Analysis date (UTC): 25 September 2021, 12:07Analysis environment: Windows 7 Pro, build 7601, x86

https://crackedpc.org/ammyy-admin-crack-free-download/

MD5:EC592A2E154D44F18C4135E7315ACBF4

SHA1:12F5F7E70FECD985CD50D0DDE5852F378FCA40E5

SHA256:5E0BB31C5994B0BB8EB4E4F38EA22EA5394691F2FA8E6E52650223ECDDF54BEC

Analysis result

Threat level:Malicious activity

Tags:

trojanloaderevasionratredlinestealervidaropendir

Full analysis:Analysis https://crackedpc.org/ammyy-admin-crack-free-download/ Malicious activity - Interactive analysis ANY.RUN

Behavior activities

MALICIOUS

Application was dropped or rewritten from another process

setup_x86_x64_install.exe (PID: 3452)
setup_x86_x64_install.exe (PID: 1388)
setup_installer.exe (PID: 3892)
Sat09964f7c03.exe (PID: 2604)
Sat09cd7ecbe4e.exe (PID: 3900)
Sat09f20f74a817fc59.exe (PID: 3100)
Sat098ac2475eba09.exe (PID: 1948)
Sat0942d118661ebeaa8.exe (PID: 2704)
Sat095b4859b0823e.exe (PID: 2440)
setup_install.exe (PID: 3952)
Sat09127dfa8681ede0.exe (PID: 1468)
Sat093d607fbd.exe (PID: 1784)
Sat0914a238bae2.exe (PID: 3320)
4388790.scr (PID: 3304)
LzmwAqmV.exe (PID: 2496)
3307180.scr (PID: 1968)
WinHoster.exe (PID: 3456)
ultramediaburner.exe (PID: 2816)
SHubekuxosi.exe (PID: 2508)
Lapenyvove.exe (PID: 2224)
6658114.scr (PID: 4088)
5027594.scr (PID: 8164)
7199766.scr (PID: 5300)
UltraMediaBurner.exe (PID: 1744)
Install.exe (PID: 10004)
install.exe (PID: 9700)
gcleaner.exe (PID: 6696)
installer.exe (PID: 5168)
installer.exe (PID: 8736)
autosubplayer.exe (PID: 4020)
EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
6985381.scr (PID: 3704)
4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
Install.exe (PID: 10760)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
TUldbHb.exe (PID: 12036)
33231236756.exe (PID: 292)
BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
Install.exe (PID: 5500)
Install.exe (PID: 6260)
45874656108.exe (PID: 8912)
60248097993.exe (PID: 6284)
3568351.scr (PID: 13252)
1970878.scr (PID: 2940)
5268981.scr (PID: 5448)
2694936.scr (PID: 12996)
File.exe (PID: 6948)
monns.exe (PID: 6208)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
hpzakXf.exe (PID: 8484)
8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
Y1FUY5TJK7FR.EXE (PID: 3096)
DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
Install.exe (PID: 11356)
Install.exe (PID: 6588)
FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
GEGcYbm.exe (PID: 5420)

Drops executable file immediately after starts

setup_installer.exe (PID: 3892)
Sat09127dfa8681ede0.exe (PID: 1468)
Sat09127dfa8681ede0.tmp (PID: 1908)
3307180.scr (PID: 1968)
LzmwAqmV.exe (PID: 2496)
ultramediaburner.exe (PID: 2816)
ultramediaburner.tmp (PID: 1704)

Executes PowerShell scripts

cmd.exe (PID: 284)
cmd.exe (PID: 8996)

Loads dropped or rewritten executable

setup_install.exe (PID: 3952)
Sat09964f7c03.exe (PID: 2604)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

Changes settings of System certificates

Sat098ac2475eba09.exe (PID: 1948)
Sat093d607fbd.exe (PID: 1784)
Sat0942d118661ebeaa8.exe (PID: 2704)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

Connects to CnC server

setup_install.exe (PID: 3952)
Sat0942d118661ebeaa8.exe (PID: 2704)
Sat095b4859b0823e.exe (PID: 2440)
6658114.scr (PID: 4088)
7199766.scr (PID: 5300)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
210921.exe (PID: 10700)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
md8_8eus.exe (PID: 9548)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
2694936.scr (PID: 12996)
33231236756.exe (PID: 292)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
5268981.scr (PID: 5448)
1.exe (PID: 9584)
monns.exe (PID: 6208)
tmp84F7_tmp.exe (PID: 8824)

Actions looks like stealing of personal data

4388790.scr (PID: 3304)
Sat09964f7c03.exe (PID: 2604)
Sat095b4859b0823e.exe (PID: 2440)
6658114.scr (PID: 4088)
5027594.scr (PID: 8164)
7199766.scr (PID: 5300)
7569659.scr (PID: 6400)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
210921.exe (PID: 10700)
md8_8eus.exe (PID: 9548)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
3568351.scr (PID: 13252)
45874656108.exe (PID: 8912)
33231236756.exe (PID: 292)
2694936.scr (PID: 12996)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
5268981.scr (PID: 5448)
1.exe (PID: 9584)
monns.exe (PID: 6208)
hpzakXf.exe (PID: 8484)
tmp84F7_tmp.exe (PID: 8824)

Stealing of credential data

4388790.scr (PID: 3304)
Sat095b4859b0823e.exe (PID: 2440)
Sat09964f7c03.exe (PID: 2604)
6658114.scr (PID: 4088)
7199766.scr (PID: 5300)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

Changes the autorun value in the registry

3307180.scr (PID: 1968)
EtalevzaJet.exe (PID: 2624)
verism.exe (PID: 10956)

Disables Windows Defender

Sat0942d118661ebeaa8.exe (PID: 2704)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Steals credentials from Web Browsers

4388790.scr (PID: 3304)
Sat09964f7c03.exe (PID: 2604)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
md8_8eus.exe (PID: 9548)
hpzakXf.exe (PID: 8484)

REDLINE was detected

Sat095b4859b0823e.exe (PID: 2440)
6658114.scr (PID: 4088)
7199766.scr (PID: 5300)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
210921.exe (PID: 10700)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
2694936.scr (PID: 12996)
33231236756.exe (PID: 292)
5268981.scr (PID: 5448)
1.exe (PID: 9584)
monns.exe (PID: 6208)
tmp84F7_tmp.exe (PID: 8824)

