URL:

https://keygenit.com

Full analysis: https://app.any.run/tasks/f198d4f5-2fd9-42f3-9413-7436bf966486
Verdict: Malicious activity
Threats:

AZORult can steal banking information, including passwords and credit card details, as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.

Malware Trends Tracker     >>>
Analysis date: July 01, 2021, 17:28:03
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
trojan
rat
azorult
stealer
loader
miner
fareit
pony
redline
phishing
raccoon
vidar
autoit
Indicators:
MD5:

BCFA353EE84FE11CF293E66C55124E32

SHA1:

77C3AF8081C31320D231D6255733A9DE65617A3D

SHA256:

7677B59893E89264916D647BA3FE01C2B505A091390E24C2E99E294EE4648E8C

SSDEEP:

3:N8FjI:2u

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • keygen-pr.exe (PID: 1864)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-3.exe (PID: 3436)
      • keygen-step-1.exe (PID: 1640)
      • keygen-step-6.exe (PID: 1540)
      • keygen-step-4.exe (PID: 3792)
      • keygen-step-5.exe (PID: 2928)
      • 7RVGe2foUeNR78.eXe (PID: 3356)
      • key.exe (PID: 3160)
      • key.exe (PID: 2440)
      • Crack.exe (PID: 1208)
      • note866.exe (PID: 1992)
      • E42.tmp.exe (PID: 3020)
      • GloryWSetp.exe (PID: 1860)
      • IDWCH1.exe (PID: 2236)
      • IDWCH1.exe (PID: 636)
      • WinHoster.exe (PID: 932)
      • 8274935.exe (PID: 2452)
      • 3118959.exe (PID: 2416)
      • 2C9A.tmp.exe (PID: 2672)
      • 7524462.exe (PID: 2488)
      • IDownload.exe (PID: 1016)
      • Nedaepiguqi.exe (PID: 672)
      • Givuladuqe.exe (PID: 2036)
      • hbggg.exe (PID: 1936)
      • hbggg.exe (PID: 1056)
      • IDownload.App.exe (PID: 3700)
      • EU.exe (PID: 9692)
      • JoSetp.exe (PID: 8344)
      • md6_6ydj.exe (PID: 8680)
      • Newouttab02.exe (PID: 6444)
      • ifhwwyy.exe (PID: 4956)
      • jfiag3g_gg.exe (PID: 1284)
      • jfiag3g_gg.exe (PID: 8512)
      • Setup3310.exe (PID: 6596)
      • google-game.exe (PID: 6516)
      • CHLbrowser.exe (PID: 4428)
      • CHLbrowser.exe (PID: 4536)
      • Era.exe.com (PID: 7544)
      • askinstall46.exe (PID: 5920)
      • Era.exe.com (PID: 7884)
      • jfiag3g_gg.exe (PID: 4392)
      • app.exe (PID: 9996)
      • jfiag3g_gg.exe (PID: 7136)
      • SunLabsPlayer.exe (PID: 9652)
      • guihuali-game.exe (PID: 4440)
      • jfiag3g_gg.exe (PID: 7924)
      • 7104202.exe (PID: 10060)
      • 4260177.exe (PID: 9104)
      • MediaBurner.exe (PID: 4432)
      • NMemo3Setp.exe (PID: 4240)
      • lylal220.exe (PID: 4608)
      • 5210961.exe (PID: 3352)
      • 7575117.exe (PID: 6356)
      • lighteningplayer-cache-gen.exe (PID: 5056)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)
      • hjjgaa.exe (PID: 4160)
      • jfiag3g_gg.exe (PID: 3808)
      • LabPicV3.exe (PID: 2336)
      • Jyjalunejo.exe (PID: 1232)
      • Lucasolaebi.exe (PID: 3936)
      • ultramediaburner.exe (PID: 5912)
      • libravpn_setup.exe (PID: 6256)
      • Tavexeqaehy.exe (PID: 4296)
      • prolab.exe (PID: 8932)
      • Winibyraebae.exe (PID: 5172)
      • irecord.exe (PID: 2648)
      • app.exe (PID: 9376)
      • ifhwwyy.exe (PID: 6452)
      • jfiag3g_gg.exe (PID: 3972)
      • Qefitutify.exe (PID: 9812)
      • ifhwwyy.exe (PID: 4868)
      • Setup3310.exe (PID: 6980)
      • jfiag3g_gg.exe (PID: 6084)
      • Setup3310.exe (PID: 8832)
      • jfiag3g_gg.exe (PID: 5444)
      • Peroxogeha.exe (PID: 5316)
      • google-game.exe (PID: 6200)
      • LibraVPN.exe (PID: 7012)
      • google-game.exe (PID: 4028)
      • jfiag3g_gg.exe (PID: 9304)
      • RegAsm.exe (PID: 7688)
      • Setup3310.exe (PID: 8196)
      • jfiag3g_gg.exe (PID: 6384)
      • ifhwwyy.exe (PID: 9544)
      • jfiag3g_gg.exe (PID: 5052)
      • google-game.exe (PID: 8828)
      • SunLabsPlayer.exe (PID: 6160)
      • SunLabsPlayer.exe (PID: 2436)
      • lighteningplayer-cache-gen.exe (PID: 4188)
      • lighteningplayer-cache-gen.exe (PID: 4820)

    • Drops executable file immediately after starts

      • keygen-pr.exe (PID: 1864)
      • keygen-step-4.exe (PID: 3792)
      • cmd.exe (PID: 1916)
      • Crack.exe (PID: 1208)
      • cmd.exe (PID: 2720)
      • 3118959.exe (PID: 2416)
      • IDWCH1.exe (PID: 2236)
      • IDWCH1.exe (PID: 636)
      • IDWCH1.tmp (PID: 2684)
      • IDownload.exe (PID: 1016)
      • IDownload.tmp (PID: 2932)
      • csc.exe (PID: 2468)
      • hbggg.exe (PID: 1936)
      • SunLabsPlayer.exe (PID: 9652)
      • MediaBurner.exe (PID: 4432)
      • MediaBurner.tmp (PID: 4852)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • ultramediaburner.exe (PID: 5912)

    • Stealing of credential data

      • keygen-step-3.exe (PID: 3436)
      • 8274935.exe (PID: 2452)
      • 7524462.exe (PID: 2488)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)
      • 5210961.exe (PID: 3352)
      • 6684865.exe (PID: 6916)
      • 7104202.exe (PID: 10060)

    • AZORULT was detected

      • keygen-step-1.exe (PID: 1640)

    • Connects to CnC server

      • keygen-step-1.exe (PID: 1640)
      • keygen-step-3.exe (PID: 3436)
      • key.exe (PID: 3160)
      • E42.tmp.exe (PID: 3020)
      • hbggg.exe (PID: 1936)
      • ifhwwyy.exe (PID: 4956)
      • hjjgaa.exe (PID: 4160)
      • ifhwwyy.exe (PID: 6452)
      • ifhwwyy.exe (PID: 4868)
      • ifhwwyy.exe (PID: 9544)

    • Runs PING.EXE for delay simulation

      • cmd.exe (PID: 2628)
      • cmd.exe (PID: 7332)

    • Registers / Runs the DLL via REGSVR32.EXE

      • cmd.exe (PID: 2720)

    • Loads dropped or rewritten executable

      • rUNdlL32.eXe (PID: 3148)
      • 8274935.exe (PID: 2452)
      • IDownload.App.exe (PID: 3700)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • rUNdlL32.eXe (PID: 8268)
      • SunLabsPlayer.exe (PID: 9652)
      • lighteningplayer-cache-gen.exe (PID: 5056)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)
      • SunLabsPlayer.exe (PID: 6160)
      • SunLabsPlayer.exe (PID: 2436)
      • lighteningplayer-cache-gen.exe (PID: 4820)
      • lighteningplayer-cache-gen.exe (PID: 4188)

    • Application was injected by another process

      • svchost.exe (PID: 872)

    • Runs injected code in another process

      • rUNdlL32.eXe (PID: 3148)
      • rUNdlL32.eXe (PID: 8836)
      • rUNdlL32.eXe (PID: 8268)
      • rUNdlL32.eXe (PID: 6584)
      • rUNdlL32.eXe (PID: 4696)
      • rUNdlL32.eXe (PID: 4444)

    • Changes settings of System certificates

      • E42.tmp.exe (PID: 3020)
      • Piiiiiiiip�87.exe (PID: 2788)
      • Setup3310.tmp (PID: 7128)

