65fa93616cdb8c92a541dd2ad8468d6688e1b1f2606891b56db3e90fbfc9acbd

Target

Install2.exe
Size

497KB
MD5

41a5f4fd1ea7cac4aa94a87aebccfef0
SHA1

0d0abf079413a4c773754bf4fda338dc5b9a8ddc
SHA256

97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
SHA512

5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f

Score

9^/10

discovery evasion persistence

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Downloads MZ/PE file
Drops file in Drivers directory 1 IoCs

Processes:

Ultra.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Ultra.exe

Executes dropped EXE 7 IoCs

Processes:

Install2.tmpUltra.exeultramediaburner.exeultramediaburner.tmpUltraMediaBurner.exeQenaweshaeshy.exeKujoshicogy.exe

pid	process
1456	Install2.tmp
1124	Ultra.exe
1668	ultramediaburner.exe
1468	ultramediaburner.tmp
1316	UltraMediaBurner.exe
764	Qenaweshaeshy.exe
1840	Kujoshicogy.exe

Loads dropped DLL 12 IoCs

Processes:

Install2.exeInstall2.tmpultramediaburner.exeultramediaburner.tmp

pid	process
308	Install2.exe
1456	Install2.tmp
1456	Install2.tmp
1456	Install2.tmp
1456	Install2.tmp
1668	ultramediaburner.exe
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

Ultra.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows NT\\Mimebumyqae.exe\""	Ultra.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2200 2076 WerFault.exe IEXPLORE.EXE

pid	pid_target	process	target process
2200	2076	WerFault.exe	IEXPLORE.EXE

Drops file in Program Files directory 9 IoCs

Processes:

Ultra.exeultramediaburner.tmp

description	ioc	process
File created	C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe.config	Ultra.exe
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\is-S0UKL.tmp	ultramediaburner.tmp
File created	C:\Program Files (x86)\Windows NT\Mimebumyqae.exe	Ultra.exe
File created	C:\Program Files (x86)\Windows NT\Mimebumyqae.exe.config	Ultra.exe
File created	C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe	Ultra.exe
File created	C:\Program Files (x86)\UltraMediaBurner\is-MF4ID.tmp	ultramediaburner.tmp
File opened for modification	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp
File created	C:\Program Files (x86)\UltraMediaBurner\unins000.dat	ultramediaburner.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "326753402"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000ea5f0adc3ccfb5489cb0b1902ba955052ade9a44bfe09c556d45a69435376d4f000000000e80000000020000200000006e11aeb16b847e6fb922b21ce95639d0cdbdb1fab5e2e84f3dad2b2217efc136900000009878a70dc2d76af8c5e5264d9ca6e144ba4c5ba7890a66b86c1b33bb163759ea183795e72c0490faf1d56c8dbb2718bbaa4ee56d65a62eb6c373095a9c466ca77587466446a28a35f48c76aca2ec2122b9d8a86750fe17a85ad7ea4cf1285c919dac5c31145be0d6211161c5b4419a164524a5c1a9b89ecc971fb074a1ecb4243351736daea0a9559ab7eb9b8686fb1c40000000d05990173619ed9b938b38c4c4667e7a6feddbbf97e928a03e3f17a553f0a1246604e3fbda6b1a60d6b84e9555f9cbb6471162436a91ee955ac8a9d3b39ef8ba	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{8B165C61-AB87-11EB-8BB5-DE0F3C10814B} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00f9ce62943fd701	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000051618adbbbd0f84eb34ff59fe7045e8f00000000020000000000106600000001000020000000b663894a750ce4db2ccc2de0e2c925e419a5504149bd24f743202f630aa0170b000000000e80000000020000200000005ed605af9d24d365ea468334e6060cc351799509d3fbd6dde7be089d1d1184152000000079ff405c40c58cb40f7f6d8cec979c1d61d13e998e9dbbbfe7ab7ebe489ed33940000000e9541707d1a38b34c5d13c68b509c4aeb45efa8621927e4d41b5aca236af2285783aaeed5922088e255b4f2df2098447ce045e38c408635e1c941bb52321f9b6	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ultramediaburner.tmpKujoshicogy.exe

pid	process
1468	ultramediaburner.tmp
1468	ultramediaburner.tmp
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe
1840	Kujoshicogy.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