Loads the Task Scheduler COM API

MsiExec.exe (PID: 8128)
schtasks.exe (PID: 4324)
schtasks.exe (PID: 5020)
installer.exe (PID: 5168)
schtasks.exe (PID: 13916)
schtasks.exe (PID: 6948)
schtasks.exe (PID: 7336)
schtasks.exe (PID: 2996)
schtasks.exe (PID: 4420)
schtasks.exe (PID: 11220)
schtasks.exe (PID: 13976)
schtasks.exe (PID: 14092)
schtasks.exe (PID: 8256)
schtasks.exe (PID: 6560)
schtasks.exe (PID: 5828)
schtasks.exe (PID: 11288)
schtasks.exe (PID: 10724)
schtasks.exe (PID: 8748)
schtasks.exe (PID: 11316)
schtasks.exe (PID: 12488)
schtasks.exe (PID: 9132)
schtasks.exe (PID: 1628)
schtasks.exe (PID: 7724)
schtasks.exe (PID: 5644)
schtasks.exe (PID: 13352)
schtasks.exe (PID: 3092)
schtasks.exe (PID: 10848)
schtasks.exe (PID: 11764)
schtasks.exe (PID: 6660)
schtasks.exe (PID: 8088)
schtasks.exe (PID: 7968)
schtasks.exe (PID: 5364)
schtasks.exe (PID: 2692)
schtasks.exe (PID: 5136)
schtasks.exe (PID: 7380)
schtasks.exe (PID: 9108)

VIDAR was detected

Sat09964f7c03.exe (PID: 2604)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)

Uses Task Scheduler to run other applications

Install.exe (PID: 10760)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
TUldbHb.exe (PID: 12036)
cmd.exe (PID: 10376)
Install.exe (PID: 6260)
hpzakXf.exe (PID: 8484)
rundll32.EXE (PID: 7252)
Install.exe (PID: 11356)
cmd.exe (PID: 5368)

Loads the Task Scheduler DLL interface

schtasks.exe (PID: 13608)
schtasks.exe (PID: 6424)
schtasks.exe (PID: 5284)
schtasks.exe (PID: 6504)
schtasks.exe (PID: 9992)
schtasks.exe (PID: 7388)

Uses Task Scheduler to autorun other applications

NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
hpzakXf.exe (PID: 8484)

Runs app for hidden code execution

cmd.exe (PID: 11636)

Modifies exclusions in Windows Defender

reg.exe (PID: 3912)
reg.exe (PID: 7708)
reg.exe (PID: 7560)
reg.exe (PID: 13984)
reg.exe (PID: 2552)
reg.exe (PID: 3504)
reg.exe (PID: 14120)
reg.exe (PID: 13620)
reg.exe (PID: 4292)

Modifies files in Chrome extension folder

hpzakXf.exe (PID: 8484)

SUSPICIOUS

Checks supported languages

WinRAR.exe (PID: 2132)
WinRAR.exe (PID: 2516)
WinRAR.exe (PID: 2476)
WinRAR.exe (PID: 3732)
setup_x86_x64_install.exe (PID: 1388)
setup_installer.exe (PID: 3892)
setup_install.exe (PID: 3952)
cmd.exe (PID: 284)
cmd.exe (PID: 2516)
powershell.exe (PID: 2864)
cmd.exe (PID: 3080)
cmd.exe (PID: 3732)
Sat09cd7ecbe4e.exe (PID: 3900)
cmd.exe (PID: 3608)
cmd.exe (PID: 2668)
cmd.exe (PID: 3624)
cmd.exe (PID: 400)
cmd.exe (PID: 4036)
Sat09127dfa8681ede0.exe (PID: 1468)
Sat095b4859b0823e.exe (PID: 2440)
Sat098ac2475eba09.exe (PID: 1948)
Sat0914a238bae2.exe (PID: 3320)
Sat093d607fbd.exe (PID: 1784)
Sat09f20f74a817fc59.exe (PID: 3100)
cmd.exe (PID: 3852)
cmd.exe (PID: 2040)
Sat0942d118661ebeaa8.exe (PID: 2704)
Sat09964f7c03.exe (PID: 2604)
Sat09127dfa8681ede0.tmp (PID: 1908)
EtalevzaJet.exe (PID: 2624)
4388790.scr (PID: 3304)
3307180.scr (PID: 1968)
WinHoster.exe (PID: 3456)
LzmwAqmV.exe (PID: 2496)
6658114.scr (PID: 4088)
ultramediaburner.exe (PID: 2816)
ultramediaburner.tmp (PID: 1704)
UltraMediaBurner.exe (PID: 1744)
SHubekuxosi.exe (PID: 2508)
Lapenyvove.exe (PID: 2224)
7199766.scr (PID: 5300)
5027594.scr (PID: 8164)
cmd.exe (PID: 4812)
installer.exe (PID: 5168)
cmd.exe (PID: 10920)
cmd.exe (PID: 9460)
install.exe (PID: 9700)
Install.exe (PID: 10004)
Install.exe (PID: 10760)
cmd.exe (PID: 2068)
powershell.exe (PID: 11656)
cmd.exe (PID: 11944)
WMIC.exe (PID: 5916)
powershell.exe (PID: 10784)
WMIC.exe (PID: 13372)
powershell.exe (PID: 13912)
WMIC.exe (PID: 2320)
cmd.exe (PID: 3680)
powershell.exe (PID: 4616)
WMIC.exe (PID: 7412)
cmd.exe (PID: 6644)
gcleaner.exe (PID: 6696)
cmd.exe (PID: 924)
autosubplayer.exe (PID: 4020)
cmd.exe (PID: 9480)
powershell.EXE (PID: 5584)
ns72FD.tmp (PID: 9180)
installer.exe (PID: 8736)
powershell.exe (PID: 9928)
ns79F4.tmp (PID: 11568)
lighteningplayer-cache-gen.exe (PID: 10828)
EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 5084)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
7569659.scr (PID: 6400)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
6985381.scr (PID: 3704)
4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
nsA22B.tmp (PID: 9820)
249old.exe (PID: 9492)
cmd.exe (PID: 8996)
210921.exe (PID: 10700)
powershell.exe (PID: 9896)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
cmd.exe (PID: 8380)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
md8_8eus.exe (PID: 9548)
inst001.exe (PID: 8956)
7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
RegSvcs.exe (PID: 4352)
TUldbHb.exe (PID: 12036)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
powershell.exe (PID: 5312)
2694936.scr (PID: 12996)
cmd.exe (PID: 11668)
cmd.exe (PID: 13168)
1970878.scr (PID: 2940)
WMIC.exe (PID: 13592)
BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
powershell.exe (PID: 1292)
33231236756.exe (PID: 292)
WMIC.exe (PID: 4392)
Install.exe (PID: 5500)
WMIC.exe (PID: 768)
powershell.exe (PID: 5076)
Install.exe (PID: 6260)
powershell.exe (PID: 4332)
cmd.exe (PID: 6716)
powershell.exe (PID: 7356)
WMIC.exe (PID: 13968)
45874656108.exe (PID: 8912)
WMIC.exe (PID: 4940)
powershell.exe (PID: 8628)
cmd.exe (PID: 8816)
powershell.exe (PID: 11684)
WMIC.exe (PID: 12852)
WMIC.exe (PID: 3916)
cmd.exe (PID: 12700)
60248097993.exe (PID: 6284)
5268981.scr (PID: 5448)
powershell.exe (PID: 6364)
3568351.scr (PID: 13252)
cmd.exe (PID: 13660)
WMIC.exe (PID: 1892)
powershell.EXE (PID: 4280)
clipper)).exe (PID: 8224)
1.exe (PID: 9584)
cmd.exe (PID: 10376)
powershell.EXE (PID: 7740)
monns.exe (PID: 6208)
File.exe (PID: 6948)
cmd.exe (PID: 10056)
cmd.exe (PID: 11428)
verism.exe (PID: 10956)
cmd.exe (PID: 11636)
Puo.exe.com (PID: 11440)
Puo.exe.com (PID: 11260)
powershell.exe (PID: 6768)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
cmd.exe (PID: 8668)
cmd.exe (PID: 13244)
wscript.exe (PID: 13616)
cmd.exe (PID: 13516)
hpzakXf.exe (PID: 8484)
cmd.exe (PID: 8492)
powershell.exe (PID: 5324)
WMIC.exe (PID: 8664)
powershell.exe (PID: 9588)
WMIC.exe (PID: 5996)
powershell.exe (PID: 2340)
WMIC.exe (PID: 9344)
powershell.exe (PID: 5476)
WMIC.exe (PID: 11416)
cmd.exe (PID: 7616)
cmd.exe (PID: 6156)
8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
jNomgixrX3RZeUs304OJesEW.exe (PID: 10352)
9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 4008)
7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
mshta.exe (PID: 12792)
cmd.exe (PID: 11464)
Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
Y1FUY5TJK7FR.EXE (PID: 3096)
mshta.exe (PID: 6444)
cmd.exe (PID: 4440)
DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)
Install.exe (PID: 11356)
cmd.exe (PID: 7064)
Install.exe (PID: 6588)
tmp84F7_tmp.exe (PID: 6184)
powershell.exe (PID: 7512)
WMIC.exe (PID: 4968)
powershell.exe (PID: 10244)
powershell.exe (PID: 12540)
WMIC.exe (PID: 5132)
tmp84F7_tmp.exe (PID: 8824)
powershell.exe (PID: 7624)
WMIC.exe (PID: 7744)
WMIC.exe (PID: 3984)
cmd.exe (PID: 4752)
powershell.exe (PID: 7116)
GEGcYbm.exe (PID: 5420)
WMIC.exe (PID: 8900)
powershell.EXE (PID: 8864)
powershell.exe (PID: 2876)
WMIC.exe (PID: 7180)
WMIC.exe (PID: 10352)
powershell.exe (PID: 5856)
powershell.exe (PID: 12372)
WMIC.exe (PID: 13680)
service.exe (PID: 14120)
cmd.exe (PID: 5368)
cmd.exe (PID: 11160)
cmd.exe (PID: 7496)

