      • service.exe (PID: 14120)
      • cmd.exe (PID: 5368)
      • cmd.exe (PID: 11160)
      • cmd.exe (PID: 7496)

    • Reads the computer name

      • WinRAR.exe (PID: 2516)
      • WinRAR.exe (PID: 2132)
      • WinRAR.exe (PID: 2476)
      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • powershell.exe (PID: 2864)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • setup_install.exe (PID: 3952)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • 4388790.scr (PID: 3304)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • WinHoster.exe (PID: 3456)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • ultramediaburner.tmp (PID: 1704)
      • UltraMediaBurner.exe (PID: 1744)
      • Sat0914a238bae2.exe (PID: 3320)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • 7199766.scr (PID: 5300)
      • 5027594.scr (PID: 8164)
      • installer.exe (PID: 5168)
      • Install.exe (PID: 10760)
      • powershell.exe (PID: 11656)
      • WMIC.exe (PID: 5916)
      • powershell.exe (PID: 10784)
      • WMIC.exe (PID: 13372)
      • powershell.exe (PID: 13912)
      • WMIC.exe (PID: 2320)
      • powershell.exe (PID: 4616)
      • WMIC.exe (PID: 7412)
      • gcleaner.exe (PID: 6696)
      • autosubplayer.exe (PID: 4020)
      • powershell.EXE (PID: 5584)
      • installer.exe (PID: 8736)
      • powershell.exe (PID: 9928)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 6985381.scr (PID: 3704)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • 7569659.scr (PID: 6400)
      • powershell.exe (PID: 9896)
      • 249old.exe (PID: 9492)
      • 210921.exe (PID: 10700)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • md8_8eus.exe (PID: 9548)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • powershell.exe (PID: 5312)
      • TUldbHb.exe (PID: 12036)
      • WMIC.exe (PID: 13592)
      • 1970878.scr (PID: 2940)
      • 33231236756.exe (PID: 292)
      • WMIC.exe (PID: 4392)
      • 2694936.scr (PID: 12996)
      • powershell.exe (PID: 1292)
      • powershell.exe (PID: 5076)
      • WMIC.exe (PID: 768)
      • powershell.exe (PID: 4332)
      • WMIC.exe (PID: 13968)
      • powershell.exe (PID: 7356)
      • Install.exe (PID: 6260)
      • WMIC.exe (PID: 4940)
      • powershell.exe (PID: 8628)
      • WMIC.exe (PID: 12852)
      • WMIC.exe (PID: 3916)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • 5268981.scr (PID: 5448)
      • 3568351.scr (PID: 13252)
      • 45874656108.exe (PID: 8912)
      • WMIC.exe (PID: 1892)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • clipper)).exe (PID: 8224)
      • 1.exe (PID: 9584)
      • powershell.EXE (PID: 7740)
      • monns.exe (PID: 6208)
      • File.exe (PID: 6948)
      • Puo.exe.com (PID: 11440)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
      • powershell.exe (PID: 6768)
      • wscript.exe (PID: 13616)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 5324)
      • WMIC.exe (PID: 8664)
      • powershell.exe (PID: 9588)
      • WMIC.exe (PID: 5996)
      • WMIC.exe (PID: 9344)
      • powershell.exe (PID: 2340)
      • WMIC.exe (PID: 11416)
      • powershell.exe (PID: 5476)
      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • mshta.exe (PID: 12792)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • RegSvcs.exe (PID: 4352)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • Y1FUY5TJK7FR.EXE (PID: 3096)
      • mshta.exe (PID: 6444)
      • tmp84F7_tmp.exe (PID: 6184)
      • Install.exe (PID: 11356)
      • powershell.exe (PID: 7512)
      • WMIC.exe (PID: 4968)
      • powershell.exe (PID: 10244)
      • WMIC.exe (PID: 5132)
      • powershell.exe (PID: 12540)
      • tmp84F7_tmp.exe (PID: 8824)
      • WMIC.exe (PID: 3984)
      • 8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
      • powershell.exe (PID: 7624)
      • WMIC.exe (PID: 7744)
      • GEGcYbm.exe (PID: 5420)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • WMIC.exe (PID: 8900)
      • WMIC.exe (PID: 7180)
      • powershell.exe (PID: 2876)
      • WMIC.exe (PID: 10352)
      • powershell.exe (PID: 12372)
      • powershell.exe (PID: 5856)
      • WMIC.exe (PID: 13680)
      • service.exe (PID: 14120)

    • Application launched itself

      • WinRAR.exe (PID: 2132)
      • msiexec.exe (PID: 8296)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
      • EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
      • cmd.exe (PID: 11636)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • Puo.exe.com (PID: 11260)
      • FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
      • tmp84F7_tmp.exe (PID: 6184)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3732)
      • setup_x86_x64_install.exe (PID: 1388)
      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • LzmwAqmV.exe (PID: 2496)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Install.exe (PID: 10760)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file that was compiled in debug mode

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • Sat09964f7c03.exe (PID: 2604)
      • Lapenyvove.exe (PID: 2224)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with a compile date too recent

      • setup_installer.exe (PID: 3892)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • EtalevzaJet.exe (PID: 2624)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Drops a file with too old compile date

      • setup_installer.exe (PID: 3892)
      • Sat09127dfa8681ede0.exe (PID: 1468)
      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.exe (PID: 2816)
      • ultramediaburner.tmp (PID: 1704)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Starts CMD.EXE for commands execution

