Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2023, 10:17
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume5/Program Files (x86)/UltraViewer/Update/UVUpdater.exe
Resource
win7-20230220-en
General
-
Target
Device/HarddiskVolume5/Program Files (x86)/UltraViewer/Update/UVUpdater.exe
-
Size
3.4MB
-
MD5
b10fa685c645c451db5b6f023a4f0f27
-
SHA1
5b2511c26e5bef4bd9cd1fe79a7497a83cfe4896
-
SHA256
63d3ffb453d9717a35af6f9b8bcdff4190ae0711f872ab2f4b9f6b7a7fc8de49
-
SHA512
c8e2466ecdd82e5498b96caa71c6468440c7463022ffb69624605a9c05b5ec6f43a63d5444772ba79217c2c981f6e4e5fb3889b739cb75b2e0d648def89dd3b0
-
SSDEEP
98304:K5zZ80gsEX+LjOYZwzqxA4drSntNd6N5sCCN9ViPd:Kf80gsl3OzqfA3dHCCrcd
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 7 IoCs
pid Process 3392 tmpC2C8.tmp 4960 tmpC2C8.tmp 1052 UVUninstallHelper.exe 2064 UltraViewer_Desktop.exe 1712 UltraViewer_Desktop.exe 4420 UltraViewer_Service.exe 1300 UltraViewer_Desktop.exe -
Loads dropped DLL 23 IoCs
pid Process 4960 tmpC2C8.tmp 4960 tmpC2C8.tmp 4960 tmpC2C8.tmp 220 regasm.exe 220 regasm.exe 220 regasm.exe 220 regasm.exe 220 regasm.exe 220 regasm.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 3368 regasm.exe 3368 regasm.exe 3368 regasm.exe 3368 regasm.exe 1712 UltraViewer_Desktop.exe 1712 UltraViewer_Desktop.exe 1712 UltraViewer_Desktop.exe 1300 UltraViewer_Desktop.exe -
resource yara_rule behavioral2/files/0x0002000000023127-383.dat upx behavioral2/files/0x0002000000023127-406.dat upx behavioral2/files/0x0002000000023127-407.dat upx behavioral2/memory/2064-416-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/2064-441-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/files/0x0002000000023127-453.dat upx behavioral2/memory/1712-456-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/1712-473-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/files/0x0002000000023127-474.dat upx behavioral2/memory/1300-476-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/1300-494-0x0000000000400000-0x0000000000817000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log RegAsm.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\UltraViewer\images\emotions\is-TRTU0.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-IA3MP.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-LRSNH.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-7VQ5P.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-63SJ2.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-PRQ9E.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-AA07A.tmp tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\unins000.dat tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-PQVE3.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-2DPBI.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-NGS1H.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-B89L6.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-6O919.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-4PB0G.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-ICLU2.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-L5D5G.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-S48MF.tmp tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\uva64.dll tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-NPFU4.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-5TDKP.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-CJHEH.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-A0ABE.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-K3745.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt UltraViewer_Service.exe File opened for modification C:\Program Files (x86)\UltraViewer\msvbvm60.dll tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-I58Q8.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-4549L.tmp tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\RemoteControl40.dll tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-K5D4S.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\RemoteControl.tlb regasm.exe File created C:\Program Files (x86)\UltraViewer\Language\is-RQA6B.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-0DI69.