WerFault.exeiexplore.exe

pid process

2200 WerFault.exe
240 iexplore.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Kujoshicogy.exeWerFault.exe

description pid process

Token: SeDebugPrivilege 1840 Kujoshicogy.exe
Token: SeDebugPrivilege 2200 WerFault.exe
Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

ultramediaburner.tmpiexplore.exe

pid process

1468 ultramediaburner.tmp
240 iexplore.exe
240 iexplore.exe

pid	process
2200	WerFault.exe
240	iexplore.exe

description	pid	process
Token: SeDebugPrivilege	1840	Kujoshicogy.exe
Token: SeDebugPrivilege	2200	WerFault.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEIEXPLORE.EXE

pid	process
240	iexplore.exe
240	iexplore.exe
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
1060	IEXPLORE.EXE
2076	IEXPLORE.EXE
2076	IEXPLORE.EXE
240	iexplore.exe
240	iexplore.exe
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE
2848	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

Install2.exeInstall2.tmpUltra.exeultramediaburner.exeultramediaburner.tmpQenaweshaeshy.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 308 wrote to memory of 1456	308	Install2.exe	Install2.tmp
PID 1456 wrote to memory of 1124	1456	Install2.tmp	Ultra.exe
PID 1456 wrote to memory of 1124	1456	Install2.tmp	Ultra.exe
PID 1456 wrote to memory of 1124	1456	Install2.tmp	Ultra.exe
PID 1456 wrote to memory of 1124	1456	Install2.tmp	Ultra.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1124 wrote to memory of 1668	1124	Ultra.exe	ultramediaburner.exe
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1668 wrote to memory of 1468	1668	ultramediaburner.exe	ultramediaburner.tmp
PID 1468 wrote to memory of 1316	1468	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1468 wrote to memory of 1316	1468	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1468 wrote to memory of 1316	1468	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1468 wrote to memory of 1316	1468	ultramediaburner.tmp	UltraMediaBurner.exe
PID 1124 wrote to memory of 764	1124	Ultra.exe	Qenaweshaeshy.exe
PID 1124 wrote to memory of 764	1124	Ultra.exe	Qenaweshaeshy.exe
PID 1124 wrote to memory of 764	1124	Ultra.exe	Qenaweshaeshy.exe
PID 1124 wrote to memory of 1840	1124	Ultra.exe	Kujoshicogy.exe
PID 1124 wrote to memory of 1840	1124	Ultra.exe	Kujoshicogy.exe
PID 1124 wrote to memory of 1840	1124	Ultra.exe	Kujoshicogy.exe
PID 764 wrote to memory of 240	764	Qenaweshaeshy.exe	iexplore.exe
PID 764 wrote to memory of 240	764	Qenaweshaeshy.exe	iexplore.exe
PID 764 wrote to memory of 240	764	Qenaweshaeshy.exe	iexplore.exe
PID 240 wrote to memory of 1060	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 1060	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 1060	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 1060	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2076	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2076	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2076	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2076	240	iexplore.exe	IEXPLORE.EXE
PID 2076 wrote to memory of 2200	2076	IEXPLORE.EXE	WerFault.exe
PID 2076 wrote to memory of 2200	2076	IEXPLORE.EXE	WerFault.exe
PID 2076 wrote to memory of 2200	2076	IEXPLORE.EXE	WerFault.exe
PID 2076 wrote to memory of 2200	2076	IEXPLORE.EXE	WerFault.exe
PID 764 wrote to memory of 2812	764	Qenaweshaeshy.exe	iexplore.exe
PID 764 wrote to memory of 2812	764	Qenaweshaeshy.exe	iexplore.exe
PID 764 wrote to memory of 2812	764	Qenaweshaeshy.exe	iexplore.exe
PID 240 wrote to memory of 2848	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2848	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2848	240	iexplore.exe	IEXPLORE.EXE
PID 240 wrote to memory of 2848	240	iexplore.exe	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\Install2.exe
"C:\Users\Admin\AppData\Local\Temp\Install2.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:308

