Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2023, 06:52
Static task
static1
Behavioral task
behavioral1
Sample
Device/HarddiskVolume3/Program Files (x86)/UltraViewer/Update/UVUpdater.exe
Resource
win7-20230703-en
General
-
Target
Device/HarddiskVolume3/Program Files (x86)/UltraViewer/Update/UVUpdater.exe
-
Size
3.4MB
-
MD5
58c7835275c287ffa6aab23500b61ecb
-
SHA1
8d4ef999c7755423576bfcfd9092d4976f409c29
-
SHA256
81fb1f2231fc1956351a3ad690ffad177b8174f52d51518bd5333e9ce24cb042
-
SHA512
788a55c52b6b748e0f330c201a2cd65471265742b35f4672bf8183a338566212e8710bb6603501d6e76eeb7da263abb39bfaa0e1d1024b86212fb1a0d42d5394
-
SSDEEP
98304:H5zZ80gsEX+LjH24iPFna6KbgxZiZc7Xmhcf9ViPS:Hf80gsl3WLs6EZI2GFcS
Malware Config
Signatures
-
Stops running service(s) 3 TTPs
-
Executes dropped EXE 7 IoCs
pid Process 1452 tmpAC7C.tmp 1800 tmpAC7C.tmp 3908 UVUninstallHelper.exe 3696 UltraViewer_Desktop.exe 64 UltraViewer_Desktop.exe 1784 UltraViewer_Service.exe 4416 UltraViewer_Desktop.exe -
Loads dropped DLL 23 IoCs
pid Process 1800 tmpAC7C.tmp 1800 tmpAC7C.tmp 1800 tmpAC7C.tmp 3172 regasm.exe 3172 regasm.exe 3172 regasm.exe 3172 regasm.exe 3172 regasm.exe 3172 regasm.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 2520 regasm.exe 2520 regasm.exe 2520 regasm.exe 2520 regasm.exe 64 UltraViewer_Desktop.exe 64 UltraViewer_Desktop.exe 64 UltraViewer_Desktop.exe 4416 UltraViewer_Desktop.exe -
resource yara_rule behavioral2/files/0x000700000002324a-415.dat upx behavioral2/files/0x000700000002324a-438.dat upx behavioral2/files/0x000700000002324a-439.dat upx behavioral2/memory/3696-448-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/3696-470-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/files/0x000700000002324a-482.dat upx behavioral2/memory/64-487-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/64-503-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/files/0x000700000002324a-504.dat upx behavioral2/memory/4416-512-0x0000000000400000-0x0000000000817000-memory.dmp upx behavioral2/memory/4416-524-0x0000000000400000-0x0000000000817000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{EAB795CE-C74C-4259-BD1E-768FBD66F74C}.catalogItem svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat svchost.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log RegAsm.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\UltraViewer\images\is-E1PJR.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-I8O13.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-OJ2VB.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.tlb regasm.exe File created C:\Program Files (x86)\UltraViewer\is-ENL6G.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-MFS87.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\js\is-D3IBC.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-K7493.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-BRTC3.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-E4BCM.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\uva.dll tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-DNAL0.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-11EN6.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-1H6TL.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\RemoteControl.tlb regasm.exe File created C:\Program Files (x86)\UltraViewer\images\is-2QNJK.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-O93OK.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-0V656.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Update\is-PRNUF.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-L1JQC.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\unins000.dat tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-D8OTI.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-3UQU4.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-5SFB9.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-91FAG.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-PA1SQ.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-6CV34.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-O0VEM.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-5TT4C.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-PO8DQ.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-SH9F6.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-7HB0I.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-5P961.