      • setup_install.exe (PID: 3952)
      • Lapenyvove.exe (PID: 2224)
      • Sat09964f7c03.exe (PID: 2604)
      • Install.exe (PID: 10760)
      • forfiles.exe (PID: 11360)
      • forfiles.exe (PID: 5432)
      • forfiles.exe (PID: 13708)
      • forfiles.exe (PID: 4068)
      • forfiles.exe (PID: 10584)
      • forfiles.exe (PID: 10884)
      • nsA22B.tmp (PID: 9820)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • TUldbHb.exe (PID: 12036)
      • forfiles.exe (PID: 12232)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • forfiles.exe (PID: 6880)
      • forfiles.exe (PID: 4760)
      • forfiles.exe (PID: 6940)
      • Install.exe (PID: 6260)
      • forfiles.exe (PID: 10224)
      • forfiles.exe (PID: 11180)
      • forfiles.exe (PID: 12584)
      • forfiles.exe (PID: 6176)
      • forfiles.exe (PID: 5896)
      • clipper)).exe (PID: 8224)
      • verism.exe (PID: 10956)
      • cmd.exe (PID: 11636)
      • 45874656108.exe (PID: 8912)
      • forfiles.exe (PID: 14072)
      • hpzakXf.exe (PID: 8484)
      • forfiles.exe (PID: 8792)
      • forfiles.exe (PID: 7768)
      • forfiles.exe (PID: 10800)
      • forfiles.exe (PID: 11364)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)
      • Install.exe (PID: 11356)
      • forfiles.exe (PID: 3028)
      • forfiles.exe (PID: 10148)
      • forfiles.exe (PID: 6324)
      • forfiles.exe (PID: 12836)
      • forfiles.exe (PID: 4268)
      • forfiles.exe (PID: 4296)
      • GEGcYbm.exe (PID: 5420)
      • forfiles.exe (PID: 9532)
      • forfiles.exe (PID: 12056)
      • forfiles.exe (PID: 10116)
      • forfiles.exe (PID: 12856)
      • service.exe (PID: 14120)

    • Reads the date of Windows installation

      • powershell.exe (PID: 2864)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 4616)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 5312)
      • powershell.exe (PID: 1292)
      • powershell.exe (PID: 5076)
      • powershell.exe (PID: 4332)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 5324)
      • powershell.exe (PID: 9588)
      • powershell.exe (PID: 2340)
      • powershell.exe (PID: 5476)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 12372)
      • powershell.exe (PID: 5856)

    • Creates files in the user directory

      • powershell.exe (PID: 2864)
      • Sat098ac2475eba09.exe (PID: 1948)
      • 3307180.scr (PID: 1968)
      • installer.exe (PID: 5168)
      • powershell.exe (PID: 11656)
      • powershell.exe (PID: 10784)
      • powershell.exe (PID: 13912)
      • powershell.exe (PID: 4616)
      • autosubplayer.exe (PID: 4020)
      • powershell.EXE (PID: 5584)
      • powershell.exe (PID: 9928)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • powershell.exe (PID: 9896)
      • powershell.exe (PID: 7356)
      • powershell.exe (PID: 8628)
      • powershell.exe (PID: 11684)
      • powershell.exe (PID: 6364)
      • powershell.EXE (PID: 4280)
      • 60248097993.exe (PID: 6284)
      • powershell.EXE (PID: 7740)
      • powershell.exe (PID: 6768)
      • hpzakXf.exe (PID: 8484)
      • powershell.exe (PID: 7512)
      • powershell.exe (PID: 10244)
      • powershell.exe (PID: 12540)
      • powershell.exe (PID: 7624)
      • powershell.exe (PID: 7116)
      • powershell.EXE (PID: 8864)
      • powershell.exe (PID: 2876)
      • powershell.exe (PID: 5856)
      • powershell.exe (PID: 12372)

    • Reads Environment values

      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat098ac2475eba09.exe (PID: 1948)
      • EtalevzaJet.exe (PID: 2624)
      • 4388790.scr (PID: 3304)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • Sat095b4859b0823e.exe (PID: 2440)
      • Sat09964f7c03.exe (PID: 2604)
      • 6658114.scr (PID: 4088)
      • installer.exe (PID: 5168)
      • 5027594.scr (PID: 8164)
      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
      • 7199766.scr (PID: 5300)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • 7569659.scr (PID: 6400)
      • powershell.exe (PID: 9896)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 210921.exe (PID: 10700)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • 1970878.scr (PID: 2940)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • 45874656108.exe (PID: 8912)
      • 3568351.scr (PID: 13252)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • tmp84F7_tmp.exe (PID: 8824)

    • Reads the Windows organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)

    • Reads Windows owner or organization settings

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)
      • installer.exe (PID: 5168)
      • msiexec.exe (PID: 8296)
      • pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)

    • Adds / modifies Windows certificates

      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

    • Starts application with an unusual extension

      • Sat098ac2475eba09.exe (PID: 1948)
      • autosubplayer.exe (PID: 4020)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
      • cmd.exe (PID: 11428)
      • Puo.exe.com (PID: 11260)

    • Starts itself from another location

      • 3307180.scr (PID: 1968)
      • install.exe (PID: 9700)
      • BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
      • DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)

    • Reads the cookies of Mozilla Firefox

      • 4388790.scr (PID: 3304)
      • md8_8eus.exe (PID: 9548)

    • Searches for installed software

      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 5027594.scr (PID: 8164)
      • 6658114.scr (PID: 4088)
      • 7199766.scr (PID: 5300)
      • 7569659.scr (PID: 6400)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 210921.exe (PID: 10700)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • 3568351.scr (PID: 13252)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 2694936.scr (PID: 12996)
      • 1.exe (PID: 9584)
      • 5268981.scr (PID: 5448)
      • monns.exe (PID: 6208)
      • tmp84F7_tmp.exe (PID: 8824)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

    • Creates a directory in Program Files

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)
      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Checks for external IP

      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

    • Creates files in the program directory

      • Sat09964f7c03.exe (PID: 2604)
      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • lighteningplayer-cache-gen.exe (PID: 10828)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • md8_8eus.exe (PID: 9548)
      • File.exe (PID: 6948)
      • hpzakXf.exe (PID: 8484)

    • Starts Internet Explorer

      • SHubekuxosi.exe (PID: 2508)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 2832)
      • powershell.exe (PID: 9896)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Reads CPU info

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)
      • 60248097993.exe (PID: 6284)

    • Executed as Windows Service

      • msiexec.exe (PID: 8296)

    • Starts Microsoft Installer

      • installer.exe (PID: 5168)