C:\Users\Admin\AppData\Local\Temp\is-9V2L0.tmp\Install2.tmp
"C:\Users\Admin\AppData\Local\Temp\is-9V2L0.tmp\Install2.tmp" /SL5="$3011A,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1456

C:\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\Ultra.exe
"C:\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\Ultra.exe" /S /UID=burnerch1
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1124

C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe
"C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe" /VERYSILENT
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668

C:\Users\Admin\AppData\Local\Temp\is-VSBS6.tmp\ultramediaburner.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VSBS6.tmp\ultramediaburner.tmp" /SL5="$80128,281924,62464,C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe" /VERYSILENT
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1468

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu
6⤵
- Executes dropped EXE
PID:1316

C:\Users\Admin\AppData\Local\Temp\5b-045b3-da1-f0c9f-dd335f1780c83\Qenaweshaeshy.exe
"C:\Users\Admin\AppData\Local\Temp\5b-045b3-da1-f0c9f-dd335f1780c83\Qenaweshaeshy.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e6
5⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:240

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:275457 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1060

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:340994 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2076 -s 1408
7⤵
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2200

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:240 CREDAT:2110485 /prefetch:2
6⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2848

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad
5⤵
PID:2812

C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kujoshicogy.exe
"C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kujoshicogy.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1840

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Software Discovery

T1518

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe
MD5
6103ca066cd5345ec41feaf1a0fdadaf

SHA1
938acc555933ee4887629048be4b11df76bb8de8

SHA256
b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201

SHA512
a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3

Download Submit
C:\Program Files\Windows NT\JVOFQJDUIN\ultramediaburner.exe
MD5
6103ca066cd5345ec41feaf1a0fdadaf

SHA1
938acc555933ee4887629048be4b11df76bb8de8

SHA256
b8d950bf6fa228454571f15cc4b7b6fbaa539f1284e43946abd90934db925201

SHA512
a9062e1fac2f6073a134d9756c84f70999240e36a98cb39684018e7d5bd3772f2ca21ab35bd2c6bd60413eb7306376e7f530e78ce4ebcfe256f766e8c42d16b3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4
MD5
9bd290c73c295139470b5a56f8d857bb

SHA1
c838907b18895bc98a601e27c30b5de9acef88e7

SHA256
bfc8f14e57e8fe77f10ec2c420b746a75291c034dd872bc673e459ebfdac5968

SHA512
c8a77182ce1832fe96f35a2816120c9df00eca1aa29dce49a111f057d3583b3b25a69c88f579cc84f4ff43fbf17f663a1e07234aacdd1831bbdb443f8f234e36

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B079D7ED1B8C22A8D960DDC0E7D2E0C9
MD5
912b3118e85c3ae93ecd014897891614

SHA1
f0533c18ddb617a7db82b74484265cd6388aa4f3

SHA256
44fc2193cf8e1961244c4868703fac9f48465b66148db80243003481a3e5fce2

SHA512
3a0fb01a7fdbb2755b3f3c0d849c2473fd844c1d25b9d1e191578165e820eb9b47da7d6b7a5a8e38af44633072ae39b370380ce71851424caff0a11a30d7b6fb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4
MD5
3a98399b3290c821683576558d4bf450

SHA1
aa3989d361fe2f10e158f05ec74fe31d9e0e91a1

SHA256
b222d5b47c96cdeeb56b6117179a0d4f2618ae4c191be0510b7631dfc4daa243

SHA512
39e9e2e55e94de6568af86616c8b2096849a577b5b20edbe1ad9a080f90f80ba5b010e7f05143347cd5c4b832a6db5ef76dc9e028de0c93c36ac1bee85a2db02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
705e826da894634cad75a60027312e0f

SHA1
30b7cf3cc4a78cb3797b1b8429689670eca9f8e3

SHA256
65b98b6a2f5bdcdea23ddee79304fdbc3614e3de3ea0e439719dcac68f07fcf6

SHA512
05d504dc098b742328be227e29bff69f801964fe278dc7b5a3a7ecd3260af14c4972eba42fc11fd367719fac21f8c1f39e378372ac24f585127d3f46fc7b1cc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
68e719d361556670c4cc51fc78c3fe28

SHA1
95720f0b87a548692b7c178cd36ff0c3357a8414

SHA256
fa2a51db4f6c6e366046e09cac7d41dca0e66eca0d5192ab506fe8d2cfbec2e9

SHA512
5649d3e845af840d71661a1f1109600e8e1b7f6b54720ffea88b126f05945410c84b6c9c8ee2e84397a2c1909b1713f4f19b35e2745ed54c5e1b8630417b6334

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
9b728a5ca630697e2b5bac521095a95f

SHA1
be221d07f0d055b306ba2c1e1094a8c992aad97e

SHA256
bea0757e4006edd88920b03d611a1cd73ef9912cb0a3ee40ea535d78df164c4d

SHA512
3f555e63c42c9b6cc5d1da2f2ae90296ffdfd205162d5dfeefb750958859da3da954d0e4189303eb83fe6237be17945332ffa3487c10389092c919330c313834

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
17851549cc072f6d3d800bc7e66c1e74

SHA1
99fd72bb41b25a4ad58955c9651b157a838aa73e

SHA256
2b19db3c5d5c1c31efab6d8d6093d007296e036f1f1481bc5adb615b769a0ecf

SHA512
6ef47f0225ac34d8b88dd0482d8ed5a51868ff1fa2dc475f570b72c5d116359d435dbc02c664bfc400c9a661438befe3c57619821a61f077fc82c9a4f28c989d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
5d7da4ac140042159feb885cc0d1d8e9

SHA1
98c5f8e477c464b874bb0d5d9877c3edc206fb82

SHA256
5ca9c7c8fda21c76b1f843c82b0049b6560687856b5e87c6426035ff546f5b36

SHA512
8c8015e4cb14dfddf6ff493b8651cfd26ba557f24f78ea4eeab5d0c9f4194d7333a0e5ef89abeb22f9abd1ecefdd2946e43160a73d9e3e489c49387bf7902592

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
MD5
32159de9c6534557eec62c2b306fc314

SHA1
c8da7ac137208b8aa35496efb151c59613fa9a24

SHA256
b6f0d0ca52e3b256754a4577058e0362f41c825f66c9fd718a56733427f8f44d

SHA512
6e50e20d63c34faf5ac0591d13e256fc2641f75cfe4ea1c20a41133fe52973e8c155c66342672cdf992d1a64595480759c879bfae927bda63f2af78debe7d48e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B079D7ED1B8C22A8D960DDC0E7D2E0C9
MD5
6b0eabfd58488414a51248e1472e9ace

SHA1
a0d0e2296da9ba533e77cae94d9dfd75d25c696a

SHA256
07dbc157cec48c5f8a12dbf98edc3cbe232a3fa69c2fc3f45f6d3b3060f30e62

SHA512
a61cf688d6c7846d76a3d81b42468e1cdce69663ebfceafb83e265b23350d4c19548defc548036434d3d7c04fdd635d5ae627dd629d0aff6eba00acfad029e66

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2XZVQTUG\260L64QY.htm
MD5
7ec0ad1a816ce57098cc9bbeceb4c8fb

SHA1
6842171468028891713ff87699eeee307d292264

SHA256
754f2ba9636b98cc27fccfd89b9c13094b9b1eaf29700d125b8f8317a1e66790

SHA512
e27b946cda5bcc73925e4b32cdfbfe5791da2947f54896ae601ef960c3170b4bd8ec92f8b9a69f6ce18d5f8864abc308ca2169f2a9c9ee7b206fbba70d2f381f

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b-045b3-da1-f0c9f-dd335f1780c83\Qenaweshaeshy.exe
MD5
3ff7832ac6c44aea5e9652a33d5050ad

SHA1
cbf63d3811674b4fb2249f84d91528f1f3f158a2

SHA256
9f025665cbd44dcc007927ff1d2b3f26b328c1dfe4892857eaf1f7de7fdf0c3b

SHA512
7e563621c1912c498f3afe93acade2765acd4f1eccb0cf5c35341a6f4a74971d41c6f94c5b9d64d6120ef4a007c6f539b5bcc96059e3b7c9ced5ec2a44ce37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b-045b3-da1-f0c9f-dd335f1780c83\Qenaweshaeshy.exe
MD5
3ff7832ac6c44aea5e9652a33d5050ad

SHA1
cbf63d3811674b4fb2249f84d91528f1f3f158a2

SHA256
9f025665cbd44dcc007927ff1d2b3f26b328c1dfe4892857eaf1f7de7fdf0c3b

SHA512
7e563621c1912c498f3afe93acade2765acd4f1eccb0cf5c35341a6f4a74971d41c6f94c5b9d64d6120ef4a007c6f539b5bcc96059e3b7c9ced5ec2a44ce37c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\5b-045b3-da1-f0c9f-dd335f1780c83\Qenaweshaeshy.exe.config
MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kenessey.txt
MD5
97384261b8bbf966df16e5ad509922db

SHA1
2fc42d37fee2c81d767e09fb298b70c748940f86

SHA256
9c0d294c05fc1d88d698034609bb81c0c69196327594e4c69d2915c80fd9850c

SHA512
b77fe2d86fbc5bd116d6a073eb447e76a74add3fa0d0b801f97535963241be3cdce1dbcaed603b78f020d0845b2d4bfc892ceb2a7d1c8f1d98abc4812ef5af21

Download Submit
C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kujoshicogy.exe
MD5
24988abf1cac1c74e9385b4bff16e8f7

SHA1
50bae2be9668aad4f3a3a7d404c731f541b12f67

SHA256
afad8cc3e378f4d22ca2e325a63998e4bcbb70509135532b450c22fdd47e993c

SHA512
a707b54611976264a3671907faabd817e58e4ee572637ad1193b7c346b7cb63b98a8e52a87cb2b135a5e40f0e97e3f040a04804c0164a1d6caa856b2f1fe742f

Download Submit
C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kujoshicogy.exe
MD5
24988abf1cac1c74e9385b4bff16e8f7

SHA1
50bae2be9668aad4f3a3a7d404c731f541b12f67

SHA256
afad8cc3e378f4d22ca2e325a63998e4bcbb70509135532b450c22fdd47e993c

SHA512
a707b54611976264a3671907faabd817e58e4ee572637ad1193b7c346b7cb63b98a8e52a87cb2b135a5e40f0e97e3f040a04804c0164a1d6caa856b2f1fe742f

Download Submit
C:\Users\Admin\AppData\Local\Temp\da-8fe5b-b14-73eb2-4bc26b0fadc2e\Kujoshicogy.exe.config
MD5
98d2687aec923f98c37f7cda8de0eb19

SHA1
f6dcfcdcfe570340ecdbbd9e2a61f3cb4f281ba7

SHA256
8a94163256a722ef8cc140bcd115a5b8f8725c04fe158b129d47be81cb693465

SHA512
95c7290d59749df8df495e04789c1793265e0f34e0d091df5c0d4aefe1af4c8ac1f5460f1f198fc28c4c8c900827b8f22e2851957bbaea5914ea962b3a1d0590

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9V2L0.tmp\Install2.tmp
MD5
45ca138d0bb665df6e4bef2add68c7bf

SHA1
12c1a48e3a02f319a3d3ca647d04442d55e09265

SHA256
3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

SHA512
cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\Ultra.exe
MD5
cc2e3f1906f2f7a7318ce8e6f0f00683