Reads the computer name

WinRAR.exe (PID: 2132)
WinRAR.exe (PID: 2516)
WinRAR.exe (PID: 2476)
WinRAR.exe (PID: 3732)
setup_x86_x64_install.exe (PID: 1388)
setup_installer.exe (PID: 3892)
powershell.exe (PID: 2864)
Sat09cd7ecbe4e.exe (PID: 3900)
setup_install.exe (PID: 3952)
Sat098ac2475eba09.exe (PID: 1948)
Sat093d607fbd.exe (PID: 1784)
Sat0942d118661ebeaa8.exe (PID: 2704)
Sat09127dfa8681ede0.tmp (PID: 1908)
4388790.scr (PID: 3304)
WinHoster.exe (PID: 3456)
LzmwAqmV.exe (PID: 2496)
3307180.scr (PID: 1968)
EtalevzaJet.exe (PID: 2624)
Sat095b4859b0823e.exe (PID: 2440)
Sat09964f7c03.exe (PID: 2604)
ultramediaburner.tmp (PID: 1704)
6658114.scr (PID: 4088)
UltraMediaBurner.exe (PID: 1744)
Sat0914a238bae2.exe (PID: 3320)
SHubekuxosi.exe (PID: 2508)
Lapenyvove.exe (PID: 2224)
7199766.scr (PID: 5300)
5027594.scr (PID: 8164)
installer.exe (PID: 5168)
Install.exe (PID: 10760)
powershell.exe (PID: 11656)
WMIC.exe (PID: 5916)
powershell.exe (PID: 10784)
WMIC.exe (PID: 13372)
powershell.exe (PID: 13912)
WMIC.exe (PID: 2320)
powershell.exe (PID: 4616)
WMIC.exe (PID: 7412)
gcleaner.exe (PID: 6696)
autosubplayer.exe (PID: 4020)
powershell.EXE (PID: 5584)
installer.exe (PID: 8736)
powershell.exe (PID: 9928)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
6985381.scr (PID: 3704)
4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
powershell.exe (PID: 9896)
249old.exe (PID: 9492)
210921.exe (PID: 10700)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
7569659.scr (PID: 6400)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
md8_8eus.exe (PID: 9548)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
7yk9WUYH89zHVXF_xvV51uA7.exe (PID: 9768)
TUldbHb.exe (PID: 12036)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
powershell.exe (PID: 5312)
1970878.scr (PID: 2940)
WMIC.exe (PID: 13592)
2694936.scr (PID: 12996)
powershell.exe (PID: 1292)
33231236756.exe (PID: 292)
WMIC.exe (PID: 4392)
powershell.exe (PID: 5076)
WMIC.exe (PID: 768)
powershell.exe (PID: 4332)
Install.exe (PID: 6260)
WMIC.exe (PID: 13968)
powershell.exe (PID: 7356)
WMIC.exe (PID: 4940)
powershell.exe (PID: 8628)
WMIC.exe (PID: 3916)
powershell.exe (PID: 11684)
powershell.exe (PID: 6364)
WMIC.exe (PID: 12852)
5268981.scr (PID: 5448)
3568351.scr (PID: 13252)
45874656108.exe (PID: 8912)
WMIC.exe (PID: 1892)
powershell.EXE (PID: 4280)
60248097993.exe (PID: 6284)
RegSvcs.exe (PID: 4352)
clipper)).exe (PID: 8224)
1.exe (PID: 9584)
powershell.EXE (PID: 7740)
monns.exe (PID: 6208)
File.exe (PID: 6948)
Puo.exe.com (PID: 11440)
powershell.exe (PID: 6768)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 6396)
wscript.exe (PID: 13616)
hpzakXf.exe (PID: 8484)
powershell.exe (PID: 5324)
WMIC.exe (PID: 8664)
powershell.exe (PID: 9588)
powershell.exe (PID: 2340)
WMIC.exe (PID: 9344)
WMIC.exe (PID: 5996)
WMIC.exe (PID: 11416)
powershell.exe (PID: 5476)
9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
mshta.exe (PID: 12792)
Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
Y1FUY5TJK7FR.EXE (PID: 3096)
mshta.exe (PID: 6444)
Install.exe (PID: 11356)
tmp84F7_tmp.exe (PID: 6184)
powershell.exe (PID: 7512)
WMIC.exe (PID: 4968)
powershell.exe (PID: 10244)
WMIC.exe (PID: 5132)
powershell.exe (PID: 12540)
tmp84F7_tmp.exe (PID: 8824)
powershell.exe (PID: 7624)
8teNCntK3P2ACYoMkHfT29UC.exe (PID: 6616)
WMIC.exe (PID: 3984)
WMIC.exe (PID: 7744)
GEGcYbm.exe (PID: 5420)
powershell.exe (PID: 7116)
powershell.EXE (PID: 8864)
WMIC.exe (PID: 8900)
powershell.exe (PID: 2876)
WMIC.exe (PID: 7180)
powershell.exe (PID: 5856)
WMIC.exe (PID: 10352)
WMIC.exe (PID: 13680)
powershell.exe (PID: 12372)
service.exe (PID: 14120)