    • Steals credentials from Web Browsers

      • key.exe (PID: 3160)
      • 8274935.exe (PID: 2452)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)

    • Changes the autorun value in the registry

      • 3118959.exe (PID: 2416)
      • Piiiiiiiip�87.exe (PID: 2788)
      • hbggg.exe (PID: 1936)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • 758____Dawn.exe (PID: 8376)
      • ElZan�_��_.exe (PID: 9848)

    • Actions looks like stealing of personal data

      • key.exe (PID: 3160)
      • 8274935.exe (PID: 2452)
      • 7524462.exe (PID: 2488)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • Setup3310.tmp (PID: 7128)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)
      • 5210961.exe (PID: 3352)
      • 7104202.exe (PID: 10060)
      • RegAsm.exe (PID: 7688)

    • Writes to a start menu file

      • 2C9A.tmp.exe (PID: 2672)
      • Era.exe.com (PID: 7884)

    • Detected Pony/Fareit Trojan

      • key.exe (PID: 3160)

    • Starts Visual C# compiler

      • IDownload.App.exe (PID: 3700)

    • PONY was detected

      • key.exe (PID: 3160)

    • REDLINE was detected

      • 7524462.exe (PID: 2488)
      • 7104202.exe (PID: 10060)
      • 5210961.exe (PID: 3352)
      • RegAsm.exe (PID: 7688)

    • Runs app for hidden code execution

      • cmd.exe (PID: 7144)

    • RACCOON was detected

      • E42.tmp.exe (PID: 3020)

    • VIDAR was detected

      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)

  • SUSPICIOUS

    • Checks supported languages

      • WinRAR.exe (PID: 2272)
      • WinRAR.exe (PID: 2900)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-1.exe (PID: 1640)
      • keygen-pr.exe (PID: 1864)
      • cmd.exe (PID: 2064)
      • keygen-step-6.exe (PID: 1540)
      • keygen-step-5.exe (PID: 2928)
      • keygen-step-3.exe (PID: 3436)
      • keygen-step-4.exe (PID: 3792)
      • cmd.exe (PID: 1916)
      • 7RVGe2foUeNR78.eXe (PID: 3356)
      • Crack.exe (PID: 1208)
      • cmd.exe (PID: 2988)
      • cmd.exe (PID: 2720)
      • cmd.exe (PID: 3332)
      • key.exe (PID: 3160)
      • cmd.exe (PID: 2628)
      • cmd.exe (PID: 2220)
      • key.exe (PID: 2440)
      • note866.exe (PID: 1992)
      • svchost.exe (PID: 872)
      • E42.tmp.exe (PID: 3020)
      • GloryWSetp.exe (PID: 1860)
      • 8274935.exe (PID: 2452)
      • 3118959.exe (PID: 2416)
      • 7524462.exe (PID: 2488)
      • WinHoster.exe (PID: 932)
      • IDWCH1.exe (PID: 2236)
      • 2C9A.tmp.exe (PID: 2672)
      • IDWCH1.exe (PID: 636)
      • IDWCH1.tmp (PID: 3436)
      • IDWCH1.tmp (PID: 2684)
      • Piiiiiiiip�87.exe (PID: 2788)
      • cmd.exe (PID: 3000)
      • IDownload.exe (PID: 1016)
      • IDownload.tmp (PID: 2932)
      • IDownload.App.exe (PID: 3700)
      • csc.exe (PID: 2468)
      • Givuladuqe.exe (PID: 2036)
      • Nedaepiguqi.exe (PID: 672)
      • cvtres.exe (PID: 3844)
      • hbggg.exe (PID: 1936)
      • hbggg.exe (PID: 1056)
      • jfiag3g_gg.exe (PID: 1284)
      • EU.exe (PID: 9692)
      • cmd.exe (PID: 9216)
      • cmd.exe (PID: 6260)
      • Newouttab02.exe (PID: 6444)
      • cmd.exe (PID: 7144)
      • cmd.exe (PID: 7332)
      • cmd.exe (PID: 6608)
      • Era.exe.com (PID: 7884)
      • jfiag3g_gg.exe (PID: 8512)
      • JoSetp.exe (PID: 8344)
      • Era.exe.com (PID: 7544)
      • cmd.exe (PID: 896)
      • md6_6ydj.exe (PID: 8680)
      • cmd.exe (PID: 9936)
      • cmd.exe (PID: 6804)
      • cmd.exe (PID: 4800)
      • ifhwwyy.exe (PID: 4956)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 6188)
      • Setup3310.exe (PID: 6596)
      • Setup3310.tmp (PID: 7128)
      • cmd.exe (PID: 5956)
      • google-game.exe (PID: 6516)
      • cmd.exe (PID: 9044)
      • CHLbrowser.exe (PID: 4428)
      • cmd.exe (PID: 4280)
      • askinstall46.exe (PID: 5920)
      • cmd.exe (PID: 5724)
      • CHLbrowser.exe (PID: 4536)
      • cmd.exe (PID: 9620)
      • jfiag3g_gg.exe (PID: 4392)
      • cmd.exe (PID: 5484)
      • app.exe (PID: 9996)
      • jfiag3g_gg.exe (PID: 7136)
      • cmd.exe (PID: 9272)
      • SunLabsPlayer.exe (PID: 9652)
      • cmd.exe (PID: 8528)
      • Setup.exe (PID: 3164)
      • RunWW.exe (PID: 4192)
      • LabPicV3.exe (PID: 2336)
      • lylal220.exe (PID: 4608)
      • guihuali-game.exe (PID: 4440)
      • hjjgaa.exe (PID: 4160)
      • NMemo3Setp.exe (PID: 4240)
      • MediaBurner.exe (PID: 4432)
      • MediaBurner.tmp (PID: 4852)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • jfiag3g_gg.exe (PID: 7924)
      • 758____Dawn.exe (PID: 8376)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ElZan�_��_.exe (PID: 9848)
      • 6684865.exe (PID: 6916)
      • 7575117.exe (PID: 6356)
      • 4260177.exe (PID: 9104)
      • 7104202.exe (PID: 10060)
      • ns140D.tmp (PID: 9404)
      • powershell.exe (PID: 9972)
      • 5210961.exe (PID: 3352)
      • ns214C.tmp (PID: 4836)
      • ultramediaburner.exe (PID: 5912)
      • jfiag3g_gg.exe (PID: 3808)
      • lighteningplayer-cache-gen.exe (PID: 5056)
      • ultramediaburner.tmp (PID: 7016)
      • cmd.exe (PID: 7544)
      • libravpn_setup.exe (PID: 6256)
      • prolab.exe (PID: 8932)
      • prolab.tmp (PID: 6780)
      • UltraMediaBurner.exe (PID: 8624)
      • libravpn_setup.tmp (PID: 6732)
      • Jyjalunejo.exe (PID: 1232)
      • Lucasolaebi.exe (PID: 3936)
      • Tavexeqaehy.exe (PID: 4296)
      • Winibyraebae.exe (PID: 5172)
      • LibraVPN.exe (PID: 7012)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 9028)
      • app.exe (PID: 9376)
      • irecord.exe (PID: 2648)
      • cmd.exe (PID: 3428)
      • irecord.tmp (PID: 3816)
      • cmd.exe (PID: 2104)
      • chcp.com (PID: 4468)
      • cmd.exe (PID: 4888)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 5668)
      • cmd.exe (PID: 7788)
      • Qefitutify.exe (PID: 9812)
      • cmd.exe (PID: 8512)
      • ifhwwyy.exe (PID: 6452)
      • jfiag3g_gg.exe (PID: 3972)
      • I-Record.exe (PID: 10116)
      • chcp.com (PID: 9604)
      • cmd.exe (PID: 9520)
      • cmd.exe (PID: 3296)
      • chcp.com (PID: 3696)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 2300)
      • cmd.exe (PID: 8456)
      • ifhwwyy.exe (PID: 4868)
      • cmd.exe (PID: 7848)
      • chcp.com (PID: 5400)
      • cmd.exe (PID: 5644)
      • cmd.exe (PID: 5780)
      • jfiag3g_gg.exe (PID: 6084)
      • chcp.com (PID: 6920)
      • Setup3310.exe (PID: 6980)
      • Setup3310.tmp (PID: 7904)
      • cmd.exe (PID: 8508)
      • cmd.exe (PID: 9412)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 8528)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.exe (PID: 8832)
      • chcp.com (PID: 10144)
      • cmd.exe (PID: 9096)
      • chcp.com (PID: 4408)
      • cmd.exe (PID: 4952)
      • cmd.exe (PID: 1032)
      • jfiag3g_gg.exe (PID: 5444)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 4536)
      • RegAsm.exe (PID: 7688)
      • cmd.exe (PID: 2552)
      • chcp.com (PID: 3012)
      • Peroxogeha.exe (PID: 5316)
      • cmd.exe (PID: 7508)
      • google-game.exe (PID: 6200)
      • cmd.exe (PID: 3040)
      • google-game.exe (PID: 4028)
      • jfiag3g_gg.exe (PID: 9304)
      • cmd.exe (PID: 5692)
      • cmd.exe (PID: 9228)
      • cmd.exe (PID: 7944)
      • cmd.exe (PID: 9868)
      • cmd.exe (PID: 9160)
      • jfiag3g_gg.exe (PID: 5052)
      • cmd.exe (PID: 3728)
      • Setup3310.exe (PID: 8196)
      • cmd.exe (PID: 3620)
      • Setup3310.tmp (PID: 5808)
      • jfiag3g_gg.exe (PID: 6384)
      • ifhwwyy.exe (PID: 9544)
      • cmd.exe (PID: 4532)
      • cmd.exe (PID: 7532)
      • chcp.com (PID: 8724)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 3376)
      • cmd.exe (PID: 8992)
      • google-game.exe (PID: 8828)
      • cmd.exe (PID: 9992)
      • SunLabsPlayer.exe (PID: 6160)
      • cmd.exe (PID: 9692)
      • cmd.exe (PID: 7728)
      • cmd.exe (PID: 9484)
      • cmd.exe (PID: 4044)
      • cmd.exe (PID: 6720)
      • cmd.exe (PID: 4172)
      • cmd.exe (PID: 9720)
      • ns1EA7.tmp (PID: 9208)
      • powershell.exe (PID: 9244)
      • SunLabsPlayer.exe (PID: 2436)
      • lighteningplayer-cache-gen.exe (PID: 4820)
      • ns2936.tmp (PID: 7884)
      • powershell.exe (PID: 6656)
      • lighteningplayer-cache-gen.exe (PID: 4188)
      • cmd.exe (PID: 7828)
      • cmd.exe (PID: 1584)
      • ns329D.tmp (PID: 5984)
      • ns288B.tmp (PID: 7676)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2900)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-pr.exe (PID: 1864)
      • keygen-step-4.exe (PID: 3792)
      • cmd.exe (PID: 1916)
      • Crack.exe (PID: 1208)
      • cmd.exe (PID: 2720)
      • keygen-step-6.exe (PID: 1540)
      • GloryWSetp.exe (PID: 1860)
      • 3118959.exe (PID: 2416)
      • IDWCH1.exe (PID: 2236)
      • IDWCH1.exe (PID: 636)
      • IDWCH1.tmp (PID: 2684)
      • 2C9A.tmp.exe (PID: 2672)
      • 8274935.exe (PID: 2452)
      • Piiiiiiiip�87.exe (PID: 2788)
      • IDownload.exe (PID: 1016)
      • IDownload.tmp (PID: 2932)
      • csc.exe (PID: 2468)
      • E42.tmp.exe (PID: 3020)
      • Nedaepiguqi.exe (PID: 672)
      • hbggg.exe (PID: 1936)
      • Newouttab02.exe (PID: 6444)
      • Era.exe.com (PID: 7884)
      • Setup3310.tmp (PID: 7128)
      • Setup.exe (PID: 3164)
      • SunLabsPlayer.exe (PID: 9652)
      • MediaBurner.exe (PID: 4432)
      • lylal220.exe (PID: 4608)
      • MediaBurner.tmp (PID: 4852)
      • LabPicV3.exe (PID: 2336)
      • LabPicV3.tmp (PID: 5192)
      • lylal220.tmp (PID: 5256)
      • JoSetp.exe (PID: 8344)
      • hjjgaa.exe (PID: 4160)
      • NMemo3Setp.exe (PID: 4240)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ultramediaburner.exe (PID: 5912)
      • 758____Dawn.exe (PID: 8376)
      • 6684865.exe (PID: 6916)
      • RunWW.exe (PID: 4192)
      • libravpn_setup.tmp (PID: 6732)
      • ElZan�_��_.exe (PID: 9848)
      • ifhwwyy.exe (PID: 4956)
      • Winibyraebae.exe (PID: 5172)
      • Tavexeqaehy.exe (PID: 4296)
      • Peroxogeha.exe (PID: 5316)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.tmp (PID: 5808)
      • Setup3310.tmp (PID: 7904)