SHA1
ff26f4b8ba148ddd488dde4eadd2412d6c288580

SHA256
0ed89ff238edaa1b5b084d5c3c7ba6864b59dac5a6fd961a9065e966f55b9cb2

SHA512
49d86be8794e0161bc2f2db626b9ce0031e9614486605f283c6cd8429fe9d907f3f3851d15cd318df5945ad2acac85da18f042f3692c38b794cc11d27b77a05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\Ultra.exe
MD5
cc2e3f1906f2f7a7318ce8e6f0f00683

SHA1
ff26f4b8ba148ddd488dde4eadd2412d6c288580

SHA256
0ed89ff238edaa1b5b084d5c3c7ba6864b59dac5a6fd961a9065e966f55b9cb2

SHA512
49d86be8794e0161bc2f2db626b9ce0031e9614486605f283c6cd8429fe9d907f3f3851d15cd318df5945ad2acac85da18f042f3692c38b794cc11d27b77a05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VSBS6.tmp\ultramediaburner.tmp
MD5
4e8c7308803ce36c8c2c6759a504c908

SHA1
a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc

SHA256
90fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c

SHA512
780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VSBS6.tmp\ultramediaburner.tmp
MD5
4e8c7308803ce36c8c2c6759a504c908

SHA1
a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc

SHA256
90fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c

SHA512
780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D6TIB1SW.txt
MD5
005368077e0b7f829b5c4302ac45d571

SHA1
4b3bc527df2ec97c7ed22b05a0a19b7a26778b7d

SHA256
96ebf5463f98196eab8c88624e0620e4e924a1d357f787c6cd7dcf31d81a225a

SHA512
c3b34c7cd2d427b9c5382fb8dfc9d91476df18b0c1e12fc2799a131aee53f48a16bf337b04abd2bbd73e3ff0a613026bc5e2f27942daa8f49264f01452aba84e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QWQ2DSQG.txt
MD5
de5d36567013add5f4a5d6a04c6b557d

SHA1
adc18c502bb8e04fc080a75be04c22c5d27f6bc2

SHA256
518f9ac0dd4a11bdf167c42eae1284826d488033f3f41753ad0978cec89b0e32

SHA512
3f37060bd6239a4755ef258c8b8f82ad57cdb0f60ab0c6836d588c006db2357e96e1e7ef59c4408365ca8a8a495b842d38383e8adb5a35fbe7dafaacdf0fa1a9

Download Submit
\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe
MD5
7124be0b78b9f4976a9f78aaeaed893a

SHA1
804f3e4b3f9131be5337b706d5a9ea6fcfa53e25

SHA256
bb28d7beea6e3faa641f69b9b4866858d87ca63f9eef15dae350b2dc28b537c3

SHA512
49f6df2ee5af4032ca47b01beb08648c7235a2dea51546aab8fc14d5f0ae7baa53cc539f24ea21d6db67882b4e65c8d271630fb8e12144cf24f6e8a4e598dff3

Download Submit
\Users\Admin\AppData\Local\Temp\is-9V2L0.tmp\Install2.tmp
MD5
45ca138d0bb665df6e4bef2add68c7bf

SHA1
12c1a48e3a02f319a3d3ca647d04442d55e09265

SHA256
3960a0597104fc5bbf82bf6c03564a1eb6a829c560d1f50d0a63b4772fafbe37

SHA512
cd1a0493c26798eb70b3dabb8a439de7792c4676905cad21c6b3f372213ce9f6b65648245defcd36d4f19285160f41c62e1025e772e6b9f11aa126388ea8364f

Download Submit
\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\Ultra.exe
MD5
cc2e3f1906f2f7a7318ce8e6f0f00683

SHA1
ff26f4b8ba148ddd488dde4eadd2412d6c288580

SHA256
0ed89ff238edaa1b5b084d5c3c7ba6864b59dac5a6fd961a9065e966f55b9cb2

SHA512
49d86be8794e0161bc2f2db626b9ce0031e9614486605f283c6cd8429fe9d907f3f3851d15cd318df5945ad2acac85da18f042f3692c38b794cc11d27b77a05a