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-1MA2E.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-6OT37.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-LT51D.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-9EQ7C.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-0L6Q9.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-VF0MO.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-KPHAM.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-37UBH.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-S3HNI.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-3S826.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-Q7S1B.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\msvbvm60.dll tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-GHHMN.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-PJO6B.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-MDB1P.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-42PMF.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-FIVH7.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-O5ERA.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-I657N.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-G01VI.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\sounds\is-GTAAA.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\unins000.dat tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-80O7B.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-66JTQ.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\is-ABO47.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\Language\is-V6FFD.tmp tmpAC7C.tmp File opened for modification C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\images\emotions\is-JL3PC.tmp tmpAC7C.tmp File created C:\Program Files (x86)\UltraViewer\is-2IP6D.tmp tmpAC7C.tmp -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2656 sc.exe 1720 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Discovers systems in the same network 1 TTPs 2 IoCs
pid Process 4856 net.exe 392 net.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Kills process with taskkill 64 IoCs
pid Process 3384 taskkill.exe 3872 taskkill.exe 4708 taskkill.exe 3484 taskkill.exe 1856 taskkill.exe 1192 taskkill.exe 4412 taskkill.exe 4380 taskkill.exe 1080 taskkill.exe 3680 taskkill.exe 3536 taskkill.exe 3752 taskkill.exe 3664 taskkill.exe 4064 taskkill.exe 2568 taskkill.exe 4504 taskkill.exe 3788 taskkill.exe 4860 taskkill.exe 2280 taskkill.exe 3992 taskkill.exe 4284 taskkill.exe 2796 taskkill.exe 2428 taskkill.exe 4300 taskkill.exe 4780 taskkill.exe 2696 taskkill.exe 640 taskkill.exe 1268 taskkill.exe 552 taskkill.exe 2184 taskkill.exe 3884 taskkill.exe 1496 taskkill.exe 4396 taskkill.exe 1644 taskkill.exe 2896 taskkill.exe 5028 taskkill.exe 868 taskkill.exe 4468 taskkill.exe 2700 taskkill.exe 3136 taskkill.exe 912 taskkill.exe 5056 taskkill.exe 3608 taskkill.exe 3364 taskkill.exe 4032 taskkill.exe 3608 taskkill.exe 1660 taskkill.exe 1988 taskkill.exe 3736 taskkill.exe 2128 taskkill.exe 3404 taskkill.exe 4804 taskkill.exe 1192 taskkill.exe 1860 taskkill.exe 216 taskkill.exe 3664 taskkill.exe 436 taskkill.exe 2236 taskkill.exe 4372 taskkill.exe 1320 taskkill.exe 2332 taskkill.exe 1276 taskkill.exe 2568 taskkill.exe 1784 taskkill.exe -
Modifies data under HKEY_USERS 6 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections UltraViewer_Service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" UltraViewer_Service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" UltraViewer_Service.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6154ABF6-0EE9-4DD7-A9D3-ECF4B069B8B8}\Implemented Categories regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{658A6360-7D2A-376D-BFED-34D22DC76014}\1.0.0.0\RuntimeVersion = "v4.0.30319" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B93E720-CA77-47D4-A553-CF444C365E83}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE491259-6627-3ACF-A852-B0F4960BB6C8}\ = "_DocumentCompletedEventHandler" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6750236C-BC64-3F71-AB21-D9F17828ECB4}\ = "_ReconnectedSuccessEventHandler" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{44D105E6-E078-3F10-8885-B542A77FB347}\1.0.0.0 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E65BD510-2AA1-3A63-A724-2103AA8FE2BE}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCE15B3B-6579-475D-9FAD-A51A54779699}\InprocServer32\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B9A3E9DE-ACA4-3AF0-8CCB-F933621D2A9E} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VAudio+RemoteClientInfo\CLSID\ = "{E9490A8D-2122-37B0-9F03-7331370868C2}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A7178389-B896-4914-8F82-2D8140F04E16}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E6D3BD7-4977-3C6E-BB21-329F21F8FF87}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{05162E9F-0AAF-4EF3-A2CB-253ABA0EB626}\InprocServer32\Class = "RemoteControl.clsStoredFrame+VListObject" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Record\{31E0E560-C646-3AC8-9085-5CB54FB9853E}\1.0.0.0\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EE08CED-2C53-44E2-A11F-22CD5C1A4DFF} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{73E3104E-1F1B-4C42-8DF5-1338F3A65F1E}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56B5A2E8-9BB3-3302-9D9A-0F10198B758C}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E65BD510-2AA1-3A63-A724-2103AA8FE2BE}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5022A0AC-7231-4D70-A6CD-6D06C6E2E52B}\InprocServer32\1.0.0.0 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VIndexedStrStrDictionary\CLSID\ = "{9462463B-3C6B-4C0D-B02D-81F5D03371B0}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3A919D7-0FE7-3864-AD4C-27395708B7F6} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{116A4A06-B77B-3C08-ADC9-C39E7BFAF773}\ = "_DblClickEventHandler_7" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{116A4A06-B77B-3C08-ADC9-C39E7BFAF773}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DE272A8A-DD78-3059-BE82-4A145DF84B62}\ProxyStubClsid32 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{64241102-ED1F-4C7B-9C89-0154DEC10283}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4DF77D89-3F3F-3FF6-890D-0EFCD96880D0}\ = "_ClosedEventHandler" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{709B45D6-0AB4-36B3-965B-682E01DA1782}\ = "_ChangedEventHandler" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0ADF308F-B824-4FD9-8C0B-93DA7B8A7E34}\InprocServer32\Class = "RemoteControl.clsStoredFrame+VCompressor" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{08830907-EBD1-4ABA-A249-1691BB305416}\ProgId\ = "RemoteControl.clsStoredFrame+VTelegram" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F271EFB2-B5CC-4AEF-AADE-16693B26BA0B} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D951045-3413-317C-BF75-ADC464FBCF31}\ = "_mGlobal" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4D951045-3413-317C-BF75-ADC464FBCF31}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE036BD5-535F-3C12-834E-7A9AAEF755FE}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59ADBF5F-AA15-4A92-9A10-ED8EA4F578EA}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4C33C1E7-4CD2-3987-ADB3-66AC3B9B3505}\InprocServer32\ = "mscoree.dll" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E9D4883A-6374-4753-8D47-07900E9E065F} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F8DD59C2-7087-3935-9876-D8408FF0DFE1}\ProxyStubClsid32 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BFCD01F1-3407-3BD9-A14A-B98D81E3AFB8} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BE5F4B0B-7CE4-34E7-B46D-1F31290DABC8}\TypeLib\Version = "1.0" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{75C87975-804F-456D-9D3B-8B4A621F6E6B}\ToolBoxBitmap32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C0C272BB-F685-435C-87A0-05E22D8D05A4}\InprocServer32\Class = "RemoteControl.VListDouble" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FBD839ED-4D5A-4F86-8C72-4EEE9E91FED8}\ = "_VDownloader" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{16B664F6-B146-44A7-97FA-FB0EAD46802A}\InprocServer32\1.0.0.0\Class = "RemoteControl.VUDPClient" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39592642-27A8-49D5-9951-20396E915473}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{13B00CF7-9C7F-34EA-B4BB-4C7D105F585E} regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B1AC4DDA-DCDD-3D4A-A346-7252B4701A8C}\TypeLib\Version = "1.0" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AAEB6911-19AF-3788-8452-76020BEA6FAB}\ = "_frmAddGroup" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{80DF76B9-AE4F-4405-8F98-023627E6724C}\InprocServer32\RuntimeVersion = "v4.0.30319" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VPicturebox regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VTreeView\ = "RemoteControl.VTreeView" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0F6ACC71-3831-3B66-B679-C3F11C7ED294}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DF77D89-3F3F-3FF6-890D-0EFCD96880D0}\ProxyStubClsid32 regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7FC939D-118A-492D-997F-6CB79048C6CA}\ = "__VDrawer" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2356D63F-FFA2-49A8-9304-FCBF80064D8F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DAC63DA-59EF-3707-8D36-EB1EF00FD5C4} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{56B5A2E8-9BB3-3302-9D9A-0F10198B758C} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{49272F85-DE83-33D1-A91F-292F12876C5B}\TypeLib regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A074C60F-D82F-4695-9E07-826FDAAF223E}\InprocServer32\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" regasm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF53CD8B-ECFF-4E34-A776-654C5306F4F6}\ = "RemoteControl.VWakeUp" regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF53CD8B-ECFF-4E34-A776-654C5306F4F6}\Version regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{579BC9B0-2A36-37FC-B36B-FA979521CF49}\TypeLib regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4EE08CED-2C53-44E2-A11F-22CD5C1A4DFF}\ProxyStubClsid32 regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AE832103-079C-38B7-A8B7-C56399D9D918} regasm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EC4BBE22-E76B-3524-AFA7-76BE20349172}\TypeLib regasm.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c0000000100000004000000001000000400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd UVUpdater.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd UVUpdater.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd UVUpdater.exe -
Runs net.exe
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 3696 UltraViewer_Desktop.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 960 UVUpdater.exe 960 UVUpdater.exe 3908 UVUninstallHelper.exe 1800 tmpAC7C.tmp 1800 tmpAC7C.tmp 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 1784 UltraViewer_Service.exe 960 UVUpdater.exe 960 UVUpdater.exe 960 UVUpdater.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 960 UVUpdater.exe Token: SeDebugPrivilege 3908 UVUninstallHelper.exe Token: SeDebugPrivilege 1556 taskkill.exe Token: SeDebugPrivilege 3364 taskkill.exe Token: SeDebugPrivilege 4860 taskkill.exe Token: SeDebugPrivilege 1596 taskkill.exe Token: SeDebugPrivilege 552 taskkill.exe Token: SeDebugPrivilege 2280 taskkill.exe Token: SeDebugPrivilege 2896 taskkill.exe Token: SeDebugPrivilege 5028 taskkill.exe Token: SeDebugPrivilege 2184 taskkill.exe Token: SeDebugPrivilege 4032 taskkill.exe Token: SeDebugPrivilege 3384 taskkill.exe Token: SeDebugPrivilege 3604 taskkill.exe Token: SeDebugPrivilege 3608 taskkill.exe Token: SeDebugPrivilege 868 taskkill.exe Token: SeDebugPrivilege 3992 taskkill.exe Token: SeDebugPrivilege 1660 taskkill.exe Token: SeDebugPrivilege 3584 taskkill.exe Token: SeDebugPrivilege 3884 taskkill.exe Token: SeDebugPrivilege 1080 taskkill.exe Token: SeDebugPrivilege 4468 taskkill.exe Token: SeDebugPrivilege 4180 taskkill.exe Token: SeDebugPrivilege 4284 taskkill.exe Token: SeDebugPrivilege 1988 taskkill.exe Token: SeDebugPrivilege 3680 taskkill.exe Token: SeDebugPrivilege 464 taskkill.exe Token: SeDebugPrivilege 2332 taskkill.exe Token: SeDebugPrivilege 1496 taskkill.exe Token: SeDebugPrivilege 3992 taskkill.exe Token: SeDebugPrivilege 2616 taskkill.exe Token: SeDebugPrivilege 4396 taskkill.exe Token: SeDebugPrivilege 320 taskkill.exe Token: SeDebugPrivilege 2796 taskkill.exe Token: SeDebugPrivilege 3308 taskkill.exe Token: SeDebugPrivilege 3872 taskkill.exe Token: SeDebugPrivilege 912 taskkill.exe Token: SeDebugPrivilege 1608 taskkill.exe Token: SeDebugPrivilege 4804 taskkill.exe Token: SeDebugPrivilege 436 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 5056 taskkill.exe Token: SeDebugPrivilege 1276 taskkill.exe Token: SeDebugPrivilege 3192 taskkill.exe Token: SeDebugPrivilege 1192 taskkill.exe Token: SeDebugPrivilege 3856 taskkill.exe Token: SeDebugPrivilege 4708 taskkill.exe Token: SeDebugPrivilege 4236 taskkill.exe Token: SeDebugPrivilege 1860 taskkill.exe Token: SeDebugPrivilege 4272 taskkill.exe Token: SeDebugPrivilege 2988 taskkill.exe Token: SeDebugPrivilege 2696 taskkill.exe Token: SeDebugPrivilege 1320 taskkill.exe Token: SeDebugPrivilege 2568 taskkill.exe Token: SeDebugPrivilege 3536 taskkill.exe Token: SeDebugPrivilege 3752 taskkill.exe Token: SeDebugPrivilege 1276 taskkill.exe Token: SeDebugPrivilege 4504 taskkill.exe Token: SeDebugPrivilege 3788 taskkill.exe Token: SeDebugPrivilege 3304 taskkill.exe Token: SeDebugPrivilege 4576 taskkill.exe Token: SeDebugPrivilege 1300 taskkill.exe Token: SeDebugPrivilege 1784 taskkill.