Application launched itself

WinRAR.exe (PID: 2132)
msiexec.exe (PID: 8296)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 7580)
EUzSB_bJUrTCDP6kqs2WKBP5.exe (PID: 13784)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 11896)
cmd.exe (PID: 11636)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
Puo.exe.com (PID: 11260)
FnRsM2T4iLbsb_SjGTk07Nuj.exe (PID: 6324)
tmp84F7_tmp.exe (PID: 6184)

Executable content was dropped or overwritten

WinRAR.exe (PID: 3732)
setup_x86_x64_install.exe (PID: 1388)
setup_installer.exe (PID: 3892)
Sat09127dfa8681ede0.exe (PID: 1468)
Sat09127dfa8681ede0.tmp (PID: 1908)
Sat098ac2475eba09.exe (PID: 1948)
Sat09cd7ecbe4e.exe (PID: 3900)
LzmwAqmV.exe (PID: 2496)
3307180.scr (PID: 1968)
EtalevzaJet.exe (PID: 2624)
ultramediaburner.exe (PID: 2816)
ultramediaburner.tmp (PID: 1704)
Sat09964f7c03.exe (PID: 2604)
Lapenyvove.exe (PID: 2224)
Sat0942d118661ebeaa8.exe (PID: 2704)
Install.exe (PID: 10760)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Drops a file that was compiled in debug mode

setup_installer.exe (PID: 3892)
Sat09127dfa8681ede0.tmp (PID: 1908)
ultramediaburner.tmp (PID: 1704)
Sat09964f7c03.exe (PID: 2604)
Lapenyvove.exe (PID: 2224)
Sat0942d118661ebeaa8.exe (PID: 2704)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Drops a file with too old compile date

setup_installer.exe (PID: 3892)
Sat09127dfa8681ede0.exe (PID: 1468)
Sat09127dfa8681ede0.tmp (PID: 1908)
Sat098ac2475eba09.exe (PID: 1948)
3307180.scr (PID: 1968)
EtalevzaJet.exe (PID: 2624)
ultramediaburner.exe (PID: 2816)
ultramediaburner.tmp (PID: 1704)
Sat0942d118661ebeaa8.exe (PID: 2704)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Drops a file with a compile date too recent

setup_installer.exe (PID: 3892)
Sat09cd7ecbe4e.exe (PID: 3900)
EtalevzaJet.exe (PID: 2624)
Sat0942d118661ebeaa8.exe (PID: 2704)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Starts CMD.EXE for commands execution

setup_install.exe (PID: 3952)
Lapenyvove.exe (PID: 2224)
Sat09964f7c03.exe (PID: 2604)
Install.exe (PID: 10760)
forfiles.exe (PID: 11360)
forfiles.exe (PID: 5432)
forfiles.exe (PID: 13708)
forfiles.exe (PID: 4068)
forfiles.exe (PID: 10584)
forfiles.exe (PID: 10884)
nsA22B.tmp (PID: 9820)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
TUldbHb.exe (PID: 12036)
forfiles.exe (PID: 12232)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
forfiles.exe (PID: 14072)
forfiles.exe (PID: 6880)
forfiles.exe (PID: 4760)
Install.exe (PID: 6260)
forfiles.exe (PID: 6940)
forfiles.exe (PID: 10224)
forfiles.exe (PID: 11180)
forfiles.exe (PID: 12584)
forfiles.exe (PID: 6176)
forfiles.exe (PID: 5896)
clipper)).exe (PID: 8224)
45874656108.exe (PID: 8912)
cmd.exe (PID: 11636)
verism.exe (PID: 10956)
hpzakXf.exe (PID: 8484)
forfiles.exe (PID: 7768)
forfiles.exe (PID: 8792)
forfiles.exe (PID: 10800)
forfiles.exe (PID: 11364)
mshta.exe (PID: 12792)
mshta.exe (PID: 6444)
Install.exe (PID: 11356)
forfiles.exe (PID: 3028)
forfiles.exe (PID: 10148)
forfiles.exe (PID: 6324)
forfiles.exe (PID: 12836)
forfiles.exe (PID: 4268)
forfiles.exe (PID: 4296)
GEGcYbm.exe (PID: 5420)
forfiles.exe (PID: 9532)
forfiles.exe (PID: 10116)
forfiles.exe (PID: 12056)
forfiles.exe (PID: 12856)
service.exe (PID: 14120)

Reads the date of Windows installation

powershell.exe (PID: 2864)
powershell.exe (PID: 11656)
powershell.exe (PID: 10784)
powershell.exe (PID: 13912)
powershell.exe (PID: 4616)
powershell.EXE (PID: 5584)
powershell.exe (PID: 9928)
powershell.exe (PID: 9896)
powershell.exe (PID: 5312)
powershell.exe (PID: 1292)
powershell.exe (PID: 5076)
powershell.exe (PID: 4332)
powershell.exe (PID: 7356)
powershell.exe (PID: 8628)
powershell.exe (PID: 11684)
powershell.exe (PID: 6364)
powershell.EXE (PID: 4280)
powershell.EXE (PID: 7740)
powershell.exe (PID: 6768)
powershell.exe (PID: 5324)
powershell.exe (PID: 9588)
powershell.exe (PID: 2340)
powershell.exe (PID: 5476)
powershell.exe (PID: 7512)
powershell.exe (PID: 10244)
powershell.exe (PID: 12540)
powershell.exe (PID: 7624)
powershell.exe (PID: 7116)
powershell.EXE (PID: 8864)
powershell.exe (PID: 2876)
powershell.exe (PID: 5856)
powershell.exe (PID: 12372)

Creates files in the user directory

powershell.exe (PID: 2864)
Sat098ac2475eba09.exe (PID: 1948)
3307180.scr (PID: 1968)
installer.exe (PID: 5168)
powershell.exe (PID: 11656)
powershell.exe (PID: 10784)
powershell.exe (PID: 13912)
powershell.exe (PID: 4616)
powershell.EXE (PID: 5584)
autosubplayer.exe (PID: 4020)
powershell.exe (PID: 9928)
Sat0942d118661ebeaa8.exe (PID: 2704)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
powershell.exe (PID: 9896)
powershell.exe (PID: 7356)
powershell.exe (PID: 8628)
powershell.exe (PID: 11684)
powershell.exe (PID: 6364)
powershell.EXE (PID: 4280)
60248097993.exe (PID: 6284)
powershell.EXE (PID: 7740)
powershell.exe (PID: 6768)
hpzakXf.exe (PID: 8484)
powershell.exe (PID: 7512)
powershell.exe (PID: 10244)
powershell.exe (PID: 12540)
powershell.exe (PID: 7624)
powershell.EXE (PID: 8864)
powershell.exe (PID: 7116)
powershell.exe (PID: 2876)
powershell.exe (PID: 5856)
powershell.exe (PID: 12372)

Reads Environment values

Sat09cd7ecbe4e.exe (PID: 3900)
Sat098ac2475eba09.exe (PID: 1948)
EtalevzaJet.exe (PID: 2624)
4388790.scr (PID: 3304)
SHubekuxosi.exe (PID: 2508)
Lapenyvove.exe (PID: 2224)
Sat095b4859b0823e.exe (PID: 2440)
Sat09964f7c03.exe (PID: 2604)
6658114.scr (PID: 4088)
installer.exe (PID: 5168)
5027594.scr (PID: 8164)
MsiExec.exe (PID: 2828)
MsiExec.exe (PID: 11540)
7199766.scr (PID: 5300)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
7569659.scr (PID: 6400)
powershell.exe (PID: 9896)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
210921.exe (PID: 10700)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
1970878.scr (PID: 2940)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
33231236756.exe (PID: 292)
2694936.scr (PID: 12996)
45874656108.exe (PID: 8912)
3568351.scr (PID: 13252)
60248097993.exe (PID: 6284)
5268981.scr (PID: 5448)
1.exe (PID: 9584)
monns.exe (PID: 6208)
Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
tmp84F7_tmp.exe (PID: 8824)

Reads the Windows organization settings

Sat09127dfa8681ede0.tmp (PID: 1908)
ultramediaburner.tmp (PID: 1704)
installer.exe (PID: 5168)
msiexec.exe (PID: 8296)

Reads Windows owner or organization settings

Sat09127dfa8681ede0.tmp (PID: 1908)
ultramediaburner.tmp (PID: 1704)
installer.exe (PID: 5168)
msiexec.exe (PID: 8296)
pkLOM0FhgOfdrSGP96RofqjU.exe (PID: 6004)

Adds / modifies Windows certificates

Sat098ac2475eba09.exe (PID: 1948)
Sat093d607fbd.exe (PID: 1784)
Sat0942d118661ebeaa8.exe (PID: 2704)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)

Starts application with an unusual extension

Sat098ac2475eba09.exe (PID: 1948)
autosubplayer.exe (PID: 4020)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
Qf78G1SAhkxt44nnbTMpU81Z.exe (PID: 9512)
cmd.exe (PID: 11428)
Puo.exe.com (PID: 11260)

Starts itself from another location

3307180.scr (PID: 1968)
install.exe (PID: 9700)
BJas93Ow5clRi8RnmWfw9oAE.exe (PID: 7672)
DrBvAw4SCEAYmhzxHBaKPs6L.exe (PID: 2300)

Reads the cookies of Mozilla Firefox

4388790.scr (PID: 3304)
md8_8eus.exe (PID: 9548)

Searches for installed software

4388790.scr (PID: 3304)
Sat09964f7c03.exe (PID: 2604)
Sat095b4859b0823e.exe (PID: 2440)
5027594.scr (PID: 8164)
6658114.scr (PID: 4088)
7199766.scr (PID: 5300)
7569659.scr (PID: 6400)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
210921.exe (PID: 10700)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
3568351.scr (PID: 13252)
2694936.scr (PID: 12996)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
33231236756.exe (PID: 292)
1.exe (PID: 9584)
monns.exe (PID: 6208)
5268981.scr (PID: 5448)
tmp84F7_tmp.exe (PID: 8824)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)

Creates a directory in Program Files

EtalevzaJet.exe (PID: 2624)
ultramediaburner.tmp (PID: 1704)
msiexec.exe (PID: 8296)
autosubplayer.exe (PID: 4020)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
File.exe (PID: 6948)
hpzakXf.exe (PID: 8484)

Checks for external IP

Sat0942d118661ebeaa8.exe (PID: 2704)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)

Creates files in the program directory

Sat09964f7c03.exe (PID: 2604)
msiexec.exe (PID: 8296)
autosubplayer.exe (PID: 4020)
lighteningplayer-cache-gen.exe (PID: 10828)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
md8_8eus.exe (PID: 9548)
File.exe (PID: 6948)
hpzakXf.exe (PID: 8484)

Starts Internet Explorer

SHubekuxosi.exe (PID: 2508)

Reads Microsoft Outlook installation path

iexplore.exe (PID: 2832)
powershell.exe (PID: 9896)
mshta.exe (PID: 12792)
mshta.exe (PID: 6444)

Reads CPU info

Sat09964f7c03.exe (PID: 2604)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
45874656108.exe (PID: 8912)
60248097993.exe (PID: 6284)

Executed as Windows Service

msiexec.exe (PID: 8296)

Starts Microsoft Installer

installer.exe (PID: 5168)

Starts CMD.EXE for self-deleting

Sat09964f7c03.exe (PID: 2604)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
45874656108.exe (PID: 8912)

Uses TASKKILL.EXE to kill process

cmd.exe (PID: 10920)
MsiExec.exe (PID: 11540)
cmd.exe (PID: 8380)
cmd.exe (PID: 13660)
cmd.exe (PID: 11464)

Creates a software uninstall entry

msiexec.exe (PID: 8296)
autosubplayer.exe (PID: 4020)
kHgadHafX5FQT6OUTvp7_foc.exe (PID: 7044)
hpzakXf.exe (PID: 8484)

Executes PowerShell scripts

cmd.exe (PID: 11588)
cmd.exe (PID: 12144)
cmd.exe (PID: 13832)
cmd.exe (PID: 4208)
ns72FD.tmp (PID: 9180)
cmd.exe (PID: 6580)
cmd.exe (PID: 7912)
cmd.exe (PID: 5564)
cmd.exe (PID: 7660)
cmd.exe (PID: 7084)
cmd.exe (PID: 9892)
cmd.exe (PID: 11468)
cmd.exe (PID: 3336)
IyZn0CPcfS0nSq3scM46coX_.exe (PID: 12400)
cmd.exe (PID: 600)
cmd.exe (PID: 8592)
cmd.exe (PID: 11872)
cmd.exe (PID: 10916)
cmd.exe (PID: 10368)
cmd.exe (PID: 9128)
cmd.exe (PID: 2440)
cmd.exe (PID: 14052)
cmd.exe (PID: 11988)
cmd.exe (PID: 12712)
cmd.exe (PID: 6904)
cmd.exe (PID: 3744)