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-OR4CK.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-8BHDV.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-40R7T.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-0GMPH.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-L2UK2.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-KRKOS.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\js\is-SR8O5.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-OF24J.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-H72OK.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-EK739.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-ECL2F.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-LAJC4.tmp tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\uvc.dll tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\uv_x64.exe tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-B9C4F.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.tlb regasm.exe File created C:\Program Files (x86)\UltraViewer\images\is-H0L8I.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-GL0BA.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-JMI9P.tmp tmpC2C8.tmp File opened for modification C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt UltraViewer_Service.exe File opened for modification C:\Program Files (x86)\UltraViewer\RemoteControl20.dll tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-3N781.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-I6VO7.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-97TTP.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-BM1BF.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-FAPSI.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-TQGEM.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-C3AF1.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\is-HB34S.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\images\is-BJKO7.tmp tmpC2C8.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-BLE60.tmp tmpC2C8.tmp -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4188 sc.exe 4616 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 220 net.exe 1496 net.exe -
Kills process with taskkill 64 IoCs
pid Process 5044 taskkill.exe 1416 taskkill.exe 800 taskkill.exe 3096 taskkill.exe 3012 taskkill.exe 2644 taskkill.exe 1284 taskkill.exe 4100 taskkill.exe 3480 taskkill.exe 3840 taskkill.exe 4616 taskkill.exe 4440 taskkill.exe 640 taskkill.exe 1416 taskkill.exe 4000 taskkill.exe 4376 taskkill.exe 448 taskkill.exe 1644 taskkill.exe 4240 taskkill.exe 4232 taskkill.exe 4892 taskkill.exe 4972 taskkill.exe 1444 taskkill.exe 3652 taskkill.exe 4492 taskkill.exe 2248 taskkill.exe 2684 taskkill.exe 4276 taskkill.exe 264 taskkill.exe 1492 taskkill.exe 5036 taskkill.exe 4164 taskkill.exe 4456 taskkill.exe 3476 taskkill.exe 828 taskkill.exe 4244 taskkill.exe 3840 taskkill.exe 3084 taskkill.exe 704 taskkill.exe 4296 taskkill.exe 1536 taskkill.exe 4852 taskkill.exe 4904 taskkill.exe 4580 taskkill.exe 4028 taskkill.exe 2120 taskkill.exe 3512 taskkill.exe 2284 taskkill.exe 1708 taskkill.exe 384 taskkill.exe 4344 taskkill.exe 4348 taskkill.exe 2248 taskkill.exe 4924 taskkill.exe 4680 taskkill.exe 4680 taskkill.exe 492 taskkill.exe 4124 taskkill.exe 3380 taskkill.exe 1820 taskkill.exe 4916 taskkill.exe 5080 taskkill.exe 2332 taskkill.exe 1956 taskkill.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UltraViewer_Service.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections UltraViewer_Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UltraViewer_Service.