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1800 tmpAC7C.tmp -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 3696 UltraViewer_Desktop.exe 64 UltraViewer_Desktop.exe 4416 UltraViewer_Desktop.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 1452 960 UVUpdater.exe 100 PID 960 wrote to memory of 1452 960 UVUpdater.exe 100 PID 960 wrote to memory of 1452 960 UVUpdater.exe 100 PID 1452 wrote to memory of 1800 1452 tmpAC7C.tmp 101 PID 1452 wrote to memory of 1800 1452 tmpAC7C.tmp 101 PID 1452 wrote to memory of 1800 1452 tmpAC7C.tmp 101 PID 1800 wrote to memory of 3908 1800 tmpAC7C.tmp 102 PID 1800 wrote to memory of 3908 1800 tmpAC7C.tmp 102 PID 1800 wrote to memory of 3908 1800 tmpAC7C.tmp 102 PID 1800 wrote to memory of 4856 1800 tmpAC7C.tmp 103 PID 1800 wrote to memory of 4856 1800 tmpAC7C.tmp 103 PID 1800 wrote to memory of 4856 1800 tmpAC7C.tmp 103 PID 4856 wrote to memory of 380 4856 net.exe 105 PID 4856 wrote to memory of 380 4856 net.exe 105 PID 4856 wrote to memory of 380 4856 net.exe 105 PID 1800 wrote to memory of 392 1800 tmpAC7C.tmp 106 PID 1800 wrote to memory of 392 1800 tmpAC7C.tmp 106 PID 1800 wrote to memory of 392 1800 tmpAC7C.tmp 106 PID 392 wrote to memory of 1664 392 net.exe 108 PID 392 wrote to memory of 1664 392 net.exe 108 PID 392 wrote to memory of 1664 392 net.exe 108 PID 1800 wrote to memory of 2656 1800 tmpAC7C.tmp 109 PID 1800 wrote to memory of 2656 1800 tmpAC7C.tmp 109 PID 1800 wrote to memory of 2656 1800 tmpAC7C.tmp 109 PID 1800 wrote to memory of 1556 1800 tmpAC7C.tmp 111 PID 1800 wrote to memory of 1556 1800 tmpAC7C.tmp 111 PID 1800 wrote to memory of 1556 1800 tmpAC7C.tmp 111 PID 1800 wrote to memory of 3364 1800 tmpAC7C.tmp 113 PID 1800 wrote to memory of 3364 1800 tmpAC7C.tmp 113 PID 1800 wrote to memory of 3364 1800 tmpAC7C.tmp 113 PID 1800 wrote to memory of 4860 1800 tmpAC7C.tmp 115 PID 1800 wrote to memory of 4860 1800 tmpAC7C.tmp 115 PID 1800 wrote to memory of 4860 1800 tmpAC7C.tmp 115 PID 1800 wrote to memory of 1596 1800 tmpAC7C.tmp 117 PID 1800 wrote to memory of 1596 1800 tmpAC7C.tmp 117 PID 1800 wrote to memory of 1596 1800 tmpAC7C.tmp 117 PID 1800 wrote to memory of 552 1800 tmpAC7C.tmp 119 PID 1800 wrote to memory of 552 1800 tmpAC7C.tmp 119 PID 1800 wrote to memory of 552 1800 tmpAC7C.tmp 119 PID 1800 wrote to memory of 2280 1800 tmpAC7C.tmp 121 PID 1800 wrote to memory of 2280 1800 tmpAC7C.tmp 121 PID 1800 wrote to memory of 2280 1800 tmpAC7C.tmp 121 PID 1800 wrote to memory of 2896 1800 tmpAC7C.tmp 123 PID 1800 wrote to memory of 2896 1800 tmpAC7C.tmp 123 PID 1800 wrote to memory of 2896 1800 tmpAC7C.tmp 123 PID 1800 wrote to memory of 5028 1800 tmpAC7C.tmp 125 PID 1800 wrote to memory of 5028 1800 tmpAC7C.tmp 125 PID 1800 wrote to memory of 5028 1800 tmpAC7C.tmp 125 PID 1800 wrote to memory of 2184 1800 tmpAC7C.tmp 128 PID 1800 wrote to memory of 2184 1800 tmpAC7C.tmp 128 PID 1800 wrote to memory of 2184 1800 tmpAC7C.tmp 128 PID 1800 wrote to memory of 4032 1800 tmpAC7C.tmp 131 PID 1800 wrote to memory of 4032 1800 tmpAC7C.tmp 131 PID 1800 wrote to memory of 4032 1800 tmpAC7C.tmp 131 PID 1800 wrote to memory of 3384 1800 tmpAC7C.tmp 133 PID 1800 wrote to memory of 3384 1800 tmpAC7C.tmp 133 PID 1800 wrote to memory of 3384 1800 tmpAC7C.tmp 133 PID 1800 wrote to memory of 3604 1800 tmpAC7C.tmp 135 PID 1800 wrote to memory of 3604 1800 tmpAC7C.tmp 135 PID 1800 wrote to memory of 3604 1800 tmpAC7C.tmp 135 PID 1800 wrote to memory of 3608 1800 tmpAC7C.tmp 137 PID 1800 wrote to memory of 3608 1800 tmpAC7C.tmp 137 PID 1800 wrote to memory of 3608 1800 tmpAC7C.tmp 137 PID 1800 wrote to memory of 868 1800 tmpAC7C.tmp 139 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp"C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp"C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp" /SL5="$40234,3135487,121344,C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe"C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\SysWOW64\net.exe"net" stop UltraViewService4⤵