    • Drops a file that was compiled in debug mode

      • WinRAR.exe (PID: 2900)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-4.exe (PID: 3792)
      • cmd.exe (PID: 1916)
      • Crack.exe (PID: 1208)
      • keygen-step-6.exe (PID: 1540)
      • IDWCH1.tmp (PID: 2684)
      • 8274935.exe (PID: 2452)
      • IDownload.tmp (PID: 2932)
      • hbggg.exe (PID: 1936)
      • Nedaepiguqi.exe (PID: 672)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • SunLabsPlayer.exe (PID: 9652)
      • Setup.exe (PID: 3164)
      • MediaBurner.tmp (PID: 4852)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)
      • libravpn_setup.tmp (PID: 6732)
      • Tavexeqaehy.exe (PID: 4296)
      • Winibyraebae.exe (PID: 5172)
      • Era.exe.com (PID: 7884)

    • Reads the computer name

      • WinRAR.exe (PID: 2272)
      • WinRAR.exe (PID: 2900)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-6.exe (PID: 1540)
      • keygen-pr.exe (PID: 1864)
      • keygen-step-1.exe (PID: 1640)
      • keygen-step-5.exe (PID: 2928)
      • keygen-step-4.exe (PID: 3792)
      • keygen-step-3.exe (PID: 3436)
      • 7RVGe2foUeNR78.eXe (PID: 3356)
      • Crack.exe (PID: 1208)
      • key.exe (PID: 2440)
      • E42.tmp.exe (PID: 3020)
      • GloryWSetp.exe (PID: 1860)
      • key.exe (PID: 3160)
      • 8274935.exe (PID: 2452)
      • 3118959.exe (PID: 2416)
      • 7524462.exe (PID: 2488)
      • WinHoster.exe (PID: 932)
      • IDWCH1.tmp (PID: 3436)
      • IDWCH1.tmp (PID: 2684)
      • Piiiiiiiip�87.exe (PID: 2788)
      • IDownload.App.exe (PID: 3700)
      • IDownload.tmp (PID: 2932)
      • Givuladuqe.exe (PID: 2036)
      • Nedaepiguqi.exe (PID: 672)
      • hbggg.exe (PID: 1936)
      • hbggg.exe (PID: 1056)
      • jfiag3g_gg.exe (PID: 1284)
      • EU.exe (PID: 9692)
      • JoSetp.exe (PID: 8344)
      • Newouttab02.exe (PID: 6444)
      • Era.exe.com (PID: 7884)
      • ifhwwyy.exe (PID: 4956)
      • Setup3310.tmp (PID: 7128)
      • google-game.exe (PID: 6516)
      • CHLbrowser.exe (PID: 4428)
      • askinstall46.exe (PID: 5920)
      • jfiag3g_gg.exe (PID: 4392)
      • IDownload.exe (PID: 1016)
      • SunLabsPlayer.exe (PID: 9652)
      • Setup.exe (PID: 3164)
      • NMemo3Setp.exe (PID: 4240)
      • MediaBurner.tmp (PID: 4852)
      • hjjgaa.exe (PID: 4160)
      • LabPicV3.tmp (PID: 5192)
      • lylal220.tmp (PID: 5256)
      • guihuali-game.exe (PID: 4440)
      • jfiag3g_gg.exe (PID: 7924)
      • 758____Dawn.exe (PID: 8376)
      • ElZan�_��_.exe (PID: 9848)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • 6684865.exe (PID: 6916)
      • 7575117.exe (PID: 6356)
      • 4260177.exe (PID: 9104)
      • powershell.exe (PID: 9972)
      • 7104202.exe (PID: 10060)
      • 5210961.exe (PID: 3352)
      • ultramediaburner.tmp (PID: 7016)
      • RunWW.exe (PID: 4192)
      • prolab.tmp (PID: 6780)
      • UltraMediaBurner.exe (PID: 8624)
      • libravpn_setup.tmp (PID: 6732)
      • Jyjalunejo.exe (PID: 1232)
      • Tavexeqaehy.exe (PID: 4296)
      • Lucasolaebi.exe (PID: 3936)
      • Winibyraebae.exe (PID: 5172)
      • LibraVPN.exe (PID: 7012)
      • irecord.tmp (PID: 3816)
      • I-Record.exe (PID: 10116)
      • Qefitutify.exe (PID: 9812)
      • ifhwwyy.exe (PID: 6452)
      • jfiag3g_gg.exe (PID: 3972)
      • app.exe (PID: 9996)
      • ifhwwyy.exe (PID: 4868)
      • app.exe (PID: 9376)
      • jfiag3g_gg.exe (PID: 6084)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • RegAsm.exe (PID: 7688)
      • Peroxogeha.exe (PID: 5316)
      • google-game.exe (PID: 6200)
      • google-game.exe (PID: 4028)
      • ifhwwyy.exe (PID: 9544)
      • jfiag3g_gg.exe (PID: 5052)
      • Setup3310.tmp (PID: 5808)
      • google-game.exe (PID: 8828)
      • SunLabsPlayer.exe (PID: 6160)
      • powershell.exe (PID: 9244)
      • SunLabsPlayer.exe (PID: 2436)
      • powershell.exe (PID: 6656)