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80BAEE4D-7EC4-3C59-A8D4-DC468C2DFC05}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01734E1F-85A2-3D39-AA7A-E13725309958}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA52DBBC-B050-328B-8EB0-81990853A4C3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D3FEC98-6682-3ADC-A5CA-9C7F38D0224B}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD21F0F4-5174-3D60-B84D-5BA86C8194A3}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{689A44FB-677C-41AF-A58D-9E61F33323D5}\ProgId\ = "RemoteControl.VKeyboardReceiver" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A8F41B6C-85DD-43F4-96C4-CF6737D94DD4}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC2EF02C-DA10-4070-B5C4-0F504F7E53F5}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C3A56D79-088D-4B4C-AD52-3ABBA8D552C3} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{49272F85-DE83-33D1-A91F-292F12876C5B} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{867C3F99-D25B-3722-9807-380D2C204DC5}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD21F0F4-5174-3D60-B84D-5BA86C8194A3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.mMonitor\ = "RemoteControl.mMonitor" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D87B5289-A84D-4B4D-B241-3A42C6D05D54}\Control regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13EF1A33-9CCA-49D9-8BAC-F7DC390F3295}\InprocServer32\ = "mscoree.dll" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4E482A0-F8DF-4E68-B101-489B1AFD0BD2}\InprocServer32\1.0.0.0\Class = "RemoteControl.VStopWatch" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDC5AA3E-D7A6-4A3E-A7D2-A6DA5D7B560D}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{045196B7-CF2F-3DAB-9A3F-E40EC5E61EBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DF953791-62EF-305E-8E45-F130C87093C1}\TypeLib regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E99E5338-1077-3110-909C-2F178F2B8B96}\ProxyStubClsid32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{93ECA15C-2992-42A0-9CD4-5725C7895EDA}\InprocServer32\1.0.0.0\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7E029E0F-1645-4E4B-BD0E-47A69D08C6D7} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{658A6360-7D2A-376D-BFED-34D22DC76014}\1.0.0.0\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F8DBC0A7-5FC6-461F-A4BB-4EFCAFFAFF25}\TypeLib regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD134423-A88C-4A1C-9EE5-19A5A34B4804} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A8B348E-1D07-3CCF-96C1-7209B09E96BB}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56B5A2E8-9BB3-3302-9D9A-0F10198B758C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{15ECF2A6-2F4C-3ACD-A0FC-F034C6351C0E}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13EF1A33-9CCA-49D9-8BAC-F7DC390F3295}\Version\ = "1.0" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VIntegerDictionary\CLSID regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.clsStoredFrame+VListUInt16 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{02BB3C25-2825-3250-8B1D-442AD0B9F4F7} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE272A8A-DD78-3059-BE82-4A145DF84B62}\TypeLib regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{79240D60-E07A-3A3A-ACCC-3AB1BA87CA54}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{76B0A385-3E64-3103-9987-1945739D6D79}\ = "_DomainToIPResolvedEventHandler" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE889EAB-57BC-38C6-8E2C-34B124D9CEB2}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DAB73B12-F602-3BDF-ADC0-D694A769EA8B}\TypeLib\Version = "1.0" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{92D5DA63-F027-36DB-96E8-4801D4CEDE84} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7B26DD4E-3114-3E36-98D9-40AA5F4BB787}\ProgId regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{13EF1A33-9CCA-49D9-8BAC-F7DC390F3295}\ToolBoxBitmap32\ = "C:\\Program Files (x86)\\UltraViewer\\RemoteControl.dll, 101" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2845DDC4-3AB7-425E-BCB7-7AB279C35F35}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3DD0548C-662A-455A-8F82-51A9AFFB641C}\ProxyStubClsid32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B181EAEF-AF6B-388C-9722-5D16686BB6F0}\ = "_ClickEventHandler_3" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD63F10E-9544-32B7-9D1E-C5A6A04AF778}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6DBE0E9C-5236-34D8-A10F-08ADC6FAB087}\InprocServer32\Class = "RemoteControl.clsByteArrayBuilder" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.clsStoredFrame+VRecordReader\CLSID\ = "{59ADBF5F-AA15-4A92-9A10-ED8EA4F578EA}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0CD04A1C-5525-3C3D-B932-DBE5FEE1B00A}\InprocServer32\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EDF6548C-EBE0-41C2-A301-D8761B7F7E02}\ProgId\ = "RemoteControl.VByteArraySegment" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C33C1E7-4CD2-3987-ADB3-66AC3B9B3505}\ProgId regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A983CB1-EA55-40E8-BF1A-2F84440B6373}\ProxyStubClsid32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE491259-6627-3ACF-A852-B0F4960BB6C8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{04EA81AD-067C-394E-A71B-FD31A46412F2}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72550BB6-0686-42EA-9C8F-F446DA8486CE}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CD6E44E5-1B89-4E7C-8023-53673FE031EA}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BBB5724-30DB-449E-8D07-5AB723663BEF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80BAEE4D-7EC4-3C59-A8D4-DC468C2DFC05} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4AA6ABE-1A1A-41C4-A006-D175F931B657}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4AA6ABE-1A1A-41C4-A006-D175F931B657}\ToolBoxBitmap32 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03ECBE75-0432-45BF-9EFA-F7F439997557}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0FFEC097-834C-42A6-A994-CE1966121E9B} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DF784B4-7F02-40E2-A408-05F77000779F}\TypeLib\Version = "1.0" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CB42F09F-44D7-3E7E-9C4A-9B6EDDA4AA78} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CA5DE22-F295-3F03-8D69-018007836F60}\InprocServer32\ThreadingModel = "Both" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7C1DBD1F-A4AA-43EC-ACFD-6FF9481E7473}\InprocServer32\Class = "RemoteControl.VComboBox" regasm.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e UVUpdater.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C UVUpdater.exe Set value (data) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf5c0000000100000004000000001000001800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 UVUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e UVUpdater.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2064 UltraViewer_Desktop.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4284 UVUpdater.exe 4284 UVUpdater.exe 1052 UVUninstallHelper.exe 4960 tmpC2C8.tmp 4960 tmpC2C8.tmp 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 4420 UltraViewer_Service.exe 4284 UVUpdater.exe 4284 UVUpdater.exe 4284 UVUpdater.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4284 UVUpdater.exe Token: SeDebugPrivilege 1052 UVUninstallHelper.exe Token: SeDebugPrivilege 1644 taskkill.exe Token: SeDebugPrivilege 4924 taskkill.exe Token: SeDebugPrivilege 2120 taskkill.exe Token: SeDebugPrivilege 4240 taskkill.exe Token: SeDebugPrivilege 4916 taskkill.exe Token: SeDebugPrivilege 1284 taskkill.exe Token: SeDebugPrivilege 5080 taskkill.exe Token: SeDebugPrivilege 2680 taskkill.exe Token: SeDebugPrivilege 4928 taskkill.exe Token: SeDebugPrivilege 5044 taskkill.exe Token: SeDebugPrivilege 4492 taskkill.exe Token: SeDebugPrivilege 3512 taskkill.exe Token: SeDebugPrivilege 4164 taskkill.exe Token: SeDebugPrivilege 2248 taskkill.exe Token: SeDebugPrivilege 3236 taskkill.exe Token: SeDebugPrivilege 4456 taskkill.exe Token: SeDebugPrivilege 2068 taskkill.exe Token: SeDebugPrivilege 3476 taskkill.exe Token: SeDebugPrivilege 2684 taskkill.exe Token: SeDebugPrivilege 3044 taskkill.exe Token: SeDebugPrivilege 4100 taskkill.exe Token: SeDebugPrivilege 4232 taskkill.exe Token: SeDebugPrivilege 4452 taskkill.exe Token: SeDebugPrivilege 3380 taskkill.exe Token: SeDebugPrivilege 4276 taskkill.exe Token: SeDebugPrivilege 2220 taskkill.exe Token: SeDebugPrivilege 704 taskkill.exe Token: SeDebugPrivilege 3264 taskkill.exe Token: SeDebugPrivilege 1424 taskkill.exe Token: SeDebugPrivilege 1416 taskkill.exe Token: SeDebugPrivilege 4296 taskkill.exe Token: SeDebugPrivilege 1536 taskkill.exe Token: SeDebugPrivilege 1708 taskkill.exe Token: SeDebugPrivilege 2332 taskkill.exe Token: SeDebugPrivilege 