Download Submit
\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-IJ3F8.tmp\idp.dll
MD5
8f995688085bced38ba7795f60a5e1d3

SHA1
5b1ad67a149c05c50d6e388527af5c8a0af4343a

SHA256
203d7b61eac96de865ab3b586160e72c78d93ab5532b13d50ef27174126fd006

SHA512
043d41947ab69fc9297dcb5ad238acc2c35250d1172869945ed1a56894c10f93855f0210cbca41ceee9efb55fd56a35a4ec03c77e252409edc64bfb5fb821c35

Download Submit
\Users\Admin\AppData\Local\Temp\is-PTG2O.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-PTG2O.tmp\_isetup\_shfoldr.dll
MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-VSBS6.tmp\ultramediaburner.tmp
MD5
4e8c7308803ce36c8c2c6759a504c908

SHA1
a3ec8c520620c0f9c8760f5c2c3ef6ab593240dc

SHA256
90fdd4ddf0f5700ed6e48ac33b5ede896a2d67e314fb48f6d948ab01b5c7ea4c

SHA512
780c1e8dce3e3f22dc820853bc18cadd969d7c1ce5a1bef52dbb09b3ae3c60b80116913c092760b9d50bda7857ff7de854e7b589106f3a2187697b76e3f1d7e7

Download Submit
memory/240-114-0x000007FEFC661000-0x000007FEFC663000-memory.dmp

Filesize
8KB

Download
memory/240-113-0x0000000000000000-mapping.dmp

Download
memory/308-60-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/308-61-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/764-102-0x0000000002120000-0x0000000002122000-memory.dmp

Filesize
8KB

Download
memory/764-96-0x0000000000000000-mapping.dmp

Download
memory/1060-115-0x0000000000000000-mapping.dmp

Download
memory/1060-117-0x0000000000510000-0x0000000000512000-memory.dmp

Filesize
8KB

Download
memory/1124-75-0x0000000000B40000-0x0000000000B42000-memory.dmp

Filesize
8KB

Download
memory/1124-72-0x0000000000000000-mapping.dmp

Download
memory/1316-121-0x000000001AEA0000-0x000000001AEB9000-memory.dmp

Filesize
100KB

Download
memory/1316-104-0x000007FEF2730000-0x000007FEF37C6000-memory.dmp

Filesize
16.6MB

Download
memory/1316-99-0x00000000009C0000-0x00000000009C2000-memory.dmp

Filesize
8KB

Download
memory/1316-93-0x0000000000000000-mapping.dmp

Download
memory/1316-122-0x00000000009C6000-0x00000000009E5000-memory.dmp

Filesize
124KB

Download
memory/1316-123-0x00000000009E5000-0x00000000009E6000-memory.dmp

Filesize
4KB

Download
memory/1456-69-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1456-63-0x0000000000000000-mapping.dmp

Download
memory/1468-82-0x0000000000000000-mapping.dmp

Download
memory/1468-98-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1468-87-0x0000000074D11000-0x0000000074D13000-memory.dmp

Filesize
8KB

Download
memory/1668-79-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/1668-76-0x0000000000000000-mapping.dmp

Download
memory/1840-105-0x0000000000000000-mapping.dmp

Download
memory/1840-109-0x000007FEF2730000-0x000007FEF37C6000-memory.dmp

Filesize
16.6MB

Download
memory/1840-120-0x0000000000B86000-0x0000000000BA5000-memory.dmp

Filesize
124KB

Download
memory/1840-111-0x0000000000B80000-0x0000000000B82000-memory.dmp

Filesize
8KB

Download
memory/2076-125-0x0000000000000000-mapping.dmp

Download
memory/2076-127-0x0000000000F10000-0x0000000000F12000-memory.dmp

Filesize
8KB

Download
memory/2200-130-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/2200-129-0x0000000000000000-mapping.dmp

Download
memory/2812-132-0x0000000000000000-mapping.dmp

Download
memory/2848-133-0x0000000000000000-mapping.dmp

Download