    • Starts CMD.EXE for self-deleting

      • Sat09964f7c03.exe (PID: 2604)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • 45874656108.exe (PID: 8912)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 10920)
      • MsiExec.exe (PID: 11540)
      • cmd.exe (PID: 8380)
      • cmd.exe (PID: 13660)
      • cmd.exe (PID: 11464)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 8296)
      • autosubplayer.exe (PID: 4020)
      • kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
      • hpzakXf.exe (PID: 8484)

    • Executes PowerShell scripts

      • cmd.exe (PID: 11588)
      • cmd.exe (PID: 12144)
      • cmd.exe (PID: 13832)
      • cmd.exe (PID: 4208)
      • ns72FD.tmp (PID: 9180)
      • cmd.exe (PID: 6580)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7084)
      • cmd.exe (PID: 9892)
      • cmd.exe (PID: 11468)
      • cmd.exe (PID: 3336)
      • IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
      • cmd.exe (PID: 600)
      • cmd.exe (PID: 8592)
      • cmd.exe (PID: 10916)
      • cmd.exe (PID: 11872)
      • cmd.exe (PID: 10368)
      • cmd.exe (PID: 9128)
      • cmd.exe (PID: 2440)
      • cmd.exe (PID: 14052)
      • cmd.exe (PID: 11988)
      • cmd.exe (PID: 6904)
      • cmd.exe (PID: 12712)
      • cmd.exe (PID: 3744)

    • Executes application which crashes

      • cmd.exe (PID: 11944)
      • cmd.exe (PID: 3680)
      • 60248097993.exe (PID: 6284)

    • Uses REG.EXE to modify Windows registry

      • cmd.exe (PID: 11068)
      • cmd.exe (PID: 11504)
      • cmd.exe (PID: 6464)
      • cmd.exe (PID: 7064)
      • cmd.exe (PID: 8668)
      • cmd.exe (PID: 13516)
      • wscript.exe (PID: 13616)
      • cmd.exe (PID: 6156)
      • cmd.exe (PID: 7616)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 3520)
      • cmd.exe (PID: 11160)
      • cmd.exe (PID: 7496)

    • Executed via Task Scheduler

      • powershell.EXE (PID: 5584)
      • TUldbHb.exe (PID: 12036)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • hpzakXf.exe (PID: 8484)
      • rundll32.EXE (PID: 7252)
      • GEGcYbm.exe (PID: 5420)
      • powershell.EXE (PID: 8864)
      • service.exe (PID: 14120)
      • chrome.exe (PID: 3492)

    • PowerShell script executed

      • powershell.EXE (PID: 5584)
      • powershell.EXE (PID: 4280)
      • powershell.EXE (PID: 7740)
      • powershell.EXE (PID: 8864)

    • Creates files in the Windows directory

      • schtasks.exe (PID: 13608)
      • cmd.exe (PID: 13244)
      • TUldbHb.exe (PID: 12036)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6504)
      • hpzakXf.exe (PID: 8484)
      • schtasks.exe (PID: 9992)

    • Reads the cookies of Google Chrome

      • md8_8eus.exe (PID: 9548)

    • Reads mouse settings

      • Puo.exe.com (PID: 11260)
      • Puo.exe.com (PID: 11440)

    • Executes scripts

      • TUldbHb.exe (PID: 12036)

    • Removes files from Windows directory

      • TUldbHb.exe (PID: 12036)

    • Starts MSHTA.EXE for opening HTA or HTMLS files

      • 9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Uses RUNDLL32.EXE to load library

      • Y1FUY5TJK7FR.EXE (PID: 3096)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3492)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 3852)
      • chrome.exe (PID: 2768)
      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3040)
      • chrome.exe (PID: 3188)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 1012)
      • chrome.exe (PID: 3624)
      • chrome.exe (PID: 2392)
      • chrome.exe (PID: 2496)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 2952)
      • chrome.exe (PID: 828)
      • chrome.exe (PID: 1596)
      • chrome.exe (PID: 2544)
      • chrome.exe (PID: 2380)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 3112)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 3152)
      • NOTEPAD.EXE (PID: 3908)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 2828)
      • msiexec.exe (PID: 9308)
      • taskkill.exe (PID: 11180)
      • MsiExec.exe (PID: 11540)
      • timeout.exe (PID: 11808)
      • taskkill.exe (PID: 12312)
      • MsiExec.exe (PID: 8128)
      • forfiles.exe (PID: 11360)
      • cmd.exe (PID: 11588)
      • ntvdm.exe (PID: 12348)
      • forfiles.exe (PID: 5432)
      • cmd.exe (PID: 12144)
      • forfiles.exe (PID: 13708)
      • cmd.exe (PID: 13832)
      • ntvdm.exe (PID: 2304)
      • forfiles.exe (PID: 4068)
      • cmd.exe (PID: 4208)
      • forfiles.exe (PID: 10584)
      • cmd.exe (PID: 11068)
      • forfiles.exe (PID: 10884)
      • reg.exe (PID: 11264)
      • cmd.exe (PID: 11504)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • reg.exe (PID: 11660)
      • gpupdate.exe (PID: 7080)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 13608)
      • timeout.exe (PID: 7600)
      • taskkill.exe (PID: 2240)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • forfiles.exe (PID: 12232)
      • cmd.exe (PID: 6580)
      • forfiles.exe (PID: 6880)
      • cmd.exe (PID: 5564)
      • cmd.exe (PID: 7912)
      • cmd.exe (PID: 7660)
      • forfiles.exe (PID: 4760)
      • forfiles.exe (PID: 6940)
      • cmd.exe (PID: 7084)
      • cmd.exe (PID: 9892)
      • forfiles.exe (PID: 10224)
      • forfiles.exe (PID: 11180)
      • cmd.exe (PID: 11468)
      • cmd.exe (PID: 3336)
      • forfiles.exe (PID: 12584)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 2996)
      • schtasks.exe (PID: 4420)
      • cmd.exe (PID: 6464)
      • reg.exe (PID: 5948)
      • forfiles.exe (PID: 5896)
      • forfiles.exe (PID: 6176)
      • cmd.exe (PID: 7064)
      • reg.exe (PID: 7056)
      • gpupdate.exe (PID: 9476)
      • schtasks.exe (PID: 11220)
      • ntvdm.exe (PID: 5632)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • gpupdate.exe (PID: 2996)
      • dllhost.exe (PID: 11264)
      • timeout.exe (PID: 10320)
      • findstr.exe (PID: 11432)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • reg.exe (PID: 3912)
      • forfiles.exe (PID: 14072)
      • reg.exe (PID: 7708)
      • reg.exe (PID: 7560)
      • reg.exe (PID: 3504)
      • reg.exe (PID: 13872)
      • reg.exe (PID: 2552)
      • reg.exe (PID: 4292)
      • reg.exe (PID: 13620)
      • reg.exe (PID: 960)
      • reg.exe (PID: 4480)
      • reg.exe (PID: 3640)
      • reg.exe (PID: 6884)
      • reg.exe (PID: 8292)
      • reg.exe (PID: 2452)
      • reg.exe (PID: 13984)
      • reg.exe (PID: 14120)
      • reg.exe (PID: 2936)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6560)
      • reg.exe (PID: 8072)
      • forfiles.exe (PID: 7768)
      • cmd.exe (PID: 600)
      • forfiles.exe (PID: 8792)
      • cmd.exe (PID: 8592)
      • forfiles.exe (PID: 10800)
      • cmd.exe (PID: 10916)
      • cmd.exe (PID: 11872)
      • forfiles.exe (PID: 11364)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 9736)
      • chrome.exe (PID: 11468)
      • chrome.exe (PID: 10780)
      • chrome.exe (PID: 5176)
      • chrome.exe (PID: 12816)
      • chrome.exe (PID: 1040)
      • chrome.exe (PID: 4692)
      • chrome.exe (PID: 4628)
      • schtasks.exe (PID: 11288)
      • chrome.exe (PID: 13728)
      • chrome.exe (PID: 12504)
      • schtasks.exe (PID: 5828)
      • reg.exe (PID: 6576)
      • reg.exe (PID: 2428)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 9504)
      • chrome.exe (PID: 11120)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 10848)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 10992)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 4340)
      • taskkill.exe (PID: 8120)
      • chrome.exe (PID: 1144)
      • chrome.exe (PID: 7772)
      • chrome.exe (PID: 4688)
      • rundll32.exe (PID: 12176)
      • forfiles.exe (PID: 3028)
      • cmd.exe (PID: 10368)
      • forfiles.exe (PID: 10148)
      • cmd.exe (PID: 9128)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • forfiles.exe (PID: 6324)
      • cmd.exe (PID: 2440)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • forfiles.exe (PID: 12836)
      • cmd.exe (PID: 14052)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • forfiles.exe (PID: 4268)
      • forfiles.exe (PID: 4296)
      • cmd.exe (PID: 7728)
      • reg.exe (PID: 4600)
      • cmd.exe (PID: 3520)
      • reg.exe (PID: 8212)
      • schtasks.exe (PID: 9992)
      • schtasks.exe (PID: 3092)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • forfiles.exe (PID: 9532)
      • cmd.exe (PID: 11988)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • forfiles.exe (PID: 10116)
      • cmd.exe (PID: 6904)
      • gpupdate.exe (PID: 9340)
      • forfiles.exe (PID: 12056)
      • cmd.exe (PID: 12712)
      • forfiles.exe (PID: 12856)
      • cmd.exe (PID: 3744)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 7968)
      • chrome.exe (PID: 3492)
      • schtasks.exe (PID: 5136)
      • chrome.exe (PID: 4336)
      • schtasks.exe (PID: 5364)
      • chrome.exe (PID: 9096)
      • chrome.exe (PID: 4332)
      • chrome.exe (PID: 5800)
      • chrome.exe (PID: 13424)
      • chrome.exe (PID: 6420)
      • chrome.exe (PID: 13704)
      • chrome.exe (PID: 2672)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 12660)
      • reg.exe (PID: 9188)
      • reg.exe (PID: 10796)
      • schtasks.exe (PID: 9108)
      • chrome.exe (PID: 964)
      • chrome.exe (PID: 312)
      • chrome.exe (PID: 8516)
      • schtasks.exe (PID: 7380)
      • chrome.exe (PID: 13264)
      • chrome.exe (PID: 696)
      • chrome.exe (PID: 612)
      • chrome.exe (PID: 4404)
      • chrome.exe (PID: 12332)
      • chrome.exe (PID: 11864)
      • chrome.exe (PID: 12228)
      • chrome.exe (PID: 13820)
      • chrome.exe (PID: 924)
      • chrome.exe (PID: 10644)
      • chrome.exe (PID: 4340)

    • Application launched itself

      • chrome.exe (PID: 3408)
      • iexplore.exe (PID: 2764)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 3492)