384 taskkill.exe Token: SeDebugPrivilege 3480 taskkill.exe Token: SeDebugPrivilege 3840 taskkill.exe Token: SeDebugPrivilege 4852 taskkill.exe Token: SeDebugPrivilege 4616 taskkill.exe Token: SeDebugPrivilege 4904 taskkill.exe Token: SeDebugPrivilege 4580 taskkill.exe Token: SeDebugPrivilege 2588 taskkill.exe Token: SeDebugPrivilege 5084 taskkill.exe Token: SeDebugPrivilege 2284 taskkill.exe Token: SeDebugPrivilege 4760 taskkill.exe Token: SeDebugPrivilege 4892 taskkill.exe Token: SeDebugPrivilege 4680 taskkill.exe Token: SeDebugPrivilege 4440 taskkill.exe Token: SeDebugPrivilege 4972 taskkill.exe Token: SeDebugPrivilege 640 taskkill.exe Token: SeDebugPrivilege 2644 taskkill.exe Token: SeDebugPrivilege 3456 taskkill.exe Token: SeDebugPrivilege 1324 taskkill.exe Token: SeDebugPrivilege 3924 taskkill.exe Token: SeDebugPrivilege 828 taskkill.exe Token: SeDebugPrivilege 264 taskkill.exe Token: SeDebugPrivilege 4060 taskkill.exe Token: SeDebugPrivilege 1492 taskkill.exe Token: SeDebugPrivilege 4736 taskkill.exe Token: SeDebugPrivilege 4028 taskkill.exe Token: SeDebugPrivilege 1444 taskkill.exe Token: SeDebugPrivilege 1672 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4960 tmpC2C8.tmp -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 2064 UltraViewer_Desktop.exe 1712 UltraViewer_Desktop.exe 1300 UltraViewer_Desktop.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4284 wrote to memory of 3392 4284 UVUpdater.exe 82 PID 4284 wrote to memory of 3392 4284 UVUpdater.exe 82 PID 4284 wrote to memory of 3392 4284 UVUpdater.exe 82 PID 3392 wrote to memory of 4960 3392 tmpC2C8.tmp 83 PID 3392 wrote to memory of 4960 3392 tmpC2C8.tmp 83 PID 3392 wrote to memory of 4960 3392 tmpC2C8.tmp 83 PID 4960 wrote to memory of 1052 4960 tmpC2C8.tmp 84 PID 4960 wrote to memory of 1052 4960 tmpC2C8.tmp 84 PID 4960 wrote to memory of 1052 4960 tmpC2C8.tmp 84 PID 4960 wrote to memory of 220 4960 tmpC2C8.tmp 87 PID 4960 wrote to memory of 220 4960 tmpC2C8.tmp 87 PID 4960 wrote to memory of 220 4960 tmpC2C8.tmp 87 PID 220 wrote to memory of 4060 220 net.exe 89 PID 220 wrote to memory of 4060 220 net.exe 89 PID 220 wrote to memory of 4060 220 net.exe 89 PID 4960 wrote to memory of 1496 4960 tmpC2C8.tmp 90 PID 4960 wrote to memory of 1496 4960 tmpC2C8.tmp 90 PID 4960 wrote to memory of 1496 4960 tmpC2C8.tmp 90 PID 1496 wrote to memory of 4652 1496 net.exe 92 PID 1496 wrote to memory of 4652 1496 net.exe 92 PID 1496 wrote to memory of 4652 1496 net.exe 92 PID 4960 wrote to memory of 4616 4960 tmpC2C8.tmp 93 PID 4960 wrote to memory of 4616 4960 tmpC2C8.tmp 93 PID 4960 wrote to memory of 4616 4960 tmpC2C8.tmp 93 PID 4960 wrote to memory of 1644 4960 tmpC2C8.tmp 96 PID 4960 wrote to memory of 1644 4960 tmpC2C8.tmp 96 PID 4960 wrote to memory of 1644 4960 tmpC2C8.tmp 96 PID 4960 wrote to memory of 4924 4960 tmpC2C8.tmp 98 PID 4960 wrote to memory of 4924 4960 tmpC2C8.tmp 98 PID 4960 wrote to memory of 4924 4960 tmpC2C8.tmp 98 PID 4960 wrote to memory of 2120 4960 tmpC2C8.tmp 100 PID 4960 wrote to memory of 2120 4960 tmpC2C8.tmp 100 PID 4960 wrote to memory of 2120 4960 tmpC2C8.tmp 100 PID 4960 wrote to memory of 4240 4960 tmpC2C8.tmp 102 PID 4960 wrote to memory of 4240 4960 tmpC2C8.tmp 102 PID 4960 wrote to memory of 4240 4960 tmpC2C8.tmp 102 PID 4960 wrote to memory of 4916 4960 tmpC2C8.tmp 104 PID 4960 wrote to memory of 4916 4960 tmpC2C8.tmp 104 PID 4960 wrote to memory of 4916 4960 tmpC2C8.tmp 104 PID 4960 wrote to memory of 1284 4960 tmpC2C8.tmp 106 PID 4960 wrote to memory of 1284 4960 tmpC2C8.tmp 106 PID 4960 wrote to memory of 1284 4960 tmpC2C8.tmp 106 PID 4960 wrote to memory of 5080 4960 tmpC2C8.tmp 108 PID 4960 wrote to memory of 5080 4960 tmpC2C8.tmp 108 PID 4960 wrote to memory of 5080 4960 tmpC2C8.tmp 108 PID 4960 wrote to memory of 2680 4960 tmpC2C8.tmp 111 PID 4960 wrote to memory of 2680 4960 tmpC2C8.tmp 111 PID 4960 wrote to memory of 2680 4960 tmpC2C8.tmp 111 PID 4960 wrote to memory of 4928 4960 tmpC2C8.tmp 113 PID 4960 wrote to memory of 4928 4960 tmpC2C8.tmp 113 PID 4960 wrote to memory of 4928 4960 tmpC2C8.tmp 113 PID 4960 wrote to memory of 5044 4960 