    • Drops a file with too old compile date

      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-4.exe (PID: 3792)
      • Crack.exe (PID: 1208)
      • cmd.exe (PID: 2720)
      • IDWCH1.exe (PID: 2236)
      • IDWCH1.exe (PID: 636)
      • IDWCH1.tmp (PID: 2684)
      • Piiiiiiiip�87.exe (PID: 2788)
      • IDownload.exe (PID: 1016)
      • IDownload.tmp (PID: 2932)
      • E42.tmp.exe (PID: 3020)
      • Nedaepiguqi.exe (PID: 672)
      • Setup3310.tmp (PID: 7128)
      • Setup.exe (PID: 3164)
      • SunLabsPlayer.exe (PID: 9652)
      • MediaBurner.exe (PID: 4432)
      • lylal220.exe (PID: 4608)
      • MediaBurner.tmp (PID: 4852)
      • LabPicV3.exe (PID: 2336)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ultramediaburner.exe (PID: 5912)
      • 758____Dawn.exe (PID: 8376)
      • libravpn_setup.tmp (PID: 6732)
      • ElZan�_��_.exe (PID: 9848)
      • Tavexeqaehy.exe (PID: 4296)
      • Winibyraebae.exe (PID: 5172)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.tmp (PID: 5808)

    • Drops a file with a compile date too recent

      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-4.exe (PID: 3792)
      • GloryWSetp.exe (PID: 1860)
      • 3118959.exe (PID: 2416)
      • csc.exe (PID: 2468)
      • Piiiiiiiip�87.exe (PID: 2788)
      • hbggg.exe (PID: 1936)
      • Nedaepiguqi.exe (PID: 672)
      • E42.tmp.exe (PID: 3020)
      • Setup.exe (PID: 3164)
      • NMemo3Setp.exe (PID: 4240)
      • JoSetp.exe (PID: 8344)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • 758____Dawn.exe (PID: 8376)
      • libravpn_setup.tmp (PID: 6732)
      • ElZan�_��_.exe (PID: 9848)
      • Tavexeqaehy.exe (PID: 4296)
      • Winibyraebae.exe (PID: 5172)

    • Starts CMD.EXE for commands execution

      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)
      • keygen-step-5.exe (PID: 2928)
      • 7RVGe2foUeNR78.eXe (PID: 3356)
      • keygen-step-3.exe (PID: 3436)
      • cmd.exe (PID: 2720)
      • keygen-step-6.exe (PID: 1540)
      • Nedaepiguqi.exe (PID: 672)
      • cmd.exe (PID: 7144)
      • EU.exe (PID: 9692)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)
      • Tavexeqaehy.exe (PID: 4296)
      • cmd.exe (PID: 2104)
      • LibraVPN.exe (PID: 7012)
      • Winibyraebae.exe (PID: 5172)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 8508)
      • cmd.exe (PID: 9096)
      • cmd.exe (PID: 1032)
      • cmd.exe (PID: 7104)
      • Peroxogeha.exe (PID: 5316)

    • Reads Environment values

      • keygen-step-1.exe (PID: 1640)
      • key.exe (PID: 2440)
      • GloryWSetp.exe (PID: 1860)
      • 8274935.exe (PID: 2452)
      • Piiiiiiiip�87.exe (PID: 2788)
      • 7524462.exe (PID: 2488)
      • Givuladuqe.exe (PID: 2036)
      • Nedaepiguqi.exe (PID: 672)
      • JoSetp.exe (PID: 8344)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • NMemo3Setp.exe (PID: 4240)
      • 758____Dawn.exe (PID: 8376)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ElZan�_��_.exe (PID: 9848)
      • 6684865.exe (PID: 6916)
      • 7104202.exe (PID: 10060)
      • Jyjalunejo.exe (PID: 1232)
      • 5210961.exe (PID: 3352)
      • RunWW.exe (PID: 4192)
      • Lucasolaebi.exe (PID: 3936)
      • Tavexeqaehy.exe (PID: 4296)
      • Winibyraebae.exe (PID: 5172)
      • LibraVPN.exe (PID: 7012)
      • netsh.exe (PID: 5028)
      • Qefitutify.exe (PID: 9812)
      • netsh.exe (PID: 9720)
      • netsh.exe (PID: 3364)
      • netsh.exe (PID: 7192)
      • netsh.exe (PID: 8592)
      • netsh.exe (PID: 8672)
      • netsh.exe (PID: 9128)
      • Peroxogeha.exe (PID: 5316)
      • RegAsm.exe (PID: 7688)

    • Uses TASKKILL.EXE to kill process

      • cmd.exe (PID: 1916)
      • cmd.exe (PID: 9044)
      • cmd.exe (PID: 7536)
      • cmd.exe (PID: 2552)

    • Reads the date of Windows installation

      • Crack.exe (PID: 1208)
      • google-game.exe (PID: 6516)
      • guihuali-game.exe (PID: 4440)
      • powershell.exe (PID: 9972)
      • google-game.exe (PID: 6200)
      • google-game.exe (PID: 4028)
      • google-game.exe (PID: 8828)
      • powershell.exe (PID: 9244)
      • powershell.exe (PID: 6656)

    • Starts CMD.EXE for self-deleting

      • keygen-step-3.exe (PID: 3436)
      • keygen-step-6.exe (PID: 1540)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)

    • Application launched itself

      • cmd.exe (PID: 2720)
      • key.exe (PID: 3160)
      • hbggg.exe (PID: 1056)
      • cmd.exe (PID: 7144)
      • Era.exe.com (PID: 7544)
      • CHLbrowser.exe (PID: 4428)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 8508)
      • cmd.exe (PID: 9096)
      • cmd.exe (PID: 1032)
      • cmd.exe (PID: 7104)

    • Reads Windows owner or organization settings

      • key.exe (PID: 2440)
      • IDWCH1.tmp (PID: 2684)
      • IDownload.tmp (PID: 2932)
      • Setup3310.tmp (PID: 7128)
      • MediaBurner.tmp (PID: 4852)
      • LabPicV3.tmp (PID: 5192)
      • lylal220.tmp (PID: 5256)
      • ultramediaburner.tmp (PID: 7016)
      • libravpn_setup.tmp (PID: 6732)
      • prolab.tmp (PID: 6780)
      • irecord.tmp (PID: 3816)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.tmp (PID: 5808)

    • Reads Windows Product ID

      • key.exe (PID: 2440)

    • Reads the Windows organization settings

      • key.exe (PID: 2440)
      • IDWCH1.tmp (PID: 2684)
      • IDownload.tmp (PID: 2932)
      • Setup3310.tmp (PID: 7128)
      • MediaBurner.tmp (PID: 4852)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • ultramediaburner.tmp (PID: 7016)
      • libravpn_setup.tmp (PID: 6732)
      • prolab.tmp (PID: 6780)
      • irecord.tmp (PID: 3816)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.tmp (PID: 5808)

    • Uses RUNDLL32.EXE to load library

      • Crack.exe (PID: 1208)
      • google-game.exe (PID: 6516)
      • guihuali-game.exe (PID: 4440)
      • google-game.exe (PID: 4028)
      • google-game.exe (PID: 6200)
      • google-game.exe (PID: 8828)

    • Creates files in the user directory

      • keygen-step-6.exe (PID: 1540)
      • key.exe (PID: 3160)
      • GloryWSetp.exe (PID: 1860)
      • 3118959.exe (PID: 2416)
      • 2C9A.tmp.exe (PID: 2672)
      • Era.exe.com (PID: 7884)
      • SunLabsPlayer.exe (PID: 9652)
      • JoSetp.exe (PID: 8344)
      • NMemo3Setp.exe (PID: 4240)
      • powershell.exe (PID: 9972)
      • libravpn_setup.tmp (PID: 6732)
      • powershell.exe (PID: 9244)
      • powershell.exe (PID: 6656)

    • Adds / modifies Windows certificates

      • E42.tmp.exe (PID: 3020)
      • Piiiiiiiip�87.exe (PID: 2788)
      • Setup3310.tmp (PID: 7128)

    • Loads DLL from Mozilla Firefox

      • key.exe (PID: 3160)

    • Starts itself from another location

      • 3118959.exe (PID: 2416)

    • Dropped object may contain URLs of mainers pools

      • keygen-step-6.exe (PID: 1540)

    • Creates files in the program directory

      • 8274935.exe (PID: 2452)
      • Newouttab02.exe (PID: 6444)
      • SunLabsPlayer.exe (PID: 9652)
      • lighteningplayer-cache-gen.exe (PID: 5056)
      • RunWW.exe (PID: 4192)
      • 6684865.exe (PID: 6916)
      • LibraVPN.exe (PID: 7012)
      • lighteningplayer-cache-gen.exe (PID: 4820)
      • lighteningplayer-cache-gen.exe (PID: 4188)

    • Creates a directory in Program Files

      • Piiiiiiiip�87.exe (PID: 2788)
      • IDownload.tmp (PID: 2932)
      • SunLabsPlayer.exe (PID: 9652)
      • Setup.exe (PID: 3164)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ElZan�_��_.exe (PID: 9848)
      • 758____Dawn.exe (PID: 8376)
      • ultramediaburner.tmp (PID: 7016)
      • libravpn_setup.tmp (PID: 6732)
      • prolab.tmp (PID: 6780)
      • LibraVPN.exe (PID: 7012)
      • irecord.tmp (PID: 3816)

    • Reads the cookies of Mozilla Firefox

      • 8274935.exe (PID: 2452)

    • Searches for installed software

      • 8274935.exe (PID: 2452)
      • key.exe (PID: 3160)
      • 7524462.exe (PID: 2488)
      • key.exe (PID: 2440)
      • E42.tmp.exe (PID: 3020)
      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)
      • 7104202.exe (PID: 10060)
      • 6684865.exe (PID: 6916)
      • 5210961.exe (PID: 3352)
      • RegAsm.exe (PID: 7688)

    • Executed via COM

      • iexplore.exe (PID: 2964)

    • Starts Internet Explorer

      • Givuladuqe.exe (PID: 2036)
      • Jyjalunejo.exe (PID: 1232)
      • Lucasolaebi.exe (PID: 3936)
      • Qefitutify.exe (PID: 9812)

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 2264)
      • iexplore.exe (PID: 9456)
      • LibraVPN.exe (PID: 7012)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7332)
      • Era.exe.com (PID: 7544)
      • SunLabsPlayer.exe (PID: 9652)
      • cmd.exe (PID: 2104)
      • cmd.exe (PID: 3296)
      • cmd.exe (PID: 7988)
      • cmd.exe (PID: 7848)
      • cmd.exe (PID: 8508)
      • cmd.exe (PID: 9096)
      • cmd.exe (PID: 1032)
      • cmd.exe (PID: 7104)
      • cmd.exe (PID: 7536)
      • SunLabsPlayer.exe (PID: 6160)
      • SunLabsPlayer.exe (PID: 2436)
      • cmd.exe (PID: 5740)

    • Executes application which crashes

      • cmd.exe (PID: 6608)
      • cmd.exe (PID: 9936)
      • cmd.exe (PID: 8528)
      • cmd.exe (PID: 3428)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 5668)
      • cmd.exe (PID: 7788)
      • cmd.exe (PID: 7944)
      • cmd.exe (PID: 9228)
      • cmd.exe (PID: 9484)
      • cmd.exe (PID: 4172)

    • Reads mouse settings

      • Era.exe.com (PID: 7884)
      • Era.exe.com (PID: 7544)

    • Drop AutoIt3 executable file

      • Era.exe.com (PID: 7884)

    • Checks for external IP

      • hbggg.exe (PID: 1936)
      • Setup3310.tmp (PID: 7128)
      • hjjgaa.exe (PID: 4160)
      • ifhwwyy.exe (PID: 4868)
      • ifhwwyy.exe (PID: 6452)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • ifhwwyy.exe (PID: 9544)
      • Setup3310.tmp (PID: 5808)

    • Reads CPU info

      • Newouttab02.exe (PID: 6444)
      • RunWW.exe (PID: 4192)

    • Creates a software uninstall entry

      • SunLabsPlayer.exe (PID: 9652)
      • SunLabsPlayer.exe (PID: 6160)
      • SunLabsPlayer.exe (PID: 2436)

    • Executes PowerShell scripts

      • ns140D.tmp (PID: 9404)
      • ns1EA7.tmp (PID: 9208)
      • ns2936.tmp (PID: 7884)

    • Uses NETSH.EXE for network configuration

      • cmd.exe (PID: 4888)
      • cmd.exe (PID: 9520)
      • cmd.exe (PID: 2300)
      • cmd.exe (PID: 5644)
      • cmd.exe (PID: 9412)
      • cmd.exe (PID: 3148)
      • cmd.exe (PID: 4952)

    • Uses IPCONFIG.EXE to discover IP address

      • cmd.exe (PID: 4536)

    • Reads internet explorer settings

      • LibraVPN.exe (PID: 7012)

  • INFO

    • Checks supported languages

      • chrome.exe (PID: 1804)
      • chrome.exe (PID: 2260)
      • chrome.exe (PID: 2616)
      • chrome.exe (PID: 4048)
      • chrome.exe (PID: 2516)
      • chrome.exe (PID: 1624)
      • chrome.exe (PID: 1620)
      • chrome.exe (PID: 1408)
      • chrome.exe (PID: 3000)
      • chrome.exe (PID: 3576)
      • chrome.exe (PID: 1576)
      • chrome.exe (PID: 3764)
      • chrome.exe (PID: 1032)
      • chrome.exe (PID: 2664)
      • taskkill.exe (PID: 3596)
      • PING.EXE (PID: 3832)
      • regsvr32.exe (PID: 272)
      • rUNdlL32.eXe (PID: 3148)
      • PING.EXE (PID: 760)
      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 2740)
      • ntvdm.exe (PID: 6764)
      • findstr.exe (PID: 7436)
      • PING.EXE (PID: 7664)
      • ntvdm.exe (PID: 10112)
      • timeout.exe (PID: 4208)
      • taskkill.exe (PID: 9168)
      • timeout.exe (PID: 9740)
      • rUNdlL32.eXe (PID: 8836)
      • ntvdm.exe (PID: 1584)
      • rUNdlL32.eXe (PID: 8268)
      • iexplore.exe (PID: 4516)
      • iexplore.exe (PID: 5332)
      • taskkill.exe (PID: 7996)
      • iexplore.exe (PID: 9192)
      • iexplore.exe (PID: 2264)
      • timeout.exe (PID: 9776)
      • ntvdm.exe (PID: 9360)
      • ntvdm.exe (PID: 7208)
      • ntvdm.exe (PID: 7452)
      • netsh.exe (PID: 5028)
      • ntvdm.exe (PID: 7064)
      • netsh.exe (PID: 9720)
      • netsh.exe (PID: 3364)
      • netsh.exe (PID: 7192)
      • iexplore.exe (PID: 9456)
      • netsh.exe (PID: 8592)
      • iexplore.exe (PID: 6908)
      • netsh.exe (PID: 8672)
      • netsh.exe (PID: 9128)
      • ipconfig.exe (PID: 6764)
      • taskkill.exe (PID: 8284)
      • rUNdlL32.eXe (PID: 4696)
      • rUNdlL32.eXe (PID: 6584)
      • ntvdm.exe (PID: 7964)
      • ntvdm.exe (PID: 9444)
      • rUNdlL32.eXe (PID: 4444)
      • ntvdm.exe (PID: 6200)
      • ntvdm.exe (PID: 9996)

    • Reads the computer name

      • chrome.exe (PID: 2260)
      • chrome.exe (PID: 1620)
      • chrome.exe (PID: 1624)
      • chrome.exe (PID: 1408)
      • chrome.exe (PID: 3576)
      • chrome.exe (PID: 1576)
      • chrome.exe (PID: 1032)
      • taskkill.exe (PID: 3596)
      • PING.EXE (PID: 3832)
      • rUNdlL32.eXe (PID: 3148)
      • PING.EXE (PID: 760)
      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 2548)
      • PING.EXE (PID: 7664)
      • rUNdlL32.eXe (PID: 8836)
      • taskkill.exe (PID: 9168)
      • rUNdlL32.eXe (PID: 8268)
      • iexplore.exe (PID: 4516)
      • iexplore.exe (PID: 5332)
      • taskkill.exe (PID: 7996)
      • iexplore.exe (PID: 9192)
      • iexplore.exe (PID: 2264)
      • netsh.exe (PID: 5028)
      • netsh.exe (PID: 9720)
      • netsh.exe (PID: 3364)
      • netsh.exe (PID: 7192)
      • iexplore.exe (PID: 6908)
      • netsh.exe (PID: 8592)
      • iexplore.exe (PID: 9456)
      • netsh.exe (PID: 8672)
      • netsh.exe (PID: 9128)
      • ipconfig.exe (PID: 6764)
      • taskkill.exe (PID: 8284)
      • rUNdlL32.eXe (PID: 6584)
      • rUNdlL32.eXe (PID: 4696)
      • rUNdlL32.eXe (PID: 4444)

    • Application launched itself

      • chrome.exe (PID: 1624)
      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 4516)

    • Reads the hosts file

      • chrome.exe (PID: 2260)
      • chrome.exe (PID: 1624)

    • Reads settings of System Certificates

      • chrome.exe (PID: 2260)
      • keygen-step-6.exe (PID: 1540)
      • E42.tmp.exe (PID: 3020)
      • GloryWSetp.exe (PID: 1860)
      • Piiiiiiiip�87.exe (PID: 2788)
      • 8274935.exe (PID: 2452)
      • 7524462.exe (PID: 2488)
      • Givuladuqe.exe (PID: 2036)
      • Nedaepiguqi.exe (PID: 672)
      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 2964)
      • hbggg.exe (PID: 1936)
      • Newouttab02.exe (PID: 6444)
      • iexplore.exe (PID: 2740)
      • Setup3310.tmp (PID: 7128)
      • askinstall46.exe (PID: 5920)
      • ifhwwyy.exe (PID: 4956)
      • JoSetp.exe (PID: 8344)
      • NMemo3Setp.exe (PID: 4240)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ElZan�_��_.exe (PID: 9848)
      • 6684865.exe (PID: 6916)
      • 758____Dawn.exe (PID: 8376)
      • hjjgaa.exe (PID: 4160)
      • RunWW.exe (PID: 4192)
      • 7104202.exe (PID: 10060)
      • Jyjalunejo.exe (PID: 1232)
      • 5210961.exe (PID: 3352)
      • Tavexeqaehy.exe (PID: 4296)
      • Lucasolaebi.exe (PID: 3936)
      • Winibyraebae.exe (PID: 5172)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 2264)
      • libravpn_setup.tmp (PID: 6732)
      • Qefitutify.exe (PID: 9812)
      • ifhwwyy.exe (PID: 6452)
      • Setup3310.tmp (PID: 7904)
      • iexplore.exe (PID: 9456)
      • ifhwwyy.exe (PID: 4868)
      • Setup3310.tmp (PID: 3256)
      • Peroxogeha.exe (PID: 5316)
      • LibraVPN.exe (PID: 7012)
      • RegAsm.exe (PID: 7688)
      • ifhwwyy.exe (PID: 9544)
      • Setup3310.tmp (PID: 5808)

    • Manual execution by user

      • WinRAR.exe (PID: 2900)
      • SmartMovie_v3_25_keygen_by_KeygenSumo.exe (PID: 320)

    • Checks Windows Trust Settings

      • keygen-step-6.exe (PID: 1540)
      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2740)
      • Newouttab02.exe (PID: 6444)
      • askinstall46.exe (PID: 5920)
      • powershell.exe (PID: 9972)
      • RunWW.exe (PID: 4192)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 2264)
      • iexplore.exe (PID: 9456)
      • LibraVPN.exe (PID: 7012)
      • powershell.exe (PID: 9244)
      • powershell.exe (PID: 6656)

    • Reads Microsoft Office registry keys

      • key.exe (PID: 2440)

    • Application was dropped or rewritten from another process

      • Piiiiiiiip�87.exe (PID: 2788)
      • IDWCH1.tmp (PID: 3436)
      • IDWCH1.tmp (PID: 2684)
      • IDownload.tmp (PID: 2932)
      • Setup.exe (PID: 3164)
      • MediaBurner.tmp (PID: 4852)
      • LabPicV3.tmp (PID: 5192)
      • lylal220.tmp (PID: 5256)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • 758____Dawn.exe (PID: 8376)
      • ElZan�_��_.exe (PID: 9848)
      • ultramediaburner.tmp (PID: 7016)

    • Loads dropped or rewritten executable

      • IDWCH1.tmp (PID: 2684)
      • IDownload.tmp (PID: 2932)
      • Setup3310.tmp (PID: 7128)
      • MediaBurner.tmp (PID: 4852)
      • lylal220.tmp (PID: 5256)
      • LabPicV3.tmp (PID: 5192)
      • ultramediaburner.tmp (PID: 7016)
      • prolab.tmp (PID: 6780)
      • irecord.tmp (PID: 3816)
      • Setup3310.tmp (PID: 7904)
      • Setup3310.tmp (PID: 3256)
      • Setup3310.tmp (PID: 5808)

    • Creates files in the program directory

      • Piiiiiiiip�87.exe (PID: 2788)
      • IDownload.tmp (PID: 2932)
      • Setup.exe (PID: 3164)
      • JFHGSFGSIUGFSUIG.exe (PID: 8524)
      • ultramediaburner.tmp (PID: 7016)
      • 758____Dawn.exe (PID: 8376)
      • libravpn_setup.tmp (PID: 6732)
      • prolab.tmp (PID: 6780)
      • ElZan�_��_.exe (PID: 9848)
      • irecord.tmp (PID: 3816)

    • Creates a software uninstall entry

      • IDownload.tmp (PID: 2932)
      • Setup.exe (PID: 3164)
      • ultramediaburner.tmp (PID: 7016)
      • prolab.tmp (PID: 6780)
      • libravpn_setup.tmp (PID: 6732)
      • irecord.tmp (PID: 3816)

    • Changes internet zones settings

      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 4516)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2548)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2548)

    • Creates files in the user directory

      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 4516)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2548)
      • iexplore.exe (PID: 3212)
      • iexplore.exe (PID: 5332)
      • iexplore.exe (PID: 2264)
      • iexplore.exe (PID: 9456)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2964)
      • iexplore.exe (PID: 2740)
      • iexplore.exe (PID: 4516)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
438
Monitored processes
278
Malicious processes
78
Suspicious processes
53

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start inject chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs winrar.exe no specs winrar.exe smartmovie_v3_25_keygen_by_keygensumo.exe cmd.exe no specs keygen-pr.exe #AZORULT keygen-step-1.exe keygen-step-5.exe no specs keygen-step-6.exe keygen-step-3.exe keygen-step-4.exe cmd.exe 7rvge2fouenr78.exe no specs taskkill.exe no specs crack.exe #PONY key.exe cmd.exe no specs cmd.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs ping.exe no specs regsvr32.exe no specs key.exe no specs rundll32.exe note866.exe #RACCOON e42.tmp.exe glorywsetp.exe 8274935.exe 3118959.exe #REDLINE 7524462.exe winhoster.exe no specs idwch1.exe idwch1.tmp no specs 2c9a.tmp.exe idwch1.exe idwch1.tmp piiiiiiiip�87.exe cmd.exe no specs ping.exe no specs idownload.exe idownload.tmp idownload.app.exe no specs csc.exe cvtres.exe no specs givuladuqe.exe nedaepiguqi.exe iexplore.exe iexplore.exe iexplore.exe iexplore.exe hbggg.exe no specs hbggg.exe jfiag3g_gg.exe no specs cmd.exe no specs eu.exe no specs cmd.exe no specs #VIDAR newouttab02.exe cmd.exe no specs ntvdm.exe cmd.exe no specs cmd.exe no specs findstr.exe no specs era.exe.com no specs ping.exe no specs era.exe.com cmd.exe no specs josetp.exe jfiag3g_gg.exe no specs cmd.exe no specs md6_6ydj.exe cmd.exe no specs ntvdm.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs ifhwwyy.exe cmd.exe no specs setup3310.exe no specs setup3310.tmp cmd.exe no specs google-game.exe no specs rundll32.exe no specs cmd.exe no specs taskkill.exe no specs timeout.exe no specs cmd.exe no specs chlbrowser.exe no specs chlbrowser.exe no specs cmd.exe no specs askinstall46.exe cmd.exe no specs app.exe no specs jfiag3g_gg.exe no specs cmd.exe no specs jfiag3g_gg.exe no specs cmd.exe no specs sunlabsplayer.exe cmd.exe no specs ntvdm.exe setup.exe hjjgaa.exe #VIDAR runww.exe nmemo3setp.exe mediaburner.exe lylal220.exe labpicv3.exe guihuali-game.exe no specs mediaburner.tmp labpicv3.tmp lylal220.tmp jfiag3g_gg.exe no specs 758____dawn.exe jfhgsfgsiugfsuig.exe rundll32.exe no specs elzan�_��_.exe 7575117.exe no specs 6684865.exe 4260177.exe no specs ns140d.tmp no specs powershell.exe no specs #REDLINE 7104202.exe #REDLINE 5210961.exe jfiag3g_gg.exe no specs ns214c.tmp no specs lighteningplayer-cache-gen.exe ultramediaburner.exe ultramediaburner.tmp no specs cmd.exe no specs ultramediaburner.exe no specs libravpn_setup.exe no specs libravpn_setup.tmp prolab.exe no specs prolab.tmp no specs jyjalunejo.exe lucasolaebi.exe tavexeqaehy.exe iexplore.exe no specs winibyraebae.exe iexplore.exe libravpn.exe cmd.exe no specs taskkill.exe no specs iexplore.exe no specs iexplore.exe timeout.exe no specs cmd.exe no specs app.exe no specs cmd.exe no specs irecord.exe no specs ntvdm.exe irecord.tmp no specs cmd.exe no specs chcp.com no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs cmd.exe no specs ntvdm.exe ntvdm.exe cmd.exe no specs ntvdm.exe i-record.exe no specs qefitutify.exe cmd.exe no specs ifhwwyy.exe jfiag3g_gg.exe no specs cmd.exe no specs chcp.com no specs cmd.exe no specs netsh.exe no specs cmd.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs ifhwwyy.exe cmd.exe no specs chcp.com no specs cmd.exe no specs jfiag3g_gg.exe no specs cmd.exe no specs netsh.exe no specs setup3310.exe no specs setup3310.tmp cmd.exe no specs chcp.com no specs cmd.exe no specs netsh.exe no specs iexplore.exe no specs iexplore.exe cmd.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs netsh.exe no specs setup3310.exe no specs setup3310.tmp cmd.exe no specs chcp.com no specs cmd.exe no specs netsh.exe no specs jfiag3g_gg.exe no specs cmd.exe no specs chcp.com no specs cmd.exe no specs #REDLINE regasm.exe ipconfig.exe no specs cmd.exe no specs taskkill.exe no specs peroxogeha.exe cmd.exe no specs google-game.exe no specs jfiag3g_gg.exe no specs rundll32.exe no specs cmd.exe no specs google-game.exe no specs rundll32.exe no specs cmd.exe no specs cmd.exe no specs ntvdm.exe cmd.exe no specs cmd.exe no specs ntvdm.exe cmd.exe no specs ifhwwyy.exe jfiag3g_gg.exe no specs cmd.exe no specs cmd.exe no specs setup3310.exe no specs setup3310.tmp jfiag3g_gg.exe no specs cmd.exe no specs cmd.exe no specs google-game.exe no specs rundll32.exe no specs svchost.exe cmd.exe no specs cmd.exe no specs chcp.com no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs sunlabsplayer.exe no specs cmd.exe no specs ntvdm.exe cmd.exe no specs sunlabsplayer.exe no specs cmd.exe no specs ntvdm.exe cmd.exe no specs ns1ea7.tmp no specs powershell.exe no specs ns288b.tmp no specs lighteningplayer-cache-gen.exe ns2936.tmp no specs powershell.exe no specs cmd.exe no specs cmd.exe no specs ns329d.tmp no specs lighteningplayer-cache-gen.exe cmd.exe no specs chcp.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
272regsvr32.exe ..\YMpOBc.hX -u /S C:\Windows\system32\regsvr32.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
320"C:\Users\admin\Desktop\SmartMovie_v3_25_keygen_by_KeygenSumo.exe" C:\Users\admin\Desktop\SmartMovie_v3_25_keygen_by_KeygenSumo.exe
Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\smartmovie_v3_25_keygen_by_keygensumo.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.24542_none_5c0717c7a00ddc6d\gdiplus.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
636"C:\Users\admin\AppData\Local\Temp\RarSFX1\IDWCH1.exe" /SPAWNWND=$30210 /NOTIFYWND=$C015A C:\Users\admin\AppData\Local\Temp\RarSFX1\IDWCH1.exe
IDWCH1.tmp
User:
admin
Company:
Integrity Level:
HIGH
Description:
Piiiiiiiip�87 Setup
Exit code:
1
Version:
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx1\idwch1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
672"C:\Users\admin\AppData\Local\Temp\40-83f33-a15-71184-c6f76260d92fc\Nedaepiguqi.exe" C:\Users\admin\AppData\Local\Temp\40-83f33-a15-71184-c6f76260d92fc\Nedaepiguqi.exe
Piiiiiiiip�87.exe
User:
admin
Company:
KessFraise_bel_annanass
Integrity Level:
HIGH
Description:
KessFraise_bel_annanass
Exit code:
0
Version:
40.40.40.40
Modules
Images
c:\users\admin\appdata\local\temp\40-83f33-a15-71184-c6f76260d92fc\nedaepiguqi.exe
c:\windows\system32\mscoree.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
760ping 127.0.0.1 C:\Windows\system32\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\ping.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iphlpapi.dll
c:\windows\system32\winnsi.dll
872C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
896"C:\Windows\System32\cmd.exe" /k C:\Users\admin\AppData\Local\Temp\5fsiyycc.ete\JoSetp.exe & exitC:\Windows\System32\cmd.exe—Nedaepiguqi.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\users\admin\appdata\local\temp\5fsiyycc.ete\josetp.exe
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
932"C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe" C:\Users\admin\AppData\Roaming\WinHost\WinHoster.exe—3118959.exe
User:
admin
Company:
WinHost
Integrity Level:
MEDIUM
Description:
WinHost
Exit code:
0
Version:
1.0.0.12
Modules
Images
c:\users\admin\appdata\roaming\winhost\winhoster.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1016"C:\Program Files\Windows NT\FSBMGXNKTY\IDownload.exe" /VERYSILENTC:\Program Files\Windows NT\FSBMGXNKTY\IDownload.exe
Piiiiiiiip�87.exe
User:
admin
Company:
IDownload
Integrity Level:
HIGH
Description:
IDownload Setup
Exit code:
0
Version:
Modules
Images
c:\program files\windows nt\fsbmgxnkty\idownload.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1032"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=844,14570190004404730,3934894479344807684,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1020 /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
86.0.4240.198
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\program files\google\chrome\application\86.0.4240.198\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-shell32-l1-1-0.dll
c:\windows\system32\shell32.dll
Total events
578 615
Read events
574 766
Write events
3 794
Delete events
55

Modification events

(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(1624) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid
Value:
(PID) Process:(1624) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:metricsid_installdate
Value:
0
Executable files
378
Suspicious files
106
Text files
277
Unknown types
182

Dropped files

PID
Process
Filename
Type
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-60DDFB31-658.pma —
MD5:—
SHA256:—
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old~RF2b297f.TMPtext
MD5:936EB7280DA791E6DD28EF3A9B46D39C
SHA256:CBAF2AFD831B32F6D1C12337EE5D2F090D6AE1F4DCB40B08BEF49BF52AD9721F
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Preferencestext
MD5:—
SHA256:—
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:00046F773EFDD3C8F8F6D0F87A2B93DC
SHA256:593EDE11D17AF7F016828068BCA2E93CF240417563FB06DC8A579110AEF81731
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old~RF2b298f.TMPtext
MD5:64AD8ED3E666540337BA541C549F72F7
SHA256:BECBDB08B5B37D203A85F2E974407334053BB1D2270F0B3C9A4DB963896F2206
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.old~RF2b2a89.TMPtext
MD5:109A25C32EE1132ECD6D9F3ED9ADF01A
SHA256:DA6028DB9485C65E683643658326F02B1D0A1566DE14914EF28E5248EB94F0DD
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Platform Notifications\LOG.oldtext
MD5:EF1D5606A483BB6C72C81A3F649BEB18
SHA256:BA083E7585ADA9936944FE56BC0141A544F18A01C3424E5C9F02375B34FE3D45
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\e94d07d2-bccd-4311-82d3-e96b832f921e.tmptext
MD5:—
SHA256:—
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old~RF2b299f.TMPtext
MD5:81F483F77EE490F35306A4F94DB2286B
SHA256:82434CE3C9D13F509EBEEBE3A7A1A1DE9AB4557629D9FC855761E0CFA45E8BCE
1624chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.oldtext
MD5:7721CDA9F5B73CE8A135471EB53B4E0E
SHA256:DD730C576766A46FFC84E682123248ECE1FF1887EC0ACAB22A5CE93A450F4500
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
86
TCP/UDP connections
129
DNS requests
104
Threats
318

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2684
IDWCH1.tmp
HEAD
200
194.163.135.248:80
http://superstationcity.com/C_Installer/IDownload.exe
DE
—
—
suspicious
1540
keygen-step-6.exe
GET
200
151.139.128.14:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEGmjTouN%2FW5s3CDseaiw7qE%3D
US
der
471 b
whitelisted
1540
keygen-step-6.exe
GET
200
85.214.154.106:80
http://www.almanhost.com/components/fw3.exe
DE
executable
118 Kb
suspicious
1540
keygen-step-6.exe
GET
301
85.214.154.106:80
http://www.almanhost.com/components/fw5.exe
DE
executable
101 Kb
suspicious
1540
keygen-step-6.exe
GET
301
85.214.154.106:80
http://www.almanhost.com/components/fw2.php
DE
executable
587 Kb
suspicious
2788
Piiiiiiiip�87.exe
GET
200
63.250.33.126:80
http://requested404.com/Widgets/IDownload.exe
US
executable
1.41 Mb
suspicious
1540
keygen-step-6.exe
GET
301
85.214.154.106:80
http://www.almanhost.com/components/fw3.php
DE
executable
587 Kb
suspicious
2684
IDWCH1.tmp
GET
200
194.163.135.248:80
http://superstationcity.com/C_Installer/IDownload.exe
DE
executable
625 Kb
suspicious
1540
keygen-step-6.exe
GET
200
85.214.154.106:80
http://www.almanhost.com/components/fw4.exe
DE
executable
101 Kb
suspicious
3436
keygen-step-3.exe
POST
200
107.191.60.39:80
http://www.w7dslkipoja.com/index.php/api/fb
JP
text
24 b
suspicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2260
chrome.exe
185.177.93.149:443
keygenit.com
—
MD
malicious
2260
chrome.exe
185.177.93.51:443
get.ziplink.xyz
—
MD
suspicious
2260
chrome.exe
104.21.14.244:443
serialms.com
Cloudflare Inc
US
unknown
2260
chrome.exe
142.250.186.141:443
accounts.google.com
Google Inc.
US
whitelisted
2260
chrome.exe
142.250.186.67:443
ssl.gstatic.com
Google Inc.
US
whitelisted
2260
chrome.exe
104.21.1.222:443
keygencloud.com
Cloudflare Inc
US
unknown
1540
keygen-step-6.exe
88.99.66.31:443
iplogger.org
Hetzner Online GmbH
DE
malicious
2260
chrome.exe
172.217.16.142:443
sb-ssl.google.com
Google Inc.
US
whitelisted
1640
keygen-step-1.exe
185.173.37.179:80
kvaka.li
M-Telecom, LLC
RU
malicious
1540
keygen-step-6.exe
85.214.154.106:80
www.almanhost.com
Strato AG
DE
suspicious

DNS requests

Domain
IP
Reputation
clients2.google.com
  • 216.58.212.142
whitelisted
keygenit.com
  • 185.177.93.149
malicious
accounts.google.com
  • 142.250.186.141
shared
www.googletagmanager.com
  • 142.250.185.232
whitelisted
www.google-analytics.com
  • 142.250.186.46
whitelisted
ssl.gstatic.com
  • 142.250.186.67
whitelisted
serialms.com
  • 104.21.14.244
  • 172.67.160.206
unknown
cdnjs.cloudflare.com
  • 104.16.19.94
  • 104.16.18.94
whitelisted
keygencloud.com
  • 104.21.1.222
  • 172.67.128.27
malicious
a.nel.cloudflare.com
  • 35.190.80.1
whitelisted

Threats

PID
Process
Class
Message
1640
keygen-step-1.exe
A Network Trojan was detected
ET TROJAN Win32/AZORult V3.3 Client Checkin M2
1640
keygen-step-1.exe
A Network Trojan was detected
AV TROJAN Azorult CnC Beacon
1540
keygen-step-6.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1540
keygen-step-6.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1540
keygen-step-6.exe
Misc activity
ET INFO EXE - Served Attached HTTP
2496
svchost.exe
Potential Corporate Privacy Violation
ET DNS Non-DNS or Non-Compliant DNS traffic on DNS port Reserved Bit Set
1540
keygen-step-6.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
1540
keygen-step-6.exe
Potentially Bad Traffic
ET CURRENT_EVENTS Terse alphanumeric executable downloader high likelihood of being hostile
1540
keygen-step-6.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1540
keygen-step-6.exe
Potential Corporate Privacy Violation
AV POLICY HTTP request for .exe file with no User-Agent
107 ETPRO signatures available at the full report
Process
Message
lighteningplayer-cache-gen.exe
main libvlc debug: VLC media player - 3.0.7 Vetinari
lighteningplayer-cache-gen.exe
main libvlc debug: Copyright � 1996-2018 the VideoLAN team
lighteningplayer-cache-gen.exe
main libvlc debug: revision 3.0.2-225-gc9e3360dd4
lighteningplayer-cache-gen.exe
main libvlc debug: configured with ../extras/package/win32/../../../configure '--enable-update-check' '--enable-lua' '--enable-faad' '--enable-flac' '--enable-theora' '--enable-twolame' '--enable-avcodec' '--enable-merge-ffmpeg' '--enable-dca' '--enable-mpc' '--enable-libass' '--enable-x264' '--enable-schroedinger' '--enable-realrtsp' '--enable-live555' '--enable-dvdread' '--enable-shout' '--enable-goom' '--enable-caca' '--enable-qt' '--enable-skins2' '--enable-sse' '--enable-mmx' '--enable-libcddb' '--enable-zvbi' '--disable-telx' '--enable-nls' '--host=i686-w64-mingw32' '--build=x86_64-pc-linux-gnu' 'build_alias=x86_64-pc-linux-gnu' 'host_alias=i686-w64-mingw32'
lighteningplayer-cache-gen.exe
main libvlc debug: using multimedia timers as clock source
lighteningplayer-cache-gen.exe
main libvlc debug: min period: 1 ms, max period: 1000000 ms
lighteningplayer-cache-gen.exe
main libvlc debug: searching plug-in modules
lighteningplayer-cache-gen.exe
main libvlc debug: ignoring plugins cache file
lighteningplayer-cache-gen.exe
main libvlc debug: recursively browsing `C:\Program Files\lighteningplayer\plugins'
lighteningplayer-cache-gen.exe
main libvlc debug: saving plugins cache C:\Program Files\lighteningplayer\plugins\plugins.dat
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://keygenit.com