    • Reads the computer name

      • chrome.exe (PID: 1192)
      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 4068)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3816)
      • chrome.exe (PID: 4032)
      • chrome.exe (PID: 2384)
      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)
      • iexplore.exe (PID: 2832)
      • msiexec.exe (PID: 8296)
      • msiexec.exe (PID: 9308)
      • taskkill.exe (PID: 11180)
      • MsiExec.exe (PID: 2828)
      • taskkill.exe (PID: 12312)
      • MsiExec.exe (PID: 8128)
      • MsiExec.exe (PID: 11540)
      • schtasks.exe (PID: 4324)
      • schtasks.exe (PID: 5020)
      • gpupdate.exe (PID: 7080)
      • schtasks.exe (PID: 13916)
      • schtasks.exe (PID: 13608)
      • taskkill.exe (PID: 2240)
      • schtasks.exe (PID: 6948)
      • schtasks.exe (PID: 7336)
      • taskkill.exe (PID: 14216)
      • schtasks.exe (PID: 4420)
      • schtasks.exe (PID: 2996)
      • gpupdate.exe (PID: 9476)
      • schtasks.exe (PID: 11220)
      • schtasks.exe (PID: 13976)
      • schtasks.exe (PID: 14092)
      • gpupdate.exe (PID: 2996)
      • PING.EXE (PID: 10820)
      • schtasks.exe (PID: 8256)
      • schtasks.exe (PID: 6424)
      • schtasks.exe (PID: 6560)
      • chrome.exe (PID: 11468)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 1040)
      • schtasks.exe (PID: 5828)
      • schtasks.exe (PID: 11288)
      • schtasks.exe (PID: 5284)
      • schtasks.exe (PID: 6504)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 9912)
      • chrome.exe (PID: 2492)
      • chrome.exe (PID: 8768)
      • taskkill.exe (PID: 8120)
      • schtasks.exe (PID: 10724)
      • schtasks.exe (PID: 11316)
      • schtasks.exe (PID: 8748)
      • schtasks.exe (PID: 12488)
      • schtasks.exe (PID: 9132)
      • schtasks.exe (PID: 1628)
      • schtasks.exe (PID: 7724)
      • schtasks.exe (PID: 9992)
      • rundll32.EXE (PID: 7252)
      • schtasks.exe (PID: 3092)
      • schtasks.exe (PID: 5644)
      • schtasks.exe (PID: 13352)
      • schtasks.exe (PID: 10848)
      • schtasks.exe (PID: 6660)
      • schtasks.exe (PID: 11764)
      • gpupdate.exe (PID: 9340)
      • schtasks.exe (PID: 2692)
      • schtasks.exe (PID: 8088)
      • schtasks.exe (PID: 5364)
      • chrome.exe (PID: 3492)
      • schtasks.exe (PID: 7968)
      • schtasks.exe (PID: 5136)
      • chrome.exe (PID: 10048)
      • chrome.exe (PID: 12660)
      • schtasks.exe (PID: 7380)
      • schtasks.exe (PID: 9108)
      • chrome.exe (PID: 2672)
      • schtasks.exe (PID: 7132)

    • Reads the hosts file

      • chrome.exe (PID: 3408)
      • chrome.exe (PID: 2068)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 4672)
      • chrome.exe (PID: 1120)
      • chrome.exe (PID: 8768)
      • chrome.exe (PID: 12660)
      • chrome.exe (PID: 3492)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2068)
      • Sat098ac2475eba09.exe (PID: 1948)
      • Sat09cd7ecbe4e.exe (PID: 3900)
      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • EtalevzaJet.exe (PID: 2624)
      • 4388790.scr (PID: 3304)
      • Sat09964f7c03.exe (PID: 2604)
      • SHubekuxosi.exe (PID: 2508)
      • Lapenyvove.exe (PID: 2224)
      • iexplore.exe (PID: 2832)
      • Sat095b4859b0823e.exe (PID: 2440)
      • 6658114.scr (PID: 4088)
      • installer.exe (PID: 5168)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 8296)
      • 5027594.scr (PID: 8164)
      • MsiExec.exe (PID: 11540)
      • 7199766.scr (PID: 5300)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • 7569659.scr (PID: 6400)
      • powershell.exe (PID: 9896)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
      • 210921.exe (PID: 10700)
      • md8_8eus.exe (PID: 9548)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
      • 0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
      • 1970878.scr (PID: 2940)
      • Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
      • hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
      • Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
      • 2694936.scr (PID: 12996)
      • _wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
      • 33231236756.exe (PID: 292)
      • 3568351.scr (PID: 13252)
      • 60248097993.exe (PID: 6284)
      • 5268981.scr (PID: 5448)
      • 1.exe (PID: 9584)
      • monns.exe (PID: 6208)
      • chrome.exe (PID: 4672)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • hpzakXf.exe (PID: 8484)
      • chrome.exe (PID: 8768)
      • Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
      • tmp84F7_tmp.exe (PID: 8824)
      • chrome.exe (PID: 12660)

    • Reads the date of Windows installation

      • chrome.exe (PID: 3152)
      • iexplore.exe (PID: 2764)

    • Manual execution by user

      • setup_x86_x64_install.exe (PID: 3452)
      • setup_x86_x64_install.exe (PID: 1388)
      • chrome.exe (PID: 3220)
      • chrome.exe (PID: 1120)

    • Checks Windows Trust Settings

      • Sat093d607fbd.exe (PID: 1784)
      • Sat0942d118661ebeaa8.exe (PID: 2704)
      • Sat09964f7c03.exe (PID: 2604)
      • iexplore.exe (PID: 2832)
      • installer.exe (PID: 5168)
      • iexplore.exe (PID: 2764)
      • msiexec.exe (PID: 8296)
      • MsiExec.exe (PID: 11540)
      • powershell.exe (PID: 9928)
      • 4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
      • 2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
      • NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
      • qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
      • wscript.exe (PID: 13616)
      • 7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
      • hpzakXf.exe (PID: 8484)

    • Application was dropped or rewritten from another process

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)

    • Dropped object may contain Bitcoin addresses

      • Sat098ac2475eba09.exe (PID: 1948)
      • z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)

    • Loads dropped or rewritten executable

      • Sat09127dfa8681ede0.tmp (PID: 1908)
      • ultramediaburner.tmp (PID: 1704)

    • Creates files in the program directory

      • EtalevzaJet.exe (PID: 2624)
      • ultramediaburner.tmp (PID: 1704)

    • Creates a software uninstall entry

      • ultramediaburner.tmp (PID: 1704)

    • Changes internet zones settings

      • iexplore.exe (PID: 2764)

    • Creates files in the user directory

      • iexplore.exe (PID: 2832)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2832)
      • mshta.exe (PID: 12792)
      • mshta.exe (PID: 6444)

    • Check for Java to be installed

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)

    • Reads Microsoft Office registry keys

      • MsiExec.exe (PID: 2828)
      • MsiExec.exe (PID: 11540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
642
Monitored processes
437
Malicious processes
94
Suspicious processes
40

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start download and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs chrome.exe no specs winrar.exe no specs notepad.exe no specs winrar.exe no specs winrar.exe setup_x86_x64_install.exe no specs setup_x86_x64_install.exe setup_installer.exe setup_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sat09cd7ecbe4e.exe #REDLINE sat095b4859b0823e.exe cmd.exe no specs cmd.exe no specs sat09127dfa8681ede0.exe cmd.exe no specs sat098ac2475eba09.exe cmd.exe no specs sat093d607fbd.exe sat09f20f74a817fc59.exe sat0914a238bae2.exe #VIDAR sat09964f7c03.exe sat0942d118661ebeaa8.exe sat09127dfa8681ede0.tmp etalevzajet.exe 4388790.scr lzmwaqmv.exe 3307180.scr winhoster.exe no specs #REDLINE 6658114.scr ultramediaburner.exe ultramediaburner.tmp ultramediaburner.exe no specs shubekuxosi.exe lapenyvove.exe iexplore.exe iexplore.exe #REDLINE 7199766.scr 5027594.scr cmd.exe no specs installer.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs cmd.exe no specs taskkill.exe no specs msiexec.exe timeout.exe no specs taskkill.exe no specs msiexec.exe no specs cmd.exe no specs install.exe no specs install.exe no specs install.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs ntvdm.exe wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs ntvdm.exe forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs cmd.exe no specs gcleaner.exe forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs autosubplayer.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs gpupdate.exe no specs cmd.exe no specs installer.exe no specs ns72fd.tmp no specs powershell.exe no specs ns79f4.tmp no specs lighteningplayer-cache-gen.exe euzsb_bjurtcdp6kqs2wkbp5.exe no specs ox9jys5qmra4edjjp5pcijza.exe no specs #REDLINE ox9jys5qmra4edjjp5pcijza.exe noa5rq9gjz9fn7lw27xwjwjw.exe z8uf9bjp_axpsqti78ukbx2c.exe #VIDAR 2lpsnf_krteguli6fizw2wzf.exe euzsb_bjurtcdp6kqs2wkbp5.exe no specs z9pg6mcdby8d3vse11c1atjo.exe 7569659.scr 6985381.scr no specs 4t_yeqfda0nbyaglcztvlciu.exe qf78g1sahkxt44nnbtmpu81z.exe no specs nsa22b.tmp no specs cmd.exe no specs #REDLINE 210921.exe 249old.exe powershell.exe iyzn0cpcfs0nsq3scm46cox_.exe no specs schtasks.exe no specs schtasks.exe no specs #REDLINE djclxhxqzducgquw8kbgdpv5.exe #REDLINE 0z3pord1tua6orxeylbftu7w.exe cmd.exe no specs taskkill.exe no specs timeout.exe no specs pklom0fhgofdrsgp96rofqju.exe no specs #REDLINE y9ftciyuv8_r8ww73ekprvox.exe khgadhafx5fqt6outvp7_foc.exe no specs qt3dwybp7zsuorww4zcubjl6.exe schtasks.exe no specs schtasks.exe no specs inst001.exe no specs md8_8eus.exe 7yk9wuyh89zhvxf_xvv51ua7.exe #REDLINE hu_ubw8xekvulegr_i9oqfoh.exe _wrr_3qx3wu3x4k5kimithoc.exe no specs #REDLINE _wrr_3qx3wu3x4k5kimithoc.exe regsvcs.exe no specs tuldbhb.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs #REDLINE 2694936.scr cmd.exe no specs #REDLINE 33231236756.exe 1970878.scr wmic.exe no specs bjas93ow5clri8rnmwfw9oae.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs install.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs install.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs cmd.exe no specs 45874656108.exe wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs cmd.exe no specs wmic.exe no specs 60248097993.exe #REDLINE 5268981.scr forfiles.exe no specs cmd.exe no specs powershell.exe no specs 3568351.scr cmd.exe no specs taskkill.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs gpupdate.exe no specs clipper)).exe no specs #REDLINE 1.exe cmd.exe no specs schtasks.exe no specs ntvdm.exe no specs schtasks.exe no specs schtasks.exe no specs powershell.exe no specs #REDLINE monns.exe gpupdate.exe no specs file.exe no specs cmd.exe no specs timeout.exe no specs verism.exe dllhost.exe no specs cmd.exe no specs cmd.exe no specs findstr.exe no specs ping.exe no specs puo.exe.com no specs puo.exe.com no specs powershell.exe no specs iyzn0cpcfs0nsq3scm46cox_.exe schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs wscript.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs hpzakxf.exe cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs chrome.exe chrome.exe no specs 8tencntk3p2acyomkhft29uc.exe jnomgixrx3rzeus304ojesew.exe fnrsm2t4ilbsb_sjgtk07nuj.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs 9ywba4j7t4d6vrc6bbnwaprt.exe no specs fnrsm2t4ilbsb_sjgtk07nuj.exe no specs mshta.exe no specs 7hukpthyi7hchmi4pxcd6eqq.exe mjx3l73uw0re3b2iyze4pyjm.exe chrome.exe no specs chrome.exe no specs cmd.exe no specs chrome.exe no specs y1fuy5tjk7fr.exe no specs taskkill.exe no specs mshta.exe no specs chrome.exe no specs chrome.exe no specs cmd.exe no specs drbvaw4sceaymhzxhbakps6l.exe no specs rundll32.exe no specs install.exe no specs tmp84f7_tmp.exe no specs #REDLINE tmp84f7_tmp.exe install.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs schtasks.exe no specs schtasks.exe no specs wmic.exe no specs schtasks.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs schtasks.exe no specs wmic.exe no specs schtasks.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs forfiles.exe no specs forfiles.exe no specs cmd.exe no specs cmd.exe no specs reg.exe no specs reg.exe no specs schtasks.exe no specs schtasks.exe no specs rundll32.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs gegcybm.exe no specs cmd.exe no specs forfiles.exe no specs cmd.exe no specs schtasks.exe no specs powershell.exe no specs schtasks.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs gpupdate.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs forfiles.exe no specs cmd.exe no specs powershell.exe no specs wmic.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs service.exe no specs schtasks.exe no specs cmd.exe no specs chrome.exe chrome.exe no specs schtasks.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs schtasks.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs schtasks.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
284C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\admin\AppData\Local\Temp"C:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
284C:\Users\admin\Documents\OX9JYS5qmRA4EdjjP5PCiJZA.exeC:\Users\admin\Documents\OX9JYS5qmRA4EdjjP5PCiJZA.exe
OX9JYS5qmRA4EdjjP5PCiJZA.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\documents\ox9jys5qmra4edjjp5pcijza.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
292"C:\Users\admin\AppData\Local\Temp\{tQsj-gMeFV-hlnn-vNX1x}\33231236756.exe" C:\Users\admin\AppData\Local\Temp\{tQsj-gMeFV-hlnn-vNX1x}\33231236756.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{tqsj-gmefv-hlnn-vnx1x}\33231236756.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
312"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3388 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
400C:\Windows\system32\cmd.exe /c Sat0914a238bae2.exe /mixoneC:\Windows\system32\cmd.exe—setup_install.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
3221225477
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\7zs43fd7ad0\sat0914a238bae2.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
600/C powershell WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147735503 ThreatIDDefaultAction_Actions=6 Force=TrueC:\Windows\system32\cmd.exe—forfiles.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
612"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4184 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1032,6873655240100837859,16329560652507762369,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3516 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
768"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ThreatIDDefaultAction_Ids=2147737007 ThreatIDDefaultAction_Actions=6 Force=TrueC:\Windows\System32\Wbem\WMIC.exe—powershell.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
WMI Commandline Utility
Exit code:
2147749902
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
828"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=984,14324523522869615604,1189666205060242149,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shlwapi.dll
Total events
585 861
Read events
581 838
Write events
3 956
Delete events
67

Modification events

(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(3408) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
114
Suspicious files
80
Text files
134
Unknown types
149

Dropped files

PID
Process
Filename
Type
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-614F1111-D50.pma —
MD5:—
SHA256:—
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\0aa30825-c9c1-4d21-856d-163734d044b9.tmptext
MD5:—
SHA256:—
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:—
SHA256:—
3852chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics.pmabinary
MD5:03C4F648043A88675A920425D824E1B3
SHA256:F91DBB7C64B4582F529C968C480D2DCE1C8727390482F31E4355A27BB3D9B450
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RFfd279.TMPtext
MD5:81F483F77EE490F35306A4F94DB2286B
SHA256:82434CE3C9D13F509EBEEBE3A7A1A1DE9AB4557629D9FC855761E0CFA45E8BCE
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RFfd26a.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000001binary
MD5:5AF87DFD673BA2115E2FCF5CFDB727AB
SHA256:F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
3408chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:9C016064A1F864C8140915D77CF3389A
SHA256:0E7265D4A8C16223538EDD8CD620B8820611C74538E420A88E333BE7F62AC787
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
197
TCP/UDP connections
471
DNS requests
193
Threats
436

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2068
chrome.exe
GET
301
172.67.187.223:80
http://ljhjdh.xyz/?s=7&q=Ammyy+Admin+3.10+Crack+++Key+Full+Version&dedica=18&hmac=WyI1MDdmMzFiYzdmMzliNWIyMDkyMTAyYjVkNjNlZThkZDJiNzdhMTZkIiwiNTkzOTc4YWU4NmE1MWFlZDYzYmU5NjcwNzZlNmQ5NzY1MWQ4ZTA1MyIsIjlkZTMyOTMwMWQ0YThiODYwYTNlYzcwMmM5NjM0NTQxODUxY2ViNjQiLCIzMDBiZWE0ZjVlNjhjYTk3YzY1ZTk4MjdkYmE5YTQ0OGY5MjE0YzgzIiwiMzM3YjY5YjJiODY1NGI4MDAyMzVkNmM1MTMzZjgwZTlhZGU1NTdkYiIsIjRkMmNlMDgzMzNjNmYwMzA0ODAzNjUyZWRjY2RiMjQ3ODg0MmFlZTkiLCJlMjM5ZmM2MjJhMGM1YmQ2ZDZlZGNkNWU0NDI5ZGUxYmE1OWY0MmNlIiwiMTU5NWNlNjA1NDcwN2Q3MWQ5YjkyMjEyZDBkNWVlODYwMmYwNzk5MCIsIjQ0OTg4YjJkM2MxNGJhOTdjNDViYjliZWVhN2VjYTg2MWI4YjBkYzQiLCI4MjVlZDU3NWYwZWU3ODJjMzIwMDhkMjlhN2Y1NWYwZTE2OGI0NjUzIiwiZGI3NTQwOGI0YzNiMGYwYzczNWE0ZmEwM2Y0MTM1Y2JkY2QwYWQ2NSJd
US
—
—
malicious
1908
Sat09127dfa8681ede0.tmp
HEAD
200
162.0.214.42:80
http://safialinks.com/Installer_Provider/UltraMediaBurner.exe
CA
—
—
whitelisted
2068
chrome.exe
GET
301
104.21.39.132:80
http://krmcean.xyz/?s=7&q=SpyHunter+5+Crack+%5BEmail+&dedica=18&hmac=WyJjN2Y0M2Q3MzAwZGE1OGUzZmQ1MmQyZGY1M2M5NGVmNDFmZGUzYmUzIiwiZjhmZjQ0ZDc2N2NmNTNkMDI4ZWQyNmU4YjE5MDE4Zjg5ZDA3YjQwMyIsIjhlZWJmMDUwMTIxMmMwNDIyZjI2MDc5ZjY4MGQxNmIyZjEwNDYwMzIiLCJkYTIxNWYwMTRmYWM5YjgwYWViZDY3YjhiNDQ0NjhiMThkM2M1Mzk1IiwiNGM2MzhhYzU3NDgzMmY1OTA1ZjhjNjQ4ODM5YjIzNzYxNTI2MDE5ZSIsIjZhODgxODFiYWFiODEzYjIyNmFkOTUyMTRjNzVhYzhiNTRkZjEwN2UiLCIxODAzNTZlYzY4MDFiMWU2NWRlOTY2MWE1MzIwYjVhNGVjNmI3ZTc5IiwiOTQ2NzNhNzdjYjNhYWFmYzc5N2RhZmJlNzA4NTRlM2UxMjhjYzE4MSIsIjhkYzYwN2UzMWI5MWExY2NiMDcwNGNmYjk1MTg5NjNmYjMyOTZlN2YiLCIzZjlkNDYyMDAyYTJmMWM1MWQ1OWIwYWY1Y2E2Y2Y1ZGE2Y2Y3M2YwIiwiNDIxZmE2MzUwYWI1NDBhYzQ0ZGRhY2E0YzMzNDg1Y2NlYWM4YmYwMCJd
US
—
—
malicious
2068
chrome.exe
GET
302
18.237.46.89:80
http://18.237.46.89/?614f11180510c=c4e394d73d4c90664fde851cfc376696ebe73101Array&m=7&q=Ammyy%20Admin%203.10%20Crack%20%20%20Key%20Full%20Version&dedica=18&
US
html
19.0 Kb
unknown
3952
setup_install.exe
GET
200
172.67.142.91:80
http://hsiens.xyz/addInstall.php?key=125478824515ADNxu2ccbwe&ip=&oid=150&oname[]=25Sep0929AM_UD25SEP&oname[]=jog&oname[]=you&oname[]=Too&oname[]=ult&oname[]=Pyi&oname[]=tra&oname[]=Der&oname[]=GCl&oname[]=Ebo&oname[]=lih&cnt=10
US
text
10 b
malicious
2704
Sat0942d118661ebeaa8.exe
GET
200
45.133.1.182:80
http://45.133.1.182/proxies.txt