- Discovers systems in the same network
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UltraViewService5⤵PID:380
-
-
-
C:\Windows\SysWOW64\net.exe"net" stop UltraViewService4⤵
- Discovers systems in the same network
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop UltraViewService5⤵PID:1664
-
-
-
C:\Windows\SysWOW64\sc.exe"sc" delete UltraViewService4⤵
- Launches sc.exe
PID:2656
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3364
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4860
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1596
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:552
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2280
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2896
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5028
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2184
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4032
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3384
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3604
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3608
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:868
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1660
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3584
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1080
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4180
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4284
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3680
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:464
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1496
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4396
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3872
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:912
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:436
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4708
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4236
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1860
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4272
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1320
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2568
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3752
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1276
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4504
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3788
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:3304
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4576
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1300
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:216
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:640
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3664
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:4836
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3484
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:2428
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:2968
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:2700
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3136
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1268
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:2236
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1644
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4300
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3404
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1784
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:3932
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3608
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3664
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:212
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:4648
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:2076
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4372
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:404
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1192
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:3736
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1856
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵PID:64
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4780
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4412
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4380
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:1320
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill.exe" /f /im "UltraViewer_Desktop.exe"4⤵
- Kills process with taskkill
PID:4064
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb4⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Modifies registry class
PID:3172
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb4⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:2520
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:64 -
C:\Windows\SysWOW64\sc.exesc failure "UltraViewService" reset= 0 actions= restart/600005⤵
- Launches sc.exe
PID:1720
-
-
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm404⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4416
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:4580
-
C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1784 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵
- Drops file in System32 directory
PID:2896
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵PID:744
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase2⤵PID:380
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
132KB
MD533bb06b97f8f188735f4aae5b413eef8
SHA1e5c236f39d5b9d25b650cba7707df9149d3f4d16
SHA256931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2
SHA512abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c
-
Filesize
14KB
MD5b6a8ccdc51964e1551bef57b4a42a899
SHA152de4c2fc039af9a2f1295e8419123ba89ee5858
SHA256c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a
SHA5128d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6
-
Filesize
1KB
MD5473b3896eae7ea66f61e9d0ffbe5b9b1
SHA1d7ef69586317f7472ce400bc7bef75bfa4095592
SHA256d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f
SHA512981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
496KB
MD55da17fa97fce539c78e3018ee1c29cd0
SHA1cff12edd4361fa5c310250ebaacbfc54274f00c8
SHA25692254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe
SHA5121f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
1.0MB
MD521e54454f1f753b926c6f2d9aa05b91e
SHA1b3c2a91eae69fc0594946165c4a9062502850076
SHA25621c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9
SHA5129bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8
-
Filesize
236KB
MD56905ce31fccabd2c0b51bf910698ad83
SHA1940ea6dbd498cb89423e58186222da2cc09fb45f
SHA256670896b87a02b8cf9d715ad0c62ed04160ddc5fc075adc52cb2eb038f9ecd282
SHA5126a31920226a5b774134ad7ff686b42f1965496efc6516e1dae4634b7c172243a35ba005dcb50e3c2d570a1e9228cc2fd11cc67679a0b79998ff67dbd71b0cbc4
-
Filesize
979KB
MD56f63069253c1c0de8a6fa182de6d0a8c
SHA16308d0910529e0a4f0738547841d07a7e8f074fe
SHA256b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7
SHA5125856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61
-
Filesize
979KB
MD56f63069253c1c0de8a6fa182de6d0a8c
SHA16308d0910529e0a4f0738547841d07a7e8f074fe
SHA256b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7
SHA5125856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61
-
Filesize
979KB
MD56f63069253c1c0de8a6fa182de6d0a8c
SHA16308d0910529e0a4f0738547841d07a7e8f074fe
SHA256b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7
SHA5125856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61
-
Filesize
979KB
MD56f63069253c1c0de8a6fa182de6d0a8c
SHA16308d0910529e0a4f0738547841d07a7e8f074fe
SHA256b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7
SHA5125856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61
-
Filesize
979KB
MD56f63069253c1c0de8a6fa182de6d0a8c
SHA16308d0910529e0a4f0738547841d07a7e8f074fe
SHA256b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7
SHA5125856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61
-
Filesize
310B
MD542b8d26600dcb85572ee43616f929d6a
SHA131a4c46641129ef59eb925621c1aa4f8401d776c
SHA25699f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc
SHA512d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae
-
Filesize
226KB
MD530c5f65655bbaeab0f1afd219c609050
SHA1f0317b4e3b420fd2e00483f366a0c9d31d2a8457
SHA2568befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7
SHA512611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a
-
Filesize
226KB
MD530c5f65655bbaeab0f1afd219c609050
SHA1f0317b4e3b420fd2e00483f366a0c9d31d2a8457
SHA2568befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7
SHA512611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a
-
Filesize
225B
MD5679aca3e8125584e8704b2dfdfa20a0b
SHA1bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e
SHA256470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4
SHA5128441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
1.3MB
MD55343a19c618bc515ceb1695586c6c137
SHA14dedae8cbde066f31c8e6b52c0baa3f8b1117742
SHA2562246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce
SHA512708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606
-
Filesize
124KB
MD58b3f15a335710c799eae2395fa6b322d
SHA181b9f58fe2c61e26e758690f59fa4de4bc8b462b
SHA25609ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c
SHA512c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9
-
Filesize
124KB
MD58b3f15a335710c799eae2395fa6b322d
SHA181b9f58fe2c61e26e758690f59fa4de4bc8b462b
SHA25609ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c
SHA512c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9
-
Filesize
1KB
MD5bf9fccd82a74ae0fe94fe7f265ac9bca
SHA1701036824a82ddaba67b37f545eb42e8ddf996fd
SHA25610fb5250e5422aba27206a81c71b72b98a1d2e250a2c112c0ffb8a9f28230144
SHA512fdc4a7a0e839056f1d00a3242c25791fad96679e3d5f33da57d5b4acb84bf8d143bdc592714eeb35be1d231c9bea3cf00412b082d2a9c81f1340717a0852394e
-
Filesize
507B
MD576ffb2f33cb32ade8fc862a67599e9d8
SHA1920cc4ab75b36d2f9f6e979b74db568973c49130
SHA256f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310
SHA512f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e
-
Filesize
1.1MB
MD5e845838d99d29c4bba4ad35ee996dea3
SHA134a9f433ce1e3339e07d75f0a74efd676b1d7cca
SHA256b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
SHA512fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d
-
Filesize
1.1MB
MD5e845838d99d29c4bba4ad35ee996dea3
SHA134a9f433ce1e3339e07d75f0a74efd676b1d7cca
SHA256b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d
SHA512fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d
-
Filesize
43KB
MD5ececb301656f5f8c6a46a8abf8d928fe
SHA19bdf8a054c71d34837262ab306db92d3ee70db3b
SHA256801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b
SHA512314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6
-
Filesize
43KB
MD5ececb301656f5f8c6a46a8abf8d928fe
SHA19bdf8a054c71d34837262ab306db92d3ee70db3b
SHA256801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b
SHA512314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6
-
Filesize
225B
MD5679aca3e8125584e8704b2dfdfa20a0b
SHA1bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e
SHA256470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4
SHA5128441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e
-
Filesize
232KB
MD555c310c0319260d798757557ab3bf636
SHA10892eb7ed31d8bb20a56c6835990749011a2d8de
SHA25654e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
SHA512e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
121KB
MD548ad1a1c893ce7bf456277a0a085ed01
SHA1803997ef17eedf50969115c529a2bf8de585dc91
SHA256b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
SHA5127c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
-
Filesize
3.4MB
MD5a3d0a2d3e5c40d7bd76c3e6a8bc4b18b
SHA10a2dd8004ab193daf98a02b7a3a74fbf3170c5f8
SHA256a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90
SHA512b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064
-
Filesize
3.4MB
MD5a3d0a2d3e5c40d7bd76c3e6a8bc4b18b
SHA10a2dd8004ab193daf98a02b7a3a74fbf3170c5f8
SHA256a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90
SHA512b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064
-
Filesize
14KB
MD5c01eaa0bdcd7c30a42bbb35a9acbf574
SHA10aee3e1b873e41d040f1991819d0027b6cc68f54
SHA25632297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40
SHA512d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
Filesize42B
MD584cfdb4b995b1dbf543b26b86c863adc
SHA1d2f47764908bf30036cf8248b9ff5541e2711fa2
SHA256d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b
SHA512485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce
-
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
Filesize29KB
MD54ecb75060ef4f1409b4f72e5494c2ad9
SHA15fcc2f7b92bfc6e247d3c292c7d1993f51b3e16c
SHA2565c6ab2b417156ef0c010f69c203e85818dcbef0dc69e70b0731fc0082f0e69aa
SHA512d0c3ee1c93f48a8ebd34bc2ce1e4eb93c7d67867bfa8bc011c79a5feffcf082baf24e0676d1ce21ba40829e5f326e44886716bbe00817b50f3734dd94aba3a81