Executes application which crashes

cmd.exe (PID: 11944)
cmd.exe (PID: 3680)
60248097993.exe (PID: 6284)

Uses REG.EXE to modify Windows registry

cmd.exe (PID: 11068)
cmd.exe (PID: 11504)
cmd.exe (PID: 7064)
cmd.exe (PID: 6464)
cmd.exe (PID: 8668)
wscript.exe (PID: 13616)
cmd.exe (PID: 13516)
cmd.exe (PID: 7616)
cmd.exe (PID: 6156)
cmd.exe (PID: 7728)
cmd.exe (PID: 3520)
cmd.exe (PID: 11160)
cmd.exe (PID: 7496)

Executed via Task Scheduler

powershell.EXE (PID: 5584)
TUldbHb.exe (PID: 12036)
powershell.EXE (PID: 4280)
powershell.EXE (PID: 7740)
hpzakXf.exe (PID: 8484)
rundll32.EXE (PID: 7252)
GEGcYbm.exe (PID: 5420)
powershell.EXE (PID: 8864)
service.exe (PID: 14120)
chrome.exe (PID: 3492)

PowerShell script executed

powershell.EXE (PID: 5584)
powershell.EXE (PID: 4280)
powershell.EXE (PID: 7740)
powershell.EXE (PID: 8864)

Creates files in the Windows directory

schtasks.exe (PID: 13608)
cmd.exe (PID: 13244)
TUldbHb.exe (PID: 12036)
schtasks.exe (PID: 6424)
schtasks.exe (PID: 6504)
hpzakXf.exe (PID: 8484)
schtasks.exe (PID: 9992)

Reads the cookies of Google Chrome

md8_8eus.exe (PID: 9548)

Reads mouse settings

Puo.exe.com (PID: 11260)
Puo.exe.com (PID: 11440)

Executes scripts

TUldbHb.exe (PID: 12036)

Removes files from Windows directory

TUldbHb.exe (PID: 12036)

Starts MSHTA.EXE for opening HTA or HTMLS files

9YwBA4J7T4D6vRC6bbNwApRT.exe (PID: 11596)
Y1FUY5TJK7FR.EXE (PID: 3096)

Uses RUNDLL32.EXE to load library

Y1FUY5TJK7FR.EXE (PID: 3096)

Modifies files in Chrome extension folder

chrome.exe (PID: 3492)

INFO

Checks supported languages

chrome.exe (PID: 3408)
chrome.exe (PID: 3852)
chrome.exe (PID: 2068)
chrome.exe (PID: 2768)
chrome.exe (PID: 1012)
chrome.exe (PID: 3040)
chrome.exe (PID: 4068)
chrome.exe (PID: 3188)
chrome.exe (PID: 3624)
chrome.exe (PID: 2392)
chrome.exe (PID: 2496)
chrome.exe (PID: 1192)
chrome.exe (PID: 3816)
chrome.exe (PID: 3112)
chrome.exe (PID: 2952)
chrome.exe (PID: 1596)
chrome.exe (PID: 2380)
chrome.exe (PID: 2384)
chrome.exe (PID: 2544)
chrome.exe (PID: 4032)
chrome.exe (PID: 3152)
chrome.exe (PID: 828)
NOTEPAD.EXE (PID: 3908)
iexplore.exe (PID: 2764)
iexplore.exe (PID: 2832)
msiexec.exe (PID: 8296)
MsiExec.exe (PID: 2828)
msiexec.exe (PID: 9308)
taskkill.exe (PID: 11180)
MsiExec.exe (PID: 11540)
timeout.exe (PID: 11808)
taskkill.exe (PID: 12312)
MsiExec.exe (PID: 8128)
forfiles.exe (PID: 11360)
cmd.exe (PID: 11588)
ntvdm.exe (PID: 12348)
forfiles.exe (PID: 5432)
cmd.exe (PID: 12144)
forfiles.exe (PID: 13708)
cmd.exe (PID: 13832)
ntvdm.exe (PID: 2304)
forfiles.exe (PID: 4068)
cmd.exe (PID: 4208)
forfiles.exe (PID: 10584)
cmd.exe (PID: 11068)
reg.exe (PID: 11264)
cmd.exe (PID: 11504)
reg.exe (PID: 11660)
forfiles.exe (PID: 10884)
schtasks.exe (PID: 5020)
schtasks.exe (PID: 4324)
gpupdate.exe (PID: 7080)
schtasks.exe (PID: 13916)
schtasks.exe (PID: 13608)
timeout.exe (PID: 7600)
taskkill.exe (PID: 2240)
schtasks.exe (PID: 6948)
schtasks.exe (PID: 7336)
forfiles.exe (PID: 12232)
cmd.exe (PID: 6580)
forfiles.exe (PID: 14072)
cmd.exe (PID: 7912)
forfiles.exe (PID: 6880)
cmd.exe (PID: 5564)
forfiles.exe (PID: 4760)
cmd.exe (PID: 7660)
forfiles.exe (PID: 6940)
cmd.exe (PID: 7084)
forfiles.exe (PID: 10224)
cmd.exe (PID: 9892)
forfiles.exe (PID: 11180)
cmd.exe (PID: 11468)
forfiles.exe (PID: 12584)
cmd.exe (PID: 3336)
taskkill.exe (PID: 14216)
schtasks.exe (PID: 2996)
schtasks.exe (PID: 4420)
cmd.exe (PID: 6464)
reg.exe (PID: 5948)
forfiles.exe (PID: 6176)
cmd.exe (PID: 7064)
reg.exe (PID: 7056)
gpupdate.exe (PID: 9476)
forfiles.exe (PID: 5896)
schtasks.exe (PID: 11220)
ntvdm.exe (PID: 5632)
schtasks.exe (PID: 13976)
schtasks.exe (PID: 14092)
gpupdate.exe (PID: 2996)
timeout.exe (PID: 10320)
findstr.exe (PID: 11432)
PING.EXE (PID: 10820)
dllhost.exe (PID: 11264)
schtasks.exe (PID: 8256)
reg.exe (PID: 3912)
reg.exe (PID: 7708)
reg.exe (PID: 7560)
reg.exe (PID: 3504)
reg.exe (PID: 13872)
reg.exe (PID: 2552)
reg.exe (PID: 13984)
reg.exe (PID: 3640)
reg.exe (PID: 8292)
reg.exe (PID: 2452)
reg.exe (PID: 8072)
reg.exe (PID: 2936)
schtasks.exe (PID: 6424)
reg.exe (PID: 14120)
reg.exe (PID: 4292)
reg.exe (PID: 4480)
reg.exe (PID: 13620)
reg.exe (PID: 960)
reg.exe (PID: 6884)
schtasks.exe (PID: 6560)
cmd.exe (PID: 600)
forfiles.exe (PID: 8792)
cmd.exe (PID: 8592)
forfiles.exe (PID: 7768)
forfiles.exe (PID: 10800)
cmd.exe (PID: 11872)
forfiles.exe (PID: 11364)
cmd.exe (PID: 10916)
chrome.exe (PID: 3220)
chrome.exe (PID: 9736)
chrome.exe (PID: 11468)
chrome.exe (PID: 4672)
chrome.exe (PID: 12504)
chrome.exe (PID: 13728)
chrome.exe (PID: 10780)
chrome.exe (PID: 5176)
chrome.exe (PID: 12816)
chrome.exe (PID: 1040)
chrome.exe (PID: 4692)
chrome.exe (PID: 4628)
schtasks.exe (PID: 11288)
schtasks.exe (PID: 5828)
reg.exe (PID: 6576)
reg.exe (PID: 2428)
schtasks.exe (PID: 5284)
schtasks.exe (PID: 6504)
chrome.exe (PID: 1120)
chrome.exe (PID: 9504)
chrome.exe (PID: 9912)
chrome.exe (PID: 10992)
chrome.exe (PID: 11120)
chrome.exe (PID: 8768)
chrome.exe (PID: 10848)
chrome.exe (PID: 2492)
chrome.exe (PID: 4340)
taskkill.exe (PID: 8120)
chrome.exe (PID: 1144)
chrome.exe (PID: 7772)
chrome.exe (PID: 4688)
rundll32.exe (PID: 12176)
cmd.exe (PID: 10368)
forfiles.exe (PID: 3028)
cmd.exe (PID: 9128)
schtasks.exe (PID: 10724)
schtasks.exe (PID: 11316)
forfiles.exe (PID: 10148)
schtasks.exe (PID: 8748)
forfiles.exe (PID: 6324)
cmd.exe (PID: 2440)
schtasks.exe (PID: 12488)
forfiles.exe (PID: 12836)
cmd.exe (PID: 14052)
schtasks.exe (PID: 9132)
schtasks.exe (PID: 1628)
schtasks.exe (PID: 7724)
forfiles.exe (PID: 4268)
reg.exe (PID: 8212)
schtasks.exe (PID: 9992)
schtasks.exe (PID: 3092)
cmd.exe (PID: 7728)
reg.exe (PID: 4600)
forfiles.exe (PID: 4296)
cmd.exe (PID: 3520)
schtasks.exe (PID: 5644)
schtasks.exe (PID: 13352)
schtasks.exe (PID: 10848)
rundll32.EXE (PID: 7252)
schtasks.exe (PID: 11764)
forfiles.exe (PID: 9532)
cmd.exe (PID: 11988)
forfiles.exe (PID: 10116)
cmd.exe (PID: 6904)
schtasks.exe (PID: 6660)
gpupdate.exe (PID: 9340)
forfiles.exe (PID: 12056)
forfiles.exe (PID: 12856)
cmd.exe (PID: 12712)
cmd.exe (PID: 3744)
schtasks.exe (PID: 7968)
schtasks.exe (PID: 5364)
schtasks.exe (PID: 8088)
schtasks.exe (PID: 2692)
chrome.exe (PID: 3492)
chrome.exe (PID: 4336)
schtasks.exe (PID: 5136)
chrome.exe (PID: 10048)
chrome.exe (PID: 5800)
chrome.exe (PID: 13424)
chrome.exe (PID: 6420)
chrome.exe (PID: 13704)
chrome.exe (PID: 2672)
chrome.exe (PID: 4332)
schtasks.exe (PID: 7380)
chrome.exe (PID: 12660)
chrome.exe (PID: 9096)
reg.exe (PID: 9188)
reg.exe (PID: 10796)
schtasks.exe (PID: 9108)
chrome.exe (PID: 964)
chrome.exe (PID: 11864)
chrome.exe (PID: 12332)
chrome.exe (PID: 12228)
chrome.exe (PID: 13820)
chrome.exe (PID: 13264)
chrome.exe (PID: 924)
chrome.exe (PID: 10644)
chrome.exe (PID: 4340)
chrome.exe (PID: 8516)
chrome.exe (PID: 312)
chrome.exe (PID: 696)
chrome.exe (PID: 4404)
chrome.exe (PID: 612)