tmpC2C8.tmp 115 PID 4960 wrote to memory of 5044 4960 tmpC2C8.tmp 115 PID 4960 wrote to memory of 5044 4960 tmpC2C8.tmp 115 PID 4960 wrote to memory of 4492 4960 tmpC2C8.tmp 117 PID 4960 wrote to memory of 4492 4960 tmpC2C8.tmp 117 PID 4960 wrote to memory of 4492 4960 tmpC2C8.tmp 117 PID 4960 wrote to memory of 3512 4960 tmpC2C8.tmp 119 PID 4960 wrote to memory of 3512 4960 tmpC2C8.tmp 119 PID 4960 wrote to memory of 3512 4960 tmpC2C8.tmp 119 PID 4960 wrote to memory of 4164 4960 tmpC2C8.tmp 121 PID 4960 wrote to memory of 4164 4960 tmpC2C8.tmp 121 PID 4960 wrote to memory of 4164 4960 tmpC2C8.tmp 121 PID 4960 wrote to memory of 2248 4960 tmpC2C8.tmp 124
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\tmpC2C8.tmp"C:\Users\Admin\AppData\Local\Temp\tmpC2C8.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\is-UDC4L.tmp\tmpC2C8.tmp"C:\Users\Admin\AppData\Local\Temp\is-UDC4L.tmp\tmpC2C8.tmp" /SL5="$3011C,3135622,121344,C:\Users\Admin\AppData\Local\Temp\tmpC2C8.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\is-OLBQ2.tmp\UVUninstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\is-OLBQ2.tmp\UVUninstallHelper.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\SysWOW64\net.exe"net" stop UltraViewService4⤵
- Discovers systems in the same network
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UltraViewService5⤵PID:4060
-
-
-
C:\Windows\SysWOW64\net.exe"net" stop UltraViewService4⤵
- Discovers systems in the same network
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UltraViewService5⤵PID:4652
-
-
-
C:\Windows\SysWOW64\sc.exe"sc" delete UltraViewService4⤵
- Launches sc.exe
PID:4616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2120
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4928
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4492
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3512
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4164
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3236
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4456
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3476
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3044
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4232
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4452
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3380
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4276
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2220
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:704
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4296
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1708
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:384
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3840
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4852
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4904
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4580
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2284
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4680
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4440
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4972
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:640
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2644
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3456
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:828
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:264
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1492
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4736
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4028
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1444
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3788
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4244
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3672
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:2292
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3084
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4680
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:4440
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1956