unknown
text
2.45 Kb
suspicious
2068
chrome.exe
POST
200
18.237.46.89:80
http://18.237.46.89/?cloudx=bedf03089e0c21458177c34&dedica=18&verify-id=7&verify-hash=902ba3cda1883801594b6e1b452790cc53948fda&verify-msch=U3B5SHVudGVyIDUgQ3JhY2sgW0VtYWlsIA==&download=1&xtrans=MTUw
US
compressed
3.53 Mb
unknown
2704
Sat0942d118661ebeaa8.exe
GET
200
37.0.8.119:80
http://37.0.8.119/base/api/statistics.php
NL
binary
96 b
malicious
1908
Sat09127dfa8681ede0.tmp
GET
200
162.0.214.42:80
http://safialinks.com/Installer_Provider/UltraMediaBurner.exe
CA
executable
474 Kb
whitelisted
2068
chrome.exe
POST
200
18.237.46.89:80
http://18.237.46.89/?go=a880512d1d5ae&dedica=18
US
html
694 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2068
chrome.exe
35.190.80.1:443
a.nel.cloudflare.com
Google Inc.
US
suspicious
2068
chrome.exe
192.0.77.2:443
i0.wp.com
Automattic, Inc
US
suspicious
2068
chrome.exe
142.250.186.168:443
www.googletagmanager.com
Google Inc.
US
suspicious
2068
chrome.exe
192.229.233.25:443
platform.twitter.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2068
chrome.exe
142.250.186.78:443
www.google-analytics.com
Google Inc.
US
whitelisted
2068
chrome.exe
157.240.236.35:443
www.facebook.com
—
US
malicious
2068
chrome.exe
172.67.187.223:80
ljhjdh.xyz
—
US
malicious
2068
chrome.exe
172.67.187.223:443
ljhjdh.xyz
—
US
malicious
2068
chrome.exe
216.58.212.142:443
clients2.google.com
Google Inc.
US
whitelisted
2068
chrome.exe
142.250.184.237:443
accounts.google.com
Google Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 216.58.212.142
  • 172.217.23.110
whitelisted
crackedpc.org
  • 172.67.214.180
  • 104.21.23.244
whitelisted
accounts.google.com
  • 142.250.184.237
  • 142.250.184.205
shared
www.google.com
  • 142.250.186.36
malicious
stats.wp.com
  • 192.0.76.3
whitelisted
vbdhjtgve.xyz
  • 172.67.180.127
  • 104.21.83.183
malicious
c0.wp.com
  • 192.0.77.37
whitelisted
content-autofill.googleapis.com
  • 172.217.23.106
whitelisted
connect.facebook.net
  • 157.240.236.1
whitelisted
i0.wp.com
  • 192.0.77.2
whitelisted

Threats

PID
Process
Class
Message
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2068
chrome.exe
A Network Trojan was detected
ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068
chrome.exe
A Network Trojan was detected
AV TROJAN Malware Dropper As a Service Download Request
2068
chrome.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
3952
setup_install.exe
A Network Trojan was detected
AV TROJAN GCleaner Downloader CnC Activity
3952
setup_install.exe
Potentially Bad Traffic
AV INFO HTTP Request to a *.xyz domain
2704
Sat0942d118661ebeaa8.exe
Generic Protocol Command Decode
SURICATA Applayer Mismatch protocol both directions
1908
Sat09127dfa8681ede0.tmp
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
199 ETPRO signatures available at the full report
Process
Message
lighteningplayer-cache-gen.exe
main libvlc debug: VLC media player - 3.0.7 Vetinari
lighteningplayer-cache-gen.exe
main libvlc debug: Copyright � 1996-2018 the VideoLAN team
lighteningplayer-cache-gen.exe
main libvlc debug: revision 3.0.2-225-gc9e3360dd4
lighteningplayer-cache-gen.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
lighteningplayer-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
lighteningplayer-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
lighteningplayer-cache-gen.exe
main libvlc debug: searching plug-in modules
lighteningplayer-cache-gen.exe
main libvlc debug: ignoring plugins cache file
lighteningplayer-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
lighteningplayer-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://crackedpc.org/ammyy-admin-crack-free-download/