Application launched itself

chrome.exe (PID: 3408)
iexplore.exe (PID: 2764)
chrome.exe (PID: 3220)
chrome.exe (PID: 1120)
chrome.exe (PID: 3492)

Reads the computer name

chrome.exe (PID: 3408)
chrome.exe (PID: 1192)
chrome.exe (PID: 2068)
chrome.exe (PID: 4068)
chrome.exe (PID: 3816)
chrome.exe (PID: 2384)
chrome.exe (PID: 4032)
chrome.exe (PID: 3152)
iexplore.exe (PID: 2764)
iexplore.exe (PID: 2832)
msiexec.exe (PID: 8296)
MsiExec.exe (PID: 2828)
msiexec.exe (PID: 9308)
taskkill.exe (PID: 11180)
MsiExec.exe (PID: 11540)
taskkill.exe (PID: 12312)
MsiExec.exe (PID: 8128)
schtasks.exe (PID: 4324)
schtasks.exe (PID: 5020)
gpupdate.exe (PID: 7080)
schtasks.exe (PID: 13916)
schtasks.exe (PID: 13608)
taskkill.exe (PID: 2240)
schtasks.exe (PID: 6948)
schtasks.exe (PID: 7336)
taskkill.exe (PID: 14216)
schtasks.exe (PID: 2996)
schtasks.exe (PID: 4420)
gpupdate.exe (PID: 9476)
schtasks.exe (PID: 11220)
schtasks.exe (PID: 13976)
schtasks.exe (PID: 14092)
gpupdate.exe (PID: 2996)
PING.EXE (PID: 10820)
schtasks.exe (PID: 8256)
schtasks.exe (PID: 6560)
schtasks.exe (PID: 6424)
chrome.exe (PID: 3220)
chrome.exe (PID: 11468)
chrome.exe (PID: 4672)
chrome.exe (PID: 1040)
schtasks.exe (PID: 5284)
schtasks.exe (PID: 5828)
schtasks.exe (PID: 11288)
schtasks.exe (PID: 6504)
chrome.exe (PID: 1120)
chrome.exe (PID: 9912)
chrome.exe (PID: 2492)
chrome.exe (PID: 8768)
taskkill.exe (PID: 8120)
schtasks.exe (PID: 10724)
schtasks.exe (PID: 8748)
schtasks.exe (PID: 11316)
schtasks.exe (PID: 12488)
schtasks.exe (PID: 9132)
schtasks.exe (PID: 1628)
schtasks.exe (PID: 7724)
schtasks.exe (PID: 9992)
schtasks.exe (PID: 3092)
schtasks.exe (PID: 5644)
schtasks.exe (PID: 13352)
schtasks.exe (PID: 10848)
rundll32.EXE (PID: 7252)
schtasks.exe (PID: 6660)
schtasks.exe (PID: 11764)
gpupdate.exe (PID: 9340)
schtasks.exe (PID: 8088)
schtasks.exe (PID: 7968)
schtasks.exe (PID: 2692)
schtasks.exe (PID: 5364)
chrome.exe (PID: 3492)
schtasks.exe (PID: 5136)
chrome.exe (PID: 2672)
chrome.exe (PID: 10048)
chrome.exe (PID: 12660)
schtasks.exe (PID: 9108)
schtasks.exe (PID: 7380)
schtasks.exe (PID: 7132)

Reads the hosts file

chrome.exe (PID: 3408)
chrome.exe (PID: 2068)
chrome.exe (PID: 3220)
chrome.exe (PID: 4672)
chrome.exe (PID: 1120)
chrome.exe (PID: 8768)
chrome.exe (PID: 3492)
chrome.exe (PID: 12660)

Reads settings of System Certificates

chrome.exe (PID: 2068)
Sat09cd7ecbe4e.exe (PID: 3900)
Sat093d607fbd.exe (PID: 1784)
Sat098ac2475eba09.exe (PID: 1948)
Sat0942d118661ebeaa8.exe (PID: 2704)
EtalevzaJet.exe (PID: 2624)
4388790.scr (PID: 3304)
Sat09964f7c03.exe (PID: 2604)
SHubekuxosi.exe (PID: 2508)
Lapenyvove.exe (PID: 2224)
iexplore.exe (PID: 2832)
Sat095b4859b0823e.exe (PID: 2440)
6658114.scr (PID: 4088)
installer.exe (PID: 5168)
iexplore.exe (PID: 2764)
msiexec.exe (PID: 8296)
5027594.scr (PID: 8164)
MsiExec.exe (PID: 11540)
7199766.scr (PID: 5300)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
7569659.scr (PID: 6400)
powershell.exe (PID: 9896)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
OX9JYS5qmRA4EdjjP5PCiJZA.exe (PID: 284)
210921.exe (PID: 10700)
md8_8eus.exe (PID: 9548)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
dJCLxHxQZDUcgquW8kbgDPv5.exe (PID: 3044)
0z3PoRd1tUa6OrXEyLBFtU7w.exe (PID: 4548)
1970878.scr (PID: 2940)
Y9FTCIYuV8_r8wW73EKprVOX.exe (PID: 6684)
hU_UBw8xEkVuLEGr_i9oQfOh.exe (PID: 3904)
Z9Pg6Mcdby8d3Vse11c1atjo.exe (PID: 1192)
_wrR_3QX3WU3x4k5kIMIThoc.exe (PID: 12196)
2694936.scr (PID: 12996)
33231236756.exe (PID: 292)
3568351.scr (PID: 13252)
60248097993.exe (PID: 6284)
5268981.scr (PID: 5448)
1.exe (PID: 9584)
monns.exe (PID: 6208)
chrome.exe (PID: 4672)
hpzakXf.exe (PID: 8484)
chrome.exe (PID: 8768)
7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)
Mjx3l73uw0rE3b2IyZE4pYjm.exe (PID: 10844)
tmp84F7_tmp.exe (PID: 8824)
chrome.exe (PID: 12660)

Reads the date of Windows installation

chrome.exe (PID: 3152)
iexplore.exe (PID: 2764)

Manual execution by user

setup_x86_x64_install.exe (PID: 3452)
setup_x86_x64_install.exe (PID: 1388)
chrome.exe (PID: 3220)
chrome.exe (PID: 1120)

Checks Windows Trust Settings

Sat093d607fbd.exe (PID: 1784)
Sat0942d118661ebeaa8.exe (PID: 2704)
Sat09964f7c03.exe (PID: 2604)
iexplore.exe (PID: 2832)
installer.exe (PID: 5168)
iexplore.exe (PID: 2764)
msiexec.exe (PID: 8296)
MsiExec.exe (PID: 11540)
powershell.exe (PID: 9928)
4T_yEQFdA0NbyAglCztvLcIu.exe (PID: 4972)
2LpsnF_kRTEGUli6Fizw2wZf.exe (PID: 4988)
NoA5rq9gjZ9fn7LW27xWjwJw.exe (PID: 3760)
qT3dWYBP7ZsuOrwW4ZcUbjl6.exe (PID: 2816)
wscript.exe (PID: 13616)
hpzakXf.exe (PID: 8484)
7hUkpTHYi7HcHMI4pxCd6EqQ.exe (PID: 10624)

Dropped object may contain Bitcoin addresses

Sat098ac2475eba09.exe (PID: 1948)
z8Uf9BjP_axpSQTi78ukbx2C.exe (PID: 1968)

Application was dropped or rewritten from another process

Sat09127dfa8681ede0.tmp (PID: 1908)
EtalevzaJet.exe (PID: 2624)
ultramediaburner.tmp (PID: 1704)

Loads dropped or rewritten executable

Sat09127dfa8681ede0.tmp (PID: 1908)
ultramediaburner.tmp (PID: 1704)

Creates files in the program directory

EtalevzaJet.exe (PID: 2624)
ultramediaburner.tmp (PID: 1704)

Creates a software uninstall entry

ultramediaburner.tmp (PID: 1704)

Changes internet zones settings

iexplore.exe (PID: 2764)

Creates files in the user directory

iexplore.exe (PID: 2832)

Reads internet explorer settings

iexplore.exe (PID: 2832)
mshta.exe (PID: 12792)
mshta.exe (PID: 6444)

Check for Java to be installed

MsiExec.exe (PID: 2828)
MsiExec.exe (PID: 11540)

Reads Microsoft Office registry keys

MsiExec.exe (PID: 2828)
MsiExec.exe (PID: 11540)

Threats

PID	Process	Class	Message
2068	chrome.exe	A Network Trojan was detected	ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068	chrome.exe	A Network Trojan was detected	AV TROJAN Malware Dropper As a Service Download Request
2068	chrome.exe	Potentially Bad Traffic	AV INFO HTTP Request to a *.xyz domain
2068	chrome.exe	A Network Trojan was detected	ET TROJAN Fake Software Download Redirect Leading to Malware M3
2068	chrome.exe	A Network Trojan was detected	AV TROJAN Malware Dropper As a Service Download Request
2068	chrome.exe	Potentially Bad Traffic	AV INFO HTTP Request to a *.xyz domain
3952	setup_install.exe	A Network Trojan was detected	AV TROJAN GCleaner Downloader CnC Activity
3952	setup_install.exe	Potentially Bad Traffic	AV INFO HTTP Request to a *.xyz domain
2704	Sat0942d118661ebeaa8.exe	Generic Protocol Command Decode	SURICATA Applayer Mismatch protocol both directions
1908	Sat09127dfa8681ede0.tmp	Potential Corporate Privacy Violation	ET POLICY PE EXE or DLL Windows file download HTTP

Rows per page