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1416
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:2696
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:1608
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:492
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3652
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4000
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4124
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3840
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:5036
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:2784
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:800
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4344
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3380
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4376
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:4496
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:448
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4348
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3096
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3436
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1820
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3012
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3512
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:2248
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:1556
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb4⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:220
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb4⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:3368
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1712 -
C:\Windows\SysWOW64\sc.exesc failure "UltraViewService" reset= 0 actions= restart/600005⤵
- Launches sc.exe
PID:4188
-
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm404⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:1300
-
-
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵
- Drops file in System32 directory
PID:3836
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵PID:4340
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵PID:4460
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
14KB
MD5b6a8ccdc51964e1551bef57b4a42a899
SHA152de4c2fc039af9a2f1295e8419123ba89ee5858
SHA256c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a
SHA5128d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6
-
Filesize
1KB
MD5473b3896eae7ea66f61e9d0ffbe5b9b1
SHA1d7ef69586317f7472ce400bc7bef75bfa4095592
SHA256d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f
SHA512981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
1.0MB
MD5fbb8f25020cb8b8fe025dcba40e52f9b
SHA154196c3028bb227b320dbbe00fc21c709175eda9
SHA256965d52cad1a41d94f28d7c5a4cd52ab80f5cd49b72bd508539dc699e17b6b38e
SHA5125ddfdd68de9a09ea1fa24a85c262767eef83bc8c6fd2295b7b0a9604ba0ea7ee5ed8a5cca12a9dfba33c9a536431523275ba32d0291ad834a829436f632db7a1
-
Filesize
236KB
MD56905ce31fccabd2c0b51bf910698ad83
SHA1940ea6dbd498cb89423e58186222da2cc09fb45f
SHA256670896b87a02b8cf9d715ad0c62ed04160ddc5fc075adc52cb2eb038f9ecd282
SHA5126a31920226a5b774134ad7ff686b42f1965496efc6516e1dae4634b7c172243a35ba005dcb50e3c2d570a1e9228cc2fd11cc67679a0b79998ff67dbd71b0cbc4
-
Filesize
980KB
MD50b479e00bf8277750db1c2de0610a726
SHA160895a1ab686eda0602680ebdccd12299d8643c5
SHA2569835979e2609ff20ec3cd7b1dd408ea93a1a596dd51dc908530b0f3d65a1611e
SHA5128a2a5a9c48c4a869cc2c2a0a13515221e08a2eb8b7231371645b3213da3a4e160317a69669e2dfab76c6cca5042d696e45888fb52c89c4a9233821d23140e7c6
-
Filesize
980KB
MD50b479e00bf8277750db1c2de0610a726
SHA160895a1ab686eda0602680ebdccd12299d8643c5
SHA2569835979e2609ff20ec3cd7b1dd408ea93a1a596dd51dc908530b0f3d65a1611e
SHA5128a2a5a9c48c4a869cc2c2a0a13515221e08a2eb8b7231371645b3213da3a4e160317a69669e2dfab76c6cca5042d696e45888fb52c89c4a9233821d23140e7c6
-
Filesize
980KB
MD50b479e00bf8277750db1c2de0610a726
SHA160895a1ab686eda0602680ebdccd12299d8643c5
SHA2569835979e2609ff20ec3cd7b1dd408ea93a1a596dd51dc908530b0f3d65a1611e
SHA5128a2a5a9c48c4a869cc2c2a0a13515221e08a2eb8b7231371645b3213da3a4e160317a69669e2dfab76c6cca5042d696e45888fb52c89c4a9233821d23140e7c6
-
Filesize
980KB
MD50b479e00bf8277750db1c2de0610a726
SHA160895a1ab686eda0602680ebdccd12299d8643c5
SHA2569835979e2609ff20ec3cd7b1dd408ea93a1a596dd51dc908530b0f3d65a1611e
SHA5128a2a5a9c48c4a869cc2c2a0a13515221e08a2eb8b7231371645b3213da3a4e160317a69669e2dfab76c6cca5042d696e45888fb52c89c4a9233821d23140e7c6
-
Filesize
980KB
MD50b479e00bf8277750db1c2de0610a726
SHA160895a1ab686eda0602680ebdccd12299d8643c5
SHA2569835979e2609ff20ec3cd7b1dd408ea93a1a596dd51dc908530b0f3d65a1611e
SHA5128a2a5a9c48c4a869cc2c2a0a13515221e08a2eb8b7231371645b3213da3a4e160317a69669e2dfab76c6cca5042d696e45888fb52c89c4a9233821d23140e7c6
-
Filesize
310B
MD542b8d26600dcb85572ee43616f929d6a
SHA131a4c46641129ef59eb925621c1aa4f8401d776c
SHA25699f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc
SHA512d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae
-
Filesize
226KB
MD530c5f65655bbaeab0f1afd219c609050
SHA1f0317b4e3b420fd2e00483f366a0c9d31d2a8457
SHA2568befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7
SHA512611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a
-
Filesize
226KB
MD530c5f65655bbaeab0f1afd219c609050
SHA1f0317b4e3b420fd2e00483f366a0c9d31d2a8457
SHA2568befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7
SHA512611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a
-
Filesize
225B
MD5679aca3e8125584e8704b2dfdfa20a0b
SHA1bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e
SHA256470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4
SHA5128441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
124KB
MD58b3f15a335710c799eae2395fa6b322d
SHA181b9f58fe2c61e26e758690f59fa4de4bc8b462b
SHA25609ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c
SHA512c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9
-
Filesize
124KB
MD58b3f15a335710c799eae2395fa6b322d
SHA181b9f58fe2c61e26e758690f59fa4de4bc8b462b
SHA25609ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c
SHA512c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9
-
Filesize
1KB
MD5bf9fccd82a74ae0fe94fe7f265ac9bca
SHA1701036824a82ddaba67b37f545eb42e8ddf996fd
SHA25610fb5250e5422aba27206a81c71b72b98a1d2e250a2c112c0ffb8a9f28230144
SHA512fdc4a7a0e839056f1d00a3242c25791fad96679e3d5f33da57d5b4acb84bf8d143bdc592714eeb35be1d231c9bea3cf00412b082d2a9c81f1340717a0852394e
-
Filesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
Filesize
43KB
MD5ececb301656f5f8c6a46a8abf8d928fe
SHA19bdf8a054c71d34837262ab306db92d3ee70db3b
SHA256801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b
SHA512314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6
-
Filesize
43KB
MD5ececb301656f5f8c6a46a8abf8d928fe
SHA19bdf8a054c71d34837262ab306db92d3ee70db3b
SHA256801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b
SHA512314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6
-
Filesize
225B
MD5679aca3e8125584e8704b2dfdfa20a0b
SHA1bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e
SHA256470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4
SHA5128441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
1.1MB
MD5e845838d99d29c4bba4ad35ee996dea3
SHA134a9f433ce1e3339e07d75f0a74efd676b1d7cca
SHA256b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
SHA512fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d
-
Filesize
1.1MB
MD5e845838d99d29c4bba4ad35ee996dea3
SHA134a9f433ce1e3339e07d75f0a74efd676b1d7cca
SHA256b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
SHA512fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d
-
Filesize
3.4MB
MD5a0a6131837266c13553ee0be455367ce
SHA1287824332454ba9be1e47b92f8c2af177803d622
SHA25617d9037556f31d80c8d8a0b05ff4ace130e7ebb459ba748efdf8f0b80f38dfe1
SHA5128461112e953f4dca2695122d61888d91589fa99c965ab50b0e1569e5f4038075d4e53858c3cb04ec4103921b5e3092eaa6b7224bbe73c97401e5df01f3acae9c
-
Filesize
3.4MB
MD5a0a6131837266c13553ee0be455367ce
SHA1287824332454ba9be1e47b92f8c2af177803d622
SHA25617d9037556f31d80c8d8a0b05ff4ace130e7ebb459ba748efdf8f0b80f38dfe1
SHA5128461112e953f4dca2695122d61888d91589fa99c965ab50b0e1569e5f4038075d4e53858c3cb04ec4103921b5e3092eaa6b7224bbe73c97401e5df01f3acae9c
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce