Analysis
-
max time kernel
102s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
16-04-2024 09:15
Static task
static1
Behavioral task
behavioral1
Sample
PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe
Resource
win10v2004-20240412-en
General
-
Target
PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe
-
Size
137.5MB
-
MD5
b33c62af31c864aa581919f2642e0ea9
-
SHA1
4c6bc5b7d1dca7c7ea0fe9faf1e9a3786095f66a
-
SHA256
51f152320b13eeb19538420087a5221e704f03acf7aebcb96751a51d762c8e5d
-
SHA512
90dc666a929b1ea192139216839af26d2f35795b4035c0088396f805620a3e0685cbdf157fec381ebec1611ff9f6ca0463a92a87faea63068ddc8926cf7e4cde
-
SSDEEP
3145728:+KAqbDYtCIq/Uiez1yHPO+eLEYvnLBHPVFee7tsZaIRNrBAgjtWaZsdkGpsF6nZ2:B9U0//exyre/NFee7tsZaIrif9d/sFU2
Malware Config
Signatures
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\SETDE3A.tmp DrvInst.exe File created C:\Windows\System32\drivers\SETDE3A.tmp DrvInst.exe File opened for modification C:\Windows\System32\drivers\clwvdPFC.sys DrvInst.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PerfectCam Service = "\"C:\\Program Files\\CyberLink\\PerfectCam\\PerfectCamService.exe\" /s" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PerfectCam = "\"C:\\Program Files\\CyberLink\\PerfectCam\\PerfectCam.exe\" /prelaunch" setup.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini setup.exe File opened for modification C:\Users\Public\Desktop\desktop.ini setup.exe -
Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation setup.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation WDExclusionPathTool.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation PerfectCam.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation GDPRDlg.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation CLUpdater.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation CLUpdater.exe Key value queried \REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation Trial.exe -
Drops file in System32 directory 16 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\clwvdpfc.inf_amd64_97bdd61df69f18f6\clwvdpfc.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD02.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD03.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD03.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\clwvdpfc.inf_amd64_97bdd61df69f18f6\clwvdPFC.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb} DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\clwvdpfc.inf_amd64_97bdd61df69f18f6\clwvdpfc.PNF CLDrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD04.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD04.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\clwvdPFC.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\SETDD02.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\clwvdpfc.inf_amd64_97bdd61df69f18f6\clwvdPFC.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\clwvdPFC.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{f3b1330f-c4eb-044f-a71d-1a83fb38f7eb}\clwvdpfc.inf DrvInst.exe File created C:\Windows\System32\DriverStore\drvstore.tmp DrvInst.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\Palatte\colorPalette_skintone_f.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\setting\fix_h.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\OLRSubmission\Skin\200\textedit_01.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Promotion\image\btn1.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\CLUpdater\Language\CHT\CLUpdater.xml 7z.exe File created C:\Program Files\CyberLink\PerfectCam\subsys\YouCam\ImageWrapper.dll 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\scale\scale_control_h.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\scale\scale_graduation_d.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\subsys\YouCam\tensorflow.dll 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\seekbar\Bg_btn_check.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\PerfectCam Presets\Makeup\eyeshadow\eyeshadow_160601_Summer_look_03_d.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\UI\Presentation\thememgr.kc 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Driver\Win8\x64\ setup.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\about\about_htmlview_bg.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\IM_main\btn\btn1_R_n.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\OLRSubmission\Skin\150\closebtn.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\PerfectCam Presets\Makeup\eyeline\01_03_01.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Template 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\SetupCameraDlg\btn_Next_h.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\splash\PFC2_splash_FK_00044.jpg 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\top\max_icon_h.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Boomerang\Language\Deu\BoomerangRC.dll 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\BackgroundFilter\CPU\Clair.dll setup.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\BackgroundFilter\CPU\inference_engine.dll setup.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Common\Media\button\tab_hl_n.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Common\Media\scrollbar2\vert\scrolbar_control_g.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\fileRoom\btn_bottom_panel_g.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\fileRoom\btn_middle_panel_g.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\top\btn_upgrade_h.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\CLUpdater\Skin\150\checkbox-SG.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\UI\Webcam\LibraryPage\MonthItem.kc 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Lang\ITA\IM.dll 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Common\Media\checkbox 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\Activate\bg_activation.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\PerfectCam Presets\Makeup\eyebrow\150428_12.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\PerfectCam Presets\Makeup\eyeshadow\02_03_02.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\UI\Webcam\Palatte\__init__.kc 7z.exe File created C:\Program Files\CyberLink\PerfectCam\OLRSubmission\REGrt_ESP.dll 7z.exe File created C:\Program Files\CyberLink\Shared files\language\eti\EffectExtractor.dll setup.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Common\Media\scrollbar\btn_vscroll_thumb_h.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\playback\btn_pause_h.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\UI\Webcam\EULADeclineConfirmDlg.kc 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Boomerang\Language\Sve\BoomerangRC.dll 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Driver\Win10\x64\clwvdPFC.sys 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\ShareFiles\Share\language\rom\EffectExtractor.dll 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Layout\LibraryPage\LibraryTopPanel.bkml 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\button\btn_back_p.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\button\btn_share_n.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\Palatte\delete_h.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Profile\WMV Best Quality.prx 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\CLUpdater\Language\DEU\CLUpdater.xml 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\subsys\YouCam\tensorflow.dll setup.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Layout\common\CheckButton2WithText.bkml 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\IM_main\bg.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\OLRSubmission\Skin\skin_CDKey.xml 7z.exe File created C:\Program Files\CyberLink\PerfectCam\subsys\SplashWnd\PySplashWnd.kc 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\scale\scale_control_n.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\panel\button\panel_l_arrow_h2.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\UI\Utils\mathutils.kc 7z.exe File created C:\Program Files\CyberLink\PerfectCam\koan\python27.dll 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\libraryPage\thumbnail\months_photo.png 7z.exe File created C:\Program Files\CyberLink\PerfectCam\Driver\Win8.1\x64\clwvdPFC.inf 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\SetupCameraDlg\SkyForBusiness\pic_CameraSetting_SkyForBusiness_01.png 7z.exe File opened for modification C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\setting\fix_d.png 7z.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\INF\c_media.PNF CLDrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log CLDrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log svchost.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Executes dropped EXE 23 IoCs
pid Process 1400 setup.exe 3620 7z.exe 3908 7z.exe 4308 7z.exe 1312 WDExclusionPathTool.exe 8 CLDrvInst.exe 4432 PerfectCamService.exe 3612 TaskScheduler.exe 884 PerfectCam.exe 1056 OLRStateCheck.exe 3448 GDPRDlg.exe 1372 GpuUtilityEx.exe 4640 GpuUtilityEx.exe 932 GpuUtilityEx.exe 3692 OLRStateCheck.exe 1676 OLRStateCheck.exe 3600 OLRStateCheck.exe 4068 CLUpdater.exe 236 OLRStateCheck.exe 4980 CLUpdater.exe 1752 Trial.exe 3140 Trial.exe 1960 Trial.exe -
Loads dropped DLL 64 IoCs
pid Process 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 3620 7z.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 3908 7z.exe 4308 7z.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 3860 Regsvr32.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe -
Registers COM server for autorun 1 TTPs 18 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ = "%SystemRoot%\\System32\\kstvtune.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ = "%SystemRoot%\\System32\\kstvtune.ax" DrvInst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs CLDrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 CLDrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID CLDrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID CLDrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 CLDrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 CLDrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters DrvInst.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor PerfectCam.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor PerfectCam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PerfectCam.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PerfectCam.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 PerfectCam.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor PerfectCam.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PerfectCam.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 PerfectCam.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 PerfectCam.exe -
Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\Trial = 00000000000000000000000000000000 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mklk\ = "PerfectCam2.0mklkfile" setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\Spend = 00000000000000000000000000000000 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\ = "WDM Analog Crossbar" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\ = "WDM TV Audio" DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\TrialRunBefore = 01000000 Trial.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ = "%SystemRoot%\\System32\\kstvtune.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\9C2A113C9F8AA80438683B11388357C4\PackageCode = "3E0E8C4F9D07F8A4B9348B556F03A326" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\version = "2.0" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming TV Audio Devices" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\FriendlyName = "WDM Streaming Encoder Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Key created \REGISTRY\MACHINE\Software\Classes\PerfectCam2.0mklkfile\shell\Open\command setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PerfectCam2.0mklkfile\DefaultIcon\ = "C:\\Program Files (x86)\\CyberLink\\Shared files\\EffectExtractor.exe,7" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\Installer\Products\9C2A113C9F8AA80438683B11388357C4 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\ = "Analog Crossbar Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PerfectCam2.0mklkfile\shell\ = "Open" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\ = "WDM TV Tuner" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32 DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\ = "TV Tuner Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PerfectCam2.0mklkfile\shell\Open\ = "@C:\\Program Files\\CyberLink\\PerfectCam\\MUITransfer\\Resource.dll,-109" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PerfectCam2.0mklkfile\shell\Open\command\ = "\"C:\\Program Files (x86)\\CyberLink\\Shared files\\EffectExtractor.exe\" \"%1\"" setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{A799A800-A46D-11d0-A18C-00A02401DCD4} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A800-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A800-A46D-11d0-A18C-00A02401DCD4}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B} DrvInst.exe Key created \REGISTRY\MACHINE\Software\Classes\PerfectCam2.0mklkfile setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{A799A802-A46D-11d0-A18C-00A02401DCD4} DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\Install Date = e807040002001000090011000b00e701 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{19689BF6-C384-48FD-AD51-90E58C79F70B}\CLSID = "{19689BF6-C384-48FD-AD51-90E58C79F70B}" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC} Trial.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A800-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming TV Tuner Devices" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4}\FriendlyName = "WDM Streaming Crossbar Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\ = "TV Audio Property Page" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96463-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\Trial = e8070400020010000900110021002d02 Trial.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{A799A801-A46D-11d0-A18C-00A02401DCD4}\CLSID = "{A799A801-A46D-11d0-A18C-00A02401DCD4}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}\CLSID = "{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96461-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96462-78F3-11d0-A18C-00A0C9118956} DrvInst.exe Key created \REGISTRY\MACHINE\Software\Classes\.mklk setup.exe Key created \REGISTRY\MACHINE\Software\Classes\PerfectCam2.0mklkfile\DefaultIcon setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC}\Live = 01000000 setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32\ = "%SystemRoot%\\System32\\kstvtune.ax" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ThreadingModel = "Both" DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PerfectCam2.0mklkfile\ = "mklk File" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{AB454181-DF07-47DF-9C31-C577A3E0B5CC} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DA4E3DA0-D07D-11d0-BD50-00A0C911CE86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8}\FriendlyName = "WDM Streaming Multiplexer Devices" DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE40-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{266EEE41-6C63-11cf-8A03-00AA006ECB65}\InprocServer32 DrvInst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{da4e3da0-d07d-11d0-bd50-00a0c911ce86}\Instance\{7A5DE1D3-01A1-452C-B481-4FA2B96271E8} DrvInst.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{71F96460-78F3-11d0-A18C-00A0C9118956}\InprocServer32\ = "%SystemRoot%\\System32\\ksxbar.ax" DrvInst.exe Key created \REGISTRY\MACHINE\Software\Classes\PerfectCam2.0mklkfile\shell\Open setup.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 setup.exe -
Runs .reg file with regedit 1 IoCs
pid Process 240 Regedit.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 1400 setup.exe 2520 powershell.exe 2520 powershell.exe 3184 powershell.exe 3184 powershell.exe 1052 powershell.exe 1052 powershell.exe 1956 powershell.exe 1956 powershell.exe 3192 powershell.exe 3192 powershell.exe 4868 powershell.exe 4868 powershell.exe 4864 powershell.exe 4864 powershell.exe 4312 powershell.exe 4312 powershell.exe 3496 powershell.exe 3496 powershell.exe 2684 powershell.exe 2684 powershell.exe 2684 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 3620 7z.exe Token: 35 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeSecurityPrivilege 3620 7z.exe Token: SeRestorePrivilege 3908 7z.exe Token: 35 3908 7z.exe Token: SeSecurityPrivilege 3908 7z.exe Token: SeSecurityPrivilege 3908 7z.exe Token: SeRestorePrivilege 4308 7z.exe Token: 35 4308 7z.exe Token: SeSecurityPrivilege 4308 7z.exe Token: SeSecurityPrivilege 4308 7z.exe Token: SeDebugPrivilege 2520 powershell.exe Token: SeDebugPrivilege 3184 powershell.exe Token: SeDebugPrivilege 1052 powershell.exe Token: SeDebugPrivilege 1956 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe Token: SeDebugPrivilege 4868 powershell.exe Token: SeDebugPrivilege 4864 powershell.exe Token: SeDebugPrivilege 4312 powershell.exe Token: SeDebugPrivilege 3496 powershell.exe Token: SeDebugPrivilege 2684 powershell.exe Token: SeAuditPrivilege 1964 svchost.exe Token: SeSecurityPrivilege 1964 svchost.exe Token: SeLoadDriverPrivilege 8 CLDrvInst.exe Token: SeRestorePrivilege 3908 DrvInst.exe Token: SeBackupPrivilege 3908 DrvInst.exe Token: SeLoadDriverPrivilege 3908 DrvInst.exe Token: SeLoadDriverPrivilege 3908 DrvInst.exe Token: SeLoadDriverPrivilege 3908 DrvInst.exe Token: SeIncreaseQuotaPrivilege 3272 WMIC.exe Token: SeSecurityPrivilege 3272 WMIC.exe Token: SeTakeOwnershipPrivilege 3272 WMIC.exe Token: SeLoadDriverPrivilege 3272 WMIC.exe Token: SeSystemProfilePrivilege 3272 WMIC.exe Token: SeSystemtimePrivilege 3272 WMIC.exe Token: SeProfSingleProcessPrivilege 3272 WMIC.exe Token: SeIncBasePriorityPrivilege 3272 WMIC.exe Token: SeCreatePagefilePrivilege 3272 WMIC.exe Token: SeBackupPrivilege 3272 WMIC.exe Token: SeRestorePrivilege 3272 WMIC.exe Token: SeShutdownPrivilege 3272 WMIC.exe Token: SeDebugPrivilege 3272 WMIC.exe Token: SeSystemEnvironmentPrivilege 3272 WMIC.exe Token: SeRemoteShutdownPrivilege 3272 WMIC.exe Token: SeUndockPrivilege 3272 WMIC.exe Token: SeManageVolumePrivilege 3272 WMIC.exe Token: 33 3272 WMIC.exe Token: 34 3272 WMIC.exe Token: 35 3272 WMIC.exe Token: 36 3272 WMIC.exe Token: SeIncreaseQuotaPrivilege 3272 WMIC.exe Token: SeSecurityPrivilege 3272 WMIC.exe Token: SeTakeOwnershipPrivilege 3272 WMIC.exe Token: SeLoadDriverPrivilege 3272 WMIC.exe Token: SeSystemProfilePrivilege 3272 WMIC.exe Token: SeSystemtimePrivilege 3272 WMIC.exe Token: SeProfSingleProcessPrivilege 3272 WMIC.exe Token: SeIncBasePriorityPrivilege 3272 WMIC.exe Token: SeCreatePagefilePrivilege 3272 WMIC.exe Token: SeBackupPrivilege 3272 WMIC.exe Token: SeRestorePrivilege 3272 WMIC.exe Token: SeShutdownPrivilege 3272 WMIC.exe Token: SeDebugPrivilege 3272 WMIC.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 4432 PerfectCamService.exe 3448 GDPRDlg.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe -
Suspicious use of SendNotifyMessage 5 IoCs
pid Process 4432 PerfectCamService.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 884 PerfectCam.exe 884 PerfectCam.exe -
Suspicious use of SetWindowsHookEx 24 IoCs
pid Process 1400 setup.exe 3620 7z.exe 3908 7z.exe 4308 7z.exe 1312 WDExclusionPathTool.exe 8 CLDrvInst.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 4432 PerfectCamService.exe 3612 TaskScheduler.exe 884 PerfectCam.exe 884 PerfectCam.exe 884 PerfectCam.exe 4068 CLUpdater.exe 4068 CLUpdater.exe 4980 CLUpdater.exe 4980 CLUpdater.exe 1752 Trial.exe 1752 Trial.exe 1752 Trial.exe 1752 Trial.exe 3140 Trial.exe 1960 Trial.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3188 wrote to memory of 1400 3188 PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe 92 PID 3188 wrote to memory of 1400 3188 PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe 92 PID 3188 wrote to memory of 1400 3188 PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe 92 PID 1400 wrote to memory of 3620 1400 setup.exe 96 PID 1400 wrote to memory of 3620 1400 setup.exe 96 PID 1400 wrote to memory of 3620 1400 setup.exe 96 PID 1400 wrote to memory of 3908 1400 setup.exe 100 PID 1400 wrote to memory of 3908 1400 setup.exe 100 PID 1400 wrote to memory of 3908 1400 setup.exe 100 PID 1400 wrote to memory of 4308 1400 setup.exe 102 PID 1400 wrote to memory of 4308 1400 setup.exe 102 PID 1400 wrote to memory of 4308 1400 setup.exe 102 PID 1400 wrote to memory of 2520 1400 setup.exe 104 PID 1400 wrote to memory of 2520 1400 setup.exe 104 PID 1400 wrote to memory of 2520 1400 setup.exe 104 PID 1400 wrote to memory of 3184 1400 setup.exe 107 PID 1400 wrote to memory of 3184 1400 setup.exe 107 PID 1400 wrote to memory of 3184 1400 setup.exe 107 PID 1400 wrote to memory of 1052 1400 setup.exe 109 PID 1400 wrote to memory of 1052 1400 setup.exe 109 PID 1400 wrote to memory of 1052 1400 setup.exe 109 PID 1400 wrote to memory of 1956 1400 setup.exe 111 PID 1400 wrote to memory of 1956 1400 setup.exe 111 PID 1400 wrote to memory of 1956 1400 setup.exe 111 PID 1400 wrote to memory of 3192 1400 setup.exe 113 PID 1400 wrote to memory of 3192 1400 setup.exe 113 PID 1400 wrote to memory of 3192 1400 setup.exe 113 PID 1400 wrote to memory of 4868 1400 setup.exe 115 PID 1400 wrote to memory of 4868 1400 setup.exe 115 PID 1400 wrote to memory of 4868 1400 setup.exe 115 PID 1400 wrote to memory of 4864 1400 setup.exe 119 PID 1400 wrote to memory of 4864 1400 setup.exe 119 PID 1400 wrote to memory of 4864 1400 setup.exe 119 PID 1400 wrote to memory of 4312 1400 setup.exe 121 PID 1400 wrote to memory of 4312 1400 setup.exe 121 PID 1400 wrote to memory of 4312 1400 setup.exe 121 PID 1400 wrote to memory of 3496 1400 setup.exe 123 PID 1400 wrote to memory of 3496 1400 setup.exe 123 PID 1400 wrote to memory of 3496 1400 setup.exe 123 PID 1400 wrote to memory of 3860 1400 setup.exe 125 PID 1400 wrote to memory of 3860 1400 setup.exe 125 PID 1400 wrote to memory of 3860 1400 setup.exe 125 PID 1400 wrote to memory of 240 1400 setup.exe 127 PID 1400 wrote to memory of 240 1400 setup.exe 127 PID 1400 wrote to memory of 1312 1400 setup.exe 128 PID 1400 wrote to memory of 1312 1400 setup.exe 128 PID 1312 wrote to memory of 4308 1312 WDExclusionPathTool.exe 130 PID 1312 wrote to memory of 4308 1312 WDExclusionPathTool.exe 130 PID 4308 wrote to memory of 2684 4308 cmd.exe 132 PID 4308 wrote to memory of 2684 4308 cmd.exe 132 PID 1400 wrote to memory of 8 1400 setup.exe 133 PID 1400 wrote to memory of 8 1400 setup.exe 133 PID 1964 wrote to memory of 2708 1964 svchost.exe 136 PID 1964 wrote to memory of 2708 1964 svchost.exe 136 PID 1964 wrote to memory of 3908 1964 svchost.exe 137 PID 1964 wrote to memory of 3908 1964 svchost.exe 137 PID 1400 wrote to memory of 4432 1400 setup.exe 139 PID 1400 wrote to memory of 4432 1400 setup.exe 139 PID 1400 wrote to memory of 4432 1400 setup.exe 139 PID 1400 wrote to memory of 3612 1400 setup.exe 140 PID 1400 wrote to memory of 3612 1400 setup.exe 140 PID 1400 wrote to memory of 3612 1400 setup.exe 140 PID 884 wrote to memory of 1056 884 PerfectCam.exe 142 PID 884 wrote to memory of 1056 884 PerfectCam.exe 142
Processes
-
C:\Users\Admin\AppData\Local\Temp\PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe"C:\Users\Admin\AppData\Local\Temp\PerfectCam_2.3.7124.0_Subscription_PFC231124-01.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\setup.exe"2⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\SupportFiles.7z" -o"C:\ProgramData\SUPPORTDIR\20240416_91637_1400" -aoa3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3620
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data1.7z" -o"C:\Program Files\CyberLink\PerfectCam" -aoa3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3908
-
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\7z.exe" x "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Data2.7z" -o"C:\Program Files\CyberLink\PerfectCam" -aoa3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4308
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1052
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4868
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4864
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4312
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsd4FD6.tmp\tempfile.ps1"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Windows\SysWOW64\Regsvr32.exe"C:\Windows\SysWOW64\Regsvr32.exe" /s "C:\Program Files\CyberLink\PerfectCam\REGX.dll"3⤵
- Loads dropped DLL
PID:3860
-
-
C:\Windows\Regedit.exe"C:\Windows\Regedit.exe" /s "C:\Program Files\CyberLink\PerfectCam\default.reg"3⤵
- Runs .reg file with regedit
PID:240
-
-
C:\Program Files\CyberLink\PerfectCam\WDExclusionPathTool\x64\WDExclusionPathTool.exe"C:\Program Files\CyberLink\PerfectCam\WDExclusionPathTool\x64\WDExclusionPathTool.exe" -Add "C:\Program Files\CyberLink\PerfectCam"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /NOCONSOLE /C PowerShell Add-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PerfectCam\""4⤵
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell Add-MpPreference -ExclusionPath "\"C:\Program Files\CyberLink\PerfectCam\""5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2684
-
-
-
-
C:\Program Files\CyberLink\PerfectCam\Driver\CLDrvInst.exe"C:\Program Files\CyberLink\PerfectCam\Driver\CLDrvInst.exe" install "C:\Program Files\CyberLink\PerfectCam\Driver\clwvdPFC.inf" root\clwvdPFC3⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:8
-
-
C:\Program Files\CyberLink\PerfectCam\PerfectCamService.exe"C:\Program Files\CyberLink\PerfectCam\PerfectCamService.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4432
-
-
C:\ProgramData\SUPPORTDIR\20240416_91637_1400\TaskScheduler.exe"C:\ProgramData\SUPPORTDIR\20240416_91637_1400\TaskScheduler.exe" "C:\Program Files\CyberLink\PerfectCam\PerfectCam.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3612
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{16eadabe-51fe-1346-a70a-8e5eeee03b80}\clwvdpfc.inf" "9" "4eb50072f" "00000000000000E8" "WinSta0\Default" "0000000000000158" "208" "c:\program files\cyberlink\perfectcam\driver"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2708
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "2" "211" "ROOT\MEDIA\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:dac64d37d9d525a7:clwvd.NTamd64:2.4.35409.10522:root\clwvdpfc," "4eb50072f" "00000000000000E8"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Registers COM server for autorun
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Program Files\CyberLink\PerfectCam\PerfectCam.exe"C:\Program Files\CyberLink\PerfectCam\PerfectCam.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe" /UnoPath:C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\UNO.dll /IsRegister2⤵
- Executes dropped EXE
PID:1056
-
-
C:\Program Files\CyberLink\PerfectCam\GDPRDlg\GDPRDlg.exe"C:\Program Files\CyberLink\PerfectCam\GDPRDlg\GDPRDlg.exe" -a"C:\Program Files\CyberLink\PerfectCam\APReg.url" -m"C:\Program Files\CyberLink\PerfectCam\MUITransfer\Resource.dll" -l"ENU"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:3448
-
-
C:\Program Files\CyberLink\PerfectCam\GpuUtilityEx.exeGpuUtilityEx.exe GetMultiDeviceVendors_D3D9 02⤵
- Executes dropped EXE
PID:1372
-
-
C:\Program Files\CyberLink\PerfectCam\GpuUtilityEx.exeGpuUtilityEx.exe QueryNVidiaCapability 02⤵
- Executes dropped EXE
PID:4640
-
-
C:\Program Files\CyberLink\PerfectCam\GpuUtilityEx.exeGpuUtilityEx.exe QueryNVidiaKeplerCapability 02⤵
- Executes dropped EXE
PID:932
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic PATH Win32_videocontroller GET *2⤵PID:2260
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_videocontroller GET *3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3272
-
-
-
C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"/UnoPath:C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\UNO.dll,/LANG:ENU2⤵
- Executes dropped EXE
PID:3692
-
-
C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe" /UnoPath:C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\UNO.dll /IsRegister2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe" /UnoPath:C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\UNO.dll /IsRegister2⤵
- Executes dropped EXE
PID:3600
-
-
C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\CLUpdater.exe"CLUpdater.exe" C:\Users\Admin\AppData\Local\Temp\CLUpdater.ini2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4068
-
-
C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe"C:\Program Files\CyberLink\PerfectCam\OLRSubmission\OLRStateCheck.exe" /UnoPath:C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\UNO.dll /IsRegister2⤵
- Executes dropped EXE
PID:236
-
-
C:\Program Files\CyberLink\PerfectCam\subsys\BigBang\Runtime\CLUpdater.exe"CLUpdater.exe" C:\Users\Admin\AppData\Local\Temp\CLUpdater.ini2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4980
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Trial\Trial.exe "/LANG:ENU /SIGNIN""2⤵PID:3112
-
C:\Program Files\CyberLink\PerfectCam\Trial\Trial.exeTrial\Trial.exe "/LANG:ENU /SIGNIN"3⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1752
-
-
-
C:\Program Files\CyberLink\PerfectCam\Trial\Trial.exeTrial\Trial.exe /EXPIRED_CHECKING2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3140
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "Trial\Trial.exe "/LANG:ENU /SIGNIN""2⤵PID:1820
-
C:\Program Files\CyberLink\PerfectCam\Trial\Trial.exeTrial\Trial.exe "/LANG:ENU /SIGNIN"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1960
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\8f011ca798c1438683b3c5ccfbaa6a7f /t 4508 /p 17521⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Defense Evasion
Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
220KB
MD52920bf5a26a096896321e98364823fb2
SHA1910f35443ce5c450285fc87d820bc1acf0a4ce3e
SHA2563b800aa790b186e4448bdd571d6b8fbf2f1a5bffb0e5f6672bfd47927cb04ce8
SHA512670c08832c535de56526ac63f672955d0ef21d5ca3e0096d65ba86e5e77eb1b7c0ccce98355a60c857b3e56da388ba13d70a619359eac4e5aa421557852c793f
-
Filesize
93KB
MD5f7ca3b877d538ac6c814a0275d3ce6ca
SHA1839ad14a9b48f0f547fedc565a88ddf64571cecf
SHA25629bb7d14cc0e9a8979767a019e9758062865d4f93deb449dad012a626f944e2d
SHA512ff84ad42ffcbee130524fff2b5965afb4b99ebcf609f35bdb7fe97f918fc80809abc7cae24ce1cc4bea80d7112bf40f4086e414bda4affb0b5fb6bff84eaa98a
-
Filesize
170B
MD523efc06e073276892ae300f2f37b457b
SHA16596c458cc596206c4ff629e51112276ffb35c40
SHA256f634d25c448ad0bf71eef6cc9e5575cd8f717ec1f8f977915074629b85fd2f48
SHA5127daa544d9b14623e64a509d8f97472cf38e31f9d4111c946258b6f5f87e339a4fd61a3675d365fd835dc1e7e830017f870a88d8f40ac4656e9c9317ad3b35ede
-
Filesize
87B
MD5bb1f41599d620632353d9d8605e056e4
SHA17e2639fbc9e8d0da76d4b741888080798df00236
SHA2565cb62074105f1d4d33aa0e1a04c3c727cb6b537ac93b2367a5cb97131aadf393
SHA512582123457f36705f27bab3e24ddd4c5e1c4bfdab374d8514f8ea15868adaa38f9c94bdc91935884095049b93d373b16c3f6d4c5fbc6dfefb965419985d15b6d1
-
Filesize
1KB
MD52bcaf8e62ffa544437a16317076aa456
SHA1b7cec983237e9c93a4eef8654d190086f89fa930
SHA256d4f18c2bc5143158ab2c93832409e780873f86e7af0103b92be6e1a47ab47efe
SHA51216245e8e96d28e709649580a01d01d8bff3467b9e4e719e4ea3654cf0183ab651d1f4bca705df52e4ae23cfdf7cab186ef4c6651d13432598ea189883e369e46
-
Filesize
141B
MD59fea4be13f99518b6588d8219d83ea7b
SHA12f2b43a91a1d95bfca7779b42359cebfd07d7c23
SHA2563d35cda2996b364e614b0ae519852a0616700190166a1f1af1fdeaa8d5ca6559
SHA512000be338f6181f7c48dfed3ad7ecdff6a45d5b7fe385713d02867595983a8c26955052072d38cc689f0dae6f9f8058b25552f86a38695c9ded7e5a1f5a299af5
-
Filesize
128B
MD5f9f2b1efe8c6c61cad5141a61ead160f
SHA15b06d2b062e318e4bbad37e61999f06ec742d77c
SHA256c720366d109a0a6328fb5c7fff668fa8455b243b2a71095568d44fdaaa1f8d50
SHA51222dd8d957873020376cbade0b90acd95cd3608d0129d5d8f6be400ff42ddc3f78de3e397707a66a08241673ac197c024b18c76fa00990cd0144628a35b8fe5b2
-
C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\Palatte\colorPalette_skintone_h.png
Filesize789B
MD541b79e968b8ae4259ec715a3a5c74299
SHA120e632f7920b519a4de1e59d6671219bdd46f95d
SHA25685f708106ceed382fe2989152b11feeaef3365fd9bacc1fb90b74e7e7d0314f5
SHA5129d728cfaa19cb031648e8d342ec40cd14bd26e6ba98805019b07ff7159937cfa0838f0bd99a1bf72689e469975777a58dacf440752e12d1b0154091afaec1a40
-
C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\fileRoom\icon_filter_all.png
Filesize576B
MD5540116d5cf9f3ab3622da265ed2b98ad
SHA15d6882b285e8555913fc61ce526a0747663fea01
SHA2568c3205b30062210ef64376f3f61a8e73806858219666b94139c24a2fe6a2080c
SHA5125d7788173629cae8b6c8d4d47d44c1c992e7d2f6f0386bdd1155211ce8033fdadcb6da07ad283fefe898782fb069dd1defaadad3f851b0fa8ba0b9217507d061
-
C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\STD_main\fileRoom\icon_photo.png
Filesize630B
MD56c55070932b3e03ac26dd4e5914bf929
SHA1fbf650681e42d86aa0662fdfa46abefb1273b712
SHA256cf268ad3c726f0b967d336ffcc71183818b21957fa854ff27aa9b98044dc0dc2
SHA512a567a830f8a63e30553d02bb718438691a5507066bb6ac1cb74cebd2c78765e8e0240bd47fb1fb249237475090c8c77c72208d0da1979ac2f56d34a6dafc4f6f
-
C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\file_sharing\btn_clear_p.png
Filesize274B
MD5261a0aa9e5eda958f44a0af820361ba8
SHA13520bea055a637c3479618e23687d73705f51ce8
SHA256ced60e5a79ce5a9429351dbb8e4321f504d66e210b2a0c64b03b9ffe1654511c
SHA512eb2ec0ee854213d9e0c7d552ce15c5f2a4a8b940ca5ea2f907889a8bacd2ecb63b1fe4315f9274a6ec84acb9ac314b6c8729c6513facb57878bc45a2d3ff33bc
-
C:\Program Files\CyberLink\PerfectCam\Custom\Skin\Standard\Webcam\Media\file_sharing\btn_pen_clear_arrow_n.png
Filesize153B
MD5d70b4b441ff0e3885d49582f00f23e14
SHA12acd3a31229e48c4ca1561a485b33e4958b2013b
SHA2565c96e425c982bab0e4ae62bb25ec6e289d7e3c96702790f2280e6b0dcf3d6ed9
SHA5120086e93047425d25168e9cab60ff9ff4dc47afed3695fd5ed9bf718778f55ac50eac7b6bb21d136975f3a99f432dbb42e45b2ee4caf069ef865d06709f4e9560
-
Filesize
380B
MD5916f5fbdce0d85594858c1cfdab2e05d
SHA14cf1f229b4044193b31b883d5700645f28da89c5
SHA256845b356c60d133d5851c7a83e2a72759b60baa1f9616fc8954d1d6b73d1258ca
SHA512abfab77254621288536986d2089724439f942ecf06cf412001dba2c939da1160579978f517e8410bb19f121335dffad94de0de3791e16a1acc02bb48d08feae2
-
Filesize
171B
MD51307d5d9bc21dc7d0ec6e24af3edf8f9
SHA1df924bf7252e63cfe1af083f2500cf1376110d22
SHA25647660bf09424fd6d40293d3d6cc6e930077d97405b89f14b4a2af8f99578581b
SHA51247880cdf38964d30ffc56e1a1939182633279123b4778c1b13687ae50b486743d1aa513a34feb67e029b41b3f49b83da047da296b5aebf7a1b3cd1e61bfcd9f9
-
Filesize
211KB
MD5a4dcc0ca617c0a6f3f056de0278a664d
SHA11063895b71723bd58258d1ec51886cd2220a79ad
SHA2562d66338b3dfbd5e3bb31bb01ce43bd3b05aec9f09298440ad32f20003fd2a04e
SHA512d605364b0b78d7aa23219e6f4b33b1165fa18d606eb53cdc206c7729b7fc9d7bf185a10943809741ec31fbc7b3878198b0ac3f386699035a3b73a961fb6ae758
-
Filesize
4KB
MD54c64cb04ec14c47c90233bc8b785755b
SHA17f8fc594c3d3f2b1c8a3074c2e27f2a9dc251dc2
SHA25601fd44bdf04e46360d43597de3658a91e86d10db2068231b1288e9f4e3251dbd
SHA512db54fe19995ed24f5a1f89ddf96adaff5daed56003d155ad328ec698a6b2ea008aedb38669bd612d396f1073ef566ce174102aa6efe13bf9290a6e224adc5a4e
-
Filesize
4KB
MD5f18b47b61d635cfc43388e4694527f08
SHA17001e19b356bb107152b5f1a33bd274ab8ae2986
SHA25627bfa1c6425d43ed2bac0ac6691078897451e7d3458bbc40252e0dd05330e29d
SHA51292338cab9776102668ddf33b8ac8c6a0a65988344b93e4f57850b57f63d0ca6e053ec07197f1806c3cb9bb373f34fd6a8df0ce8ff5d3231765afca6b5928e516
-
Filesize
241B
MD5d3e7783ea936bc50c61faa4b4408e366
SHA1d0f7ed7e831f174fe8b63a4f3854ed9382467c28
SHA2562a2eaf7fe8ab4354dd3b0c94fbd67b342549bbb8794fc0a628b728a19920374d
SHA512b4ffaace05470c3ef18fc26650dafaa6febc810c1841a67aeed04f2de0502e13dbde2f1fbce3a51fc7ddeb44de9f539d7f9f60906fe6ff2a66d6ee7a9ee9a3c6
-
Filesize
475B
MD50dd2edb7b79a7eb70a4ecd4681edeaf2
SHA139bec8e6dc07058844a71ba09560a00010b46e7a
SHA256ec680db2b638c3bd63fc31bd654a497e56c8dd9ea1668a52d4c52ecef4bc8daa
SHA5122fd5b7a1683f65770eb83de5981e14519918b37b27a2c874e841d7ac7e1d366858ef8540c393cf8eb7b7a00a091d47ccc67f2ee0d7578c7411e3cd38467a597e
-
Filesize
164B
MD58c75a222692472bca5757d6c5012d8d6
SHA180e07716be2ab6bb8fadc73e12537b75fadb1aa9
SHA25632b4c3abce7e8ec2e8726fce4ee8d3fe39df8ca6ea5d9c76520341e7449cc184
SHA512b8b2735450466e5fd4ef08f2d694efce3c3faa6d99ad9c2873dc284b6c141f017c3612e8af296f75cff1ed52a5229e63250a4a1340a6740399d4ff4ec0facca1
-
Filesize
40KB
MD59d31b4ae96fce0399a93d277043678e5
SHA17ac7926167b99913cb87c456366cecdff6d36760
SHA2566f298d04c35b4d873407feb5ca38c5e69b3e2a3b6e001471fa88ab365dec4dc6
SHA5122263b5ccd9fb7c358c1106530b48040c88c12c5a8461c6cb553c52cedbec2668dc484d94e38b4850f1dbd5d4350cda03359609d34e73667d1ca819bfe8a6b30e
-
Filesize
40KB
MD5b27777f13396e99eb5ba49e529008893
SHA1f040d01eb5e23d7f0cd8345e702128661850b4ee
SHA256a3dd937734935908326e85e1a71e725b0e1ababc93f8d88cd4f010ce2c888da8
SHA5125a8fa6a65da4aa1603e29191e2fa01d63bcd28df652e3f6041c33a7bc09771bea3535254884a305da677f72b9eed47d0109d526e7c5feb18805aacb3ad3f7da2
-
Filesize
31KB
MD598f0cc8a6f59a1ddee480ae13d44e0f4
SHA180693a459da96a15d108bf3772e456888be0c7eb
SHA2569aac5449d9fc02199cd137dd0a5a77c4559cc35032f7ac9deeea9316e9758cdd
SHA512780cd4158d03e5b96386f6b23c1d9712442f20779e6ccc1f95b9cf77cb1561a3702ba39dbe7cc8cd704441482e0ce01f2099c1f09823ba06ffeb0a052fcc3619
-
Filesize
31KB
MD5067cf944b8164e322518ec9bd967059a
SHA11b8ca5a1c947dceab6944a1537509ac32f3cba1d
SHA256465deb6c5ba0da60109aff81259d83ff4ff31088242b0f5eade0e8cf1ad89ed1
SHA512a53df43cdde8377fd9aa68ee4f07279e9e04369fc1c22a9787e94a550c449c15baf1b4e473903baa4005e6be7ecb18299effc4780fb1ef8a892875d67479132c
-
Filesize
40KB
MD5f979ad56f85e041e71529b5d93bfc0b7
SHA1ee6b8d757c73ba23afc1a6c1c11c00c5c2cd2ac6
SHA256d7865ca01d4343210e3efe5ebfe6b2218fadd872ff7fc14a53d437eabf4b9b57
SHA512abd925c68b065adf1c3334e903abedef07f40ba254f891d840fbf0e19d0fa0fc68dd21ee60fea43c343d2519847879070b42f78f0bc6c6c3822fe8ef69944e7c
-
Filesize
40KB
MD5bc8d461d3c15a30556ea5bb29dddc36e
SHA1e64b3b0d1f7a8490d62590bcbb004e6a2bb36880
SHA256c284cbd2f84dc0ef1293e4ba4159de1ae8eb77b267d8dbae26be715f5fe60750
SHA512dd5d33d3a1466adee10f8182b248c853190b94c48ee2bcf74e6d4c92f62afc566c93ecc51593c2523431c40d84db98747232821f982a56bd393380b8c4295779
-
Filesize
34KB
MD575c4421067dd82b2a22a4ca5f612b46e
SHA139129aab5b7c33b525e5d2f3b88d2d597941b8ab
SHA256e8f6d2adb57e8204e095a77728a8f5c364c5b4ba89ea3537b1e28cdf06a643b7
SHA512c794d4985898680d3e0ee373339bb31dd6ba03aa5bcda9ef52139afaa56e113c98491945ed3779516a2f380437c0deb08bdf2d8891e1d2a612dd4b2aed063960
-
Filesize
34KB
MD50d7b48e7e6072294f88f72dd4aba77cf
SHA1b2f6ceefcb78ea154131b60ce56acbf751830415
SHA256a5ded265a1dffef185f1fbcf8b84cc94f0f7322abf75c2f80378f4780442377a
SHA5129736a99bebfb515715fa166e45c4789fdfa0e994e74a0a0534b99db1858cc16a4f6bab315d3b0dd738625f99eff1920ffe20ec35b1e69197beb10ce53d97ab9a
-
Filesize
33KB
MD5e123ae7427b876de386b2f0f17cd4b4b
SHA151071be85792f436b58976e07c5d9bedb86696a3
SHA25641edbad9f09a5c3bc029c5ca53666e1640f87b4a497593e22f927f8e4c3c1180
SHA512497915a2530ed8aeefa12a154bca7602db8156f63985f7b33ca61d8f6c758b567e7341edac7856040260bd3bf9abb336823bf3a83f43827dc52f438612a41bae
-
Filesize
35KB
MD552b94a21ec80b39aec38fcd6fcaed219
SHA10f8b20f6d9a046848704eda5a08366634472d9cf
SHA25613b1b1e491604c268ad052a86c118bc1dcca9baec14f09484cc000c4812df92e
SHA5124422f1faa2bd2586c7d031364121ae88989c33bf65e315405ea7e8622a3d08e413276d237a4e82b54d5163f07b46bb387968cf6a4da5c895cc4c7fd0dfef8318
-
Filesize
34KB
MD5638c7836afb43ba1908925888c39aeb1
SHA17e8ed39c012552baa0aceffbd7a572dec9a5ca55
SHA2567b9290e62eb008e8ca252b963724e04d6fb3c688c8381c21cdf9d166a4e6ef4b
SHA5124e2e707b4cacf2d697bd5eedd13df4692040bbe5922d8709db77528bf4304abdc7b517ff16016bc7c4d235394c5e5987d3ffce5a0b58ff06a83f0e5cb0317123
-
Filesize
40KB
MD5b06001d54fd53edc6829de5c708ca074
SHA12c6c332cf6f6b60ca149a6de581aeba9d368e60d
SHA25634cc0ca5139b1d848d015f9eb5647f685bbcd636a004906cb0431f1bf8925ca8
SHA5125ced3c3d2a5126b35779970019b995c7dec864de8aa513be250a51891d6e12aeb2ed76fdc1ea9a8a7e24d11a12f29739bf45d4693ec403041f3f809b07680aa8
-
Filesize
40KB
MD5bdee6f886b8f48042a4a81a9eb76364a
SHA1f605d7dff237f2647c682d3a079c736049db1fc0
SHA25672df74b3038c831823b39001bf86f2cc23f08b53d4dc13ceb7631a3898b788d3
SHA512ced426ace24b9fa772a4c4f1951cf6fdc56ad97bef90a2ce05a015b9034936e7bde08a2aa223384dba40ffe8287cae8700c510b06b868ac7ea4c2ea43780b9a6
-
Filesize
34KB
MD5753f07b233bd618850eaa16356308d76
SHA19baaed916714a5f60d1ba908564688529cc9accb
SHA2562030733a2e4969892ff83e8f7da34e06b08ca56c8e36ff31474eb2bfe722c78f
SHA512d966702893569a02d5b2110f63a079e48d6ce5ba3ec29226c970725fa773bcf609eea2d7c582f434e9efdea587b5cd2f88689b129c9db3777977e18ae6329b60
-
Filesize
34KB
MD56c1db2d7b271c83577165fe633ee01ce
SHA1fe809e5db6e173643092b1ac7458208c1e94016b
SHA2567eadf26d5f064bf0031e2bcc26320703236307372bac7a1506d4e5e5cbf8f413
SHA512ef572d4f40a2834d476fd19e279b698e77bb5c04f60493f02245999ee903bcaf178e8123260a64ac55ce50938cf56287d0044796cf1ddc95a3597d8717434429
-
Filesize
40KB
MD5362db9add3b5e7ee0b9373003dbf3598
SHA1ce3c60443866115bc952ebb19d08d32f020a4ff7
SHA2563393eac03d20a48140c733800a2580a0ad7aae863298eceaf92a68d8e481f89a
SHA512a822c6d3f54b47d9bbc196317f5b58f70bb2882ef22fd87a01847bdffd318f331c60f04edbe180644c8df672e84b0d59ba6f707dde4d62f7e62825f0e5a26f74
-
Filesize
40KB
MD5c65084dc9302c7f963b137c06d57cc5a
SHA1defcd34e60e49d4db622cb29431b85dcd09ca264
SHA25686414bf25369dab7e2df514cd6ccee861a6d93dec70b1a2353881410a977266d
SHA512639b7c8e294b13ef806d3234ae2c9fbb373e73b295f356a8b9de1d50fe78a2ab02edcf5cf9cd4d5b0f4611c9ec8e0e35282cde3a40fababb323f4ef1406696b5
-
Filesize
40KB
MD52ec7e07123cf27ade5c216838f2bfe94
SHA1f96631097d4d599cf3f9a9460c9ff8621757b18a
SHA256d2693de84389abfdd31ac5e41d0df783962e2c6d81e4dfe25e2838c8a5b2e031
SHA51277ff78d3be464d0e0725ca4c201cefddb38d4c6fe059f39a9e410e1c033bd92349f9980a1632eaacefc338e4ec9c58a3d3036e55878284fb603b928ff98b74c2
-
Filesize
33KB
MD506094c88b8adc60b3484441b2f1a7664
SHA1e1888acdd65bcb0394b854743cf3117185accfda
SHA256683fbe1ea012975ad7e83365d54887b9e1ffbaa22868a3633bc4ebbfd31637d5
SHA512a135f6cd9c468060eff16a6a8997ec2be07412d53c1a80a37dad3a0cd66908fcfe8e1d5551a79935ea5d2e7d948fab55d930066fe8954a055f61779581cd95db
-
Filesize
40KB
MD5bf304c4058b7241e7dd08ba810e38235
SHA166b6417bd2a3a1a25954d050a423e570379e7bd9
SHA256469343087371c7a14014723ad62fc8b6a0955cc68492c412435459ba7c11ce89
SHA512477ee300a5da58a3a68cb2a2aab5f332b8b712e14c2fd1c4466d41ab2ee1d1526b8d06d91046c3a0a2d3d18029c33dfd6f8ac5a7f35c2e929a083a2c985a55b3
-
Filesize
32KB
MD5126fc548f21f30b8766bad19e5edc825
SHA1626b39c4646a2faa20367504b4f050d4ddf2c486
SHA2565d0187d183049b70f5dfe4b6a39bfd09d0b61e223361dcb51e993711bb1e363c
SHA512e8a3acaf1e525a36f016aa54e0f9a24521b18a08e42f074f39e07e829402bc74b265bb3bed3f3ed93918b80fa84b12e70998eb1087541fd2a8f1148e5892ee2f
-
Filesize
40KB
MD530b9d343fb2e6adc5632a67dcd8b1452
SHA132b7f4f3f8c7e776a474806dab0f33fe7a049c6b
SHA2560488267f616e200062bcae003af933c3ed069eed9df89bf7fe783e22a490dbda
SHA512480fb76572314f2354fc27c0d47cb35a24151cd652fa47c657913c62062d6ba9a2c76f2d7c556cc6d7e2e42b0c1772987ddc3a61ac6bec78c5e57f9d870a6794
-
Filesize
40KB
MD527987a4e16eda47e5e106a1df6ea9b93
SHA1ccace4a69fc8a7afd8082bbd4d1fe8c6b0416da9
SHA256f467e8eeeac06894de0953d766d8f21660e9b6543741eac4d1cb879635f63e05
SHA512ebcb275508d25d9cc004a91c8704657d14bcbad11251eb9bfa8765f56e9baceef8e0c82b15a95d34b35f96ad76f2ce156dc19582e2042f9d4787d166cb220c78
-
Filesize
33KB
MD5eb0b9b4be5d00a80ba12956c19d32579
SHA10b080cdad0b39b06362e92ce5f855c7fb8d7c1d1
SHA256e48dbe0329defbd5c4887010d5dd18cbd0342228e39d0fcb34728637c631ff6d
SHA512c0188d834b2dfb3c433e2fef1e06c6739e97f83c33b657e9a2ee335c135cd9155493213428fedb24aa62e3700bc4a9e53e06dd367944f8eaedcbac11765300dd
-
Filesize
40KB
MD57522699b5172a863d5963f674a6c8ebc
SHA1164d206a99df0f3a43a005a516ed748fb4f2b93d
SHA25635b561a74a8fcf6cdedf783377a25bb69697ea07990289f69e07cfd31d4328f0
SHA512b324bf311951cc0d6dd80ffc86cf76996757ca4157d8f304e261da5b04d0c1069a26617ea577154d40a88a7f07ecbbb04642b1edcf5ac5a431c280fef06fda8a
-
Filesize
33KB
MD537d0afadd7814280735610040bc42311
SHA1e640fe5732be97bfafa1855a33c5bc4a8f4a7ae1
SHA256efb4c6429b5def9003c0cf9512da344a0ba5138e118eec7bf11c7c1c4f94e28c
SHA512e5728b29604e7736a072da1c007f11bb876c370e6d5df3258ef803c921587c68073bef6da8e8146fa1f7f3f25501d92bb3f8a78cd7c7bfe18e3fea694b2edfb9
-
Filesize
40KB
MD511322364b30354ff04d094cc02fd8c4f
SHA10474743b823028bef70bf956e29d1396a649d6b1
SHA25696e3164093f284b1dff376ec7e2a9e7066b16f0541d9f69cf7109e7f1dd71a36
SHA5122d5325d067304ebb8690191e1960964c51c461e1dc0f6957ffaea253321faf32f27656dd6179344a51b1e8ca4616311624539dcf8fcebaf75bebaa7a12b70846
-
Filesize
34KB
MD53011df5fd98852522765ccdc9ca13152
SHA14263ae35ddffc0bbeaf5eab0b9fb5656d75d1404
SHA2567d163ee76da3be8a93c31c0fb1c99772943892258b36926ba599a2dd41b440ce
SHA5127cc7bef2358fd75e2407bdbd91c6aa890d58adc910425f0210a6d88634c4555c10e15f7a17688db328a9158542246e8f5c5ea9ce50832c2eebc7bd3dcb52ebe5
-
Filesize
34KB
MD523ea7f5b4ac09256784dfdc4043fa1ea
SHA1c66f5e0dc7a2b10adec707c2a16c7e60f21d58c2
SHA256336df275d45eb79c57e1902101229cea07643d95ed0166dee76d9a07cae0a94c
SHA5129e510918f034b417c082a251f558375c886520b2236d5a3146694334a2f03a3011586fb8f3683ac0546b1bfa5617548e597aa7d931e41e036da20affe629ff7a
-
Filesize
40KB
MD5739bf899c6f1aae5ff2e85c486b97d9c
SHA15f1f90592e49aed95d3f3b6f40f15dbe7ee0facd
SHA25694c3e7dfd6f892b3120de9c858f4db3540617d5930efcf97c97ddbb39839791d
SHA512b693d65acd3e7c381861f8698674d505c788a8db9129a732e693993c7c5195120746ff9035fd2daf121d446778d6cb54e11929b5414b33b7d8fca0aa46d9e20e
-
Filesize
33KB
MD5e76a22e4e8ac7d928cde3951d5461bac
SHA111762f45e82c9d8bcb1cd8eda3550897e0ef7b20
SHA256e4c29a3066845597f8ab5b8fb51a0bb5e6cff0c125ccfd8ac197ade6fb759816
SHA5129498c8afb0435c2e83aa5557f57da70fab2ac4eb6900066549c44cf73588111dbc1c51e4247f9c147860cdccb5236466c7a385668a30e2582941186c11448c74
-
Filesize
40KB
MD539834321e2aae3045b823f39f3beee8d
SHA166cdad281bed9d90efcb255a1f88840008b3a140
SHA2562a88d4083bb82fa97ff652b89d1770a19aef27e962ba584d627cf4359fcf9e3c
SHA51230c433685a5ece783d02e01115a372059895172fa8069df818ffedc875132317090d066b606cf185ad8ad61e3ee308984d61d5be73ef487ad96a3733e208b883
-
Filesize
283KB
MD5323800651ae248f905b6c4c31e13aa57
SHA1856fc8574ed0a84a6157a94030e30ef32816f287
SHA25643f4bcb2fb16830939e23108dc8e3e6c5ad79e3e808ba473988788d2a72a5e06
SHA512cf8a20045dde8198b154d8a44005ab81f9e118dad65961a2c1ad05d22a24ee614c630f5a87a2480e7b7a9ddb64826df86b13fe89c2834a07704596447a7b3534
-
Filesize
825KB
MD57eac063ef5ed9b14c78671dcac9b49e0
SHA12b9b7d934466e5bdb1edc5cfcadca3fead2e862f
SHA2562e200f915fadd2e072f525d3750d36c7f23ea0ff076bb5a25c0d58f68c9ce803
SHA512f8a9addd484a2982db1df90ea7e6d3b75c3139f3aa41b7acce9cecd4135380c69894b5f42977f809e082df4efdd4ae9077e1cc1b33b47eaa9e9096e1b7b9a44d
-
Filesize
988KB
MD52939dd0113a8ab4dd00bf80b326c8026
SHA1235033f01c77ddd5a6c52271d4d10a0bdd088116
SHA25606446b774fe39429997105b57a2802262d59999c8ce9de9a980217fa0765739f
SHA512133311621615ff079a9a26a001299666f7e174320c319e437b42bbd01e348399262196c4c7c367b52d29004287490ffa63eb78fba3581c00c0f1d352cf086e7e
-
Filesize
77KB
MD5fa9b7c264a88404aee72c4bfcc5f6572
SHA1e621ad0a42cd4e264ac37d3b2f480ec9341af3f3
SHA25603f2f50aaec0697a8e59b45da692a13c45b63e36f3143a0a2a30663d8384cba5
SHA512f461ecbfc82f1158ae8a386960c20f3272cd2e54b75dca1094a85bdf1f2717df9788c6c5dc68562c3cd6a7411b8a7cf50ff7e9027de381cfc09ca01d8cf0a4d3
-
Filesize
3KB
MD5629e11048e28b76bd6f1c04ae718985f
SHA1665e050aeb09bc3e9dc04e045ffa59ecc5fad072
SHA2563ee0e0e52926e70ea8042bdf082a25e71406daa7fd290f646c98420e7c0d5d1c
SHA512579c2857e5d1ea26c4e4991dc337741d76f73d314bb619190ac07cfd47b37963ca6bade84db5ea9d590d48b830fe5bb6101d8e143d9be7f8242a20aa636b656e
-
Filesize
626KB
MD5d396985225d85caa7d743d67c7da6316
SHA1915d5829ed02171684c2a9e8b3b57f7a35bc1e2c
SHA256be2ef4f6d540d0ac5fddd556dcb6bfaf6cb6288679e4d64882d625ff35f173aa
SHA512d7b0df2865bf491c9caf34cbabefb7b7f04b35b85276a59fef0499d02b09651d8f6d0db9e87df4a9a1417f07784a8e5625e9805bc434b87d64e442ab98e24075
-
Filesize
21.0MB
MD59788de7e14a00847f2515fc4a8fdc0a6
SHA1185ba55f57a9e239909c945f189c393dac0b1d84
SHA25605f23059cfd4670c4c1672416ca0847bab4608076554db17c8c298127e78f2d8
SHA5125ac95836fb739c063d3fc3cd07d240ebed2bb146e45615f0fef95dc80895eb4c93db075fa2ac3587e6ab2379c7490a3acb3bb5d28bee78f68db9871a22e786ae
-
Filesize
389KB
MD531bb70130d0ff57af315d0a397ba0fbc
SHA168b891c4dd4d92b592b22694d6ce451bb356bc70
SHA25690b53131bafd49890997b1e069a0df759cdc4c47fa79edf7ad11ebf70e1cd02a
SHA512c68a9cc87cf16ebe42493623a5ad44169712d9517008e01d901bae722053a08969605271acdfe686283380a4e2cd7ead989cba47c342770d5ab2ed9b532587f8
-
Filesize
180KB
MD556ce9c075ec13cf3fdc23dd554a8ea25
SHA1ed9edf0c77c8e3d4ef6675c360aa6cc625a0d70c
SHA2561d480d651414304bddd0928b1c1563b4fb7f89b1c6ac30650c884150de0ec540
SHA512125a5d87ef3f4edfd0bd21beb8f616343a42a5b8b3543370fa5306e015019acd4c40216cac7148306956497144c84d1f12d6d91c3a08755938f7df30634d4d41
-
Filesize
85KB
MD59a53905892d9c9f3bf9d295c8b32e446
SHA12c5c56ff86fb1e827b2e0d479c529baea13eb561
SHA256d58e3ff10fd96a22a8e6d2fd76146a282cc45ccfaf2301257e76e7c2771cbd41
SHA5122dde975e15f95aa9310820cae009f2b04e26b7bafebb42d5822e3917017e4a37e17b0a71825f8f79f075abc1507d7d4d9202550fdd7a53ab54ac0fde4349fe2f
-
C:\ProgramData\CyberLink\CBE\D8D760AC-ACA2-493e-9623-61E9D47DE89C\setup.exe_v2\999b5d50-7053-46f0-8ea3-72ec9d0d267b.json
Filesize997B
MD5f690f36774f44506a63c5aca0bf56117
SHA1a83f7e29325e6c2470c895fb1092644a39f42eb9
SHA25606b26b300c8d5a9bdcb6d8e1d37335b153d5a4302e36e784207e138afd1e1a65
SHA51271f33723507b6f6bf1826330fa1855160339c42168e09d7e5a06b604f916c131de8544924c96279c6800569eba4a6e7b83361cd628a6fc4a794ab4e03385ca19
-
Filesize
7B
MD5be9d6efbd8632e482c64618f00a701fa
SHA1cc7c0702a34305282ba77d4eb88db1fa0bbed850
SHA256d94fd0c7e43df0a03014a44d79653c0845adb29e6222ca47718c46af90847b84
SHA512c59eee3a838ec35f447c28a701289f3f35ea5ec08d0c38df54482b39a2219598074d49fc162b1ef46d9e20c336221f53bc86de7163183193001b466ff36dd5c8
-
Filesize
174B
MD57118d9fc663af0b348dbaf18d795e536
SHA1a4ad879d2c3eceb818b0eef60edda324de323ded
SHA25606e57e9c8c11592b9a5f4fca67ea7ae7cca057e15597e3201e29710f63a00872
SHA5120e79238f78393634d8759410173ca5eccb45e5c627abe7abb8b864f5330b70dec0b4679a2fb624dc1df8e33d838400dd1bd168828d44667b217d9d3ff00bcd3b
-
Filesize
35KB
MD559ec4c3301f73986bb42aa8606e1a759
SHA1a37a0b4f81c190deae2750b1cdca230c7ebbd5d5
SHA25610256048d1dc54c2a12188da349db45010a2d62c1ab224e0364317f0f5564423
SHA5122a8f9040463ba96532df973a02fddb51816e8b911dbf86243e359669a04691c06ac7cbb13405f3ee84c207121aedc4a1d185c6fc086cf8be5279c9b7a2c8ab15
-
Filesize
35KB
MD570c8e0abc02e312f5b4bf3d47b7e092b
SHA18a4d1e219e47de62de338a8947c97438c2789fae
SHA256b0f8095028c75219d375f4d27cf5e99b65185b3ae4ac17d01890f16aecc90ad9
SHA512ca7990c7cb593eae5cd99a0be9865145c0408c8de97471dc13437519e179b22c57c57d1cd8126aa8cb0edc660edbb5dee46bc4e999a97a0ca7e17981e306b82e
-
Filesize
32KB
MD5b35e20b5c282cbe55b0214ba4fd94f6e
SHA1b94c661606750d3db463ad17b3a74791018611ef
SHA256304094fce5fda9d8750238054d5ee2ec411643bfc29735ee529759d4475ccc22
SHA512ba6f20b45e32970db0384ed0d895028efc4abbc434925240b0344b8e19e8547123333d28e694198adbb67f2ae9f4969b04b67ad58acedc8b3bbe9f32748c1f5a
-
Filesize
210B
MD5b777fefafcafea680cc6dde12d4d56fe
SHA10d733702f85d3b0c9ea4849ef1462503f505d13d
SHA25639de116af1b4ab1a041b4661d09b8c09776f128e2b7bd36d4e5275c30982ef2f
SHA51238ce59c68066bba17e355487131720ccf22f04bcb55e47f3c5bf7a7861dad32c3416303cc9bdf8b4c87f62382fee6da5e2315c71c82c5c8e3bd5d117cede65f7
-
Filesize
244B
MD58c7f10dc76fe64c274cf904de7b26876
SHA15ac875e24b5220489172d8c4b73630688bc2b140
SHA25644e48a4d96644b33bd65ba47f52c99892e83992fa8faf82e648aa20274e3e2ec
SHA5126deaba419e53019d0fe943d8d43d7cbd3ab53e156e4cdd53c9ef4674d994e857d6dbf25280fca08474d63734a8568f8e55e55f07c085746022d668aa7805d772
-
Filesize
210B
MD512b536d10e8bd19a2388c92604b38aaa
SHA1c8c25087282b69bc5607b39b5a73815acdb27342
SHA2563687d6b24abd4c84b652e1632721d8bbebb1d6bb3bc47517fc5df9d9178c2e4d
SHA512fec5bafa4df6209d38e8ae4be6545e5a710e1772d529a9fdcbdc8b1af7e012268dee2044f8ac088a247852417a24f2abc80f0a6424b206110dc3c416f6756f4b
-
Filesize
229B
MD540bc50604d4701eddc4c82299d3696b2
SHA12c49ffae06ecae754a90292281714da0a7be323a
SHA256a04d905de90f1adec3bc618c5700da4c823f789da01718e4cc3369f65c50eaf6
SHA51229e1f84ccce62c6d0b0c9bfd1ed189e11197dafd849ee9ecff80be4689ef2233654d6f392b221c8de799b38f3b2f1837075dfbf0b5d4d5d32aba0d1404fe79c8
-
Filesize
210B
MD5cc3bd99680dafa18e31b8dc9d220f8e5
SHA12e309d07a2b7e1f88af4a09ea57242787d41e26f
SHA2561cc586a13d396b804b9e4f7db41c93c17a871b2a3bff00bfe67d7d46996dc231
SHA5123aa7b3aa08a416fd7d3d8ecae71863b2b5361d989c13bd538ffea4ae8da86696a569d1348dc025d722f86c0f88f135d2a0368f01f0f174764a3c3820da8d18b6
-
Filesize
244B
MD546c5cbbe7f5f2b19b2a2aa1006d44526
SHA1f0fcc39755db8ed267e98c3801de9fe0978231f3
SHA2560d6f1f274d4db64a0dccffa400cdd0309b28f92c037d477aa1ac06c432aeef82
SHA51254ec0b93702816f2f5d3a63d26068761741df71f16d4e24f666b1f66f725ea7ece71776c63e7c0d3a3189d39c7a3b799116f7d9fdea4c186ab3ca938fbaad624
-
Filesize
161B
MD502af8754762945a0f1ef8036aaccc829
SHA1fd405b7773e16cba9db32a69668f99844c4977cc
SHA2565ba2bc6d997f1f0cf1b444527e560eb0f51bd4922187caaa2b0c70024a224b29
SHA51278ca8bfa4385e6d005e123fd4ef0ba2971db607f190c9058febff04d183fdcb8fa94bb2368d8ecc3fe2796f144718c7a6f4b6429386b9bd3e26a532baa67912d
-
Filesize
190B
MD5a1a6068fc756a2b7bb01f94c196130e5
SHA1f300ee63cc1b7987cc53b0cce48de3fd1ef11853
SHA25639e6efb5db9b16a5797a4a1251c97d9075e54af6f3f8f1f39882dadaedaaa6e9
SHA512664d6f93a07dd0fb39663932e830d9b8a9b5beb533b7f04a59dd9e05c12c8750dfa3f8adf2a5698837ce2993a558aec02e4aa036d1e38cfd713170b2618b5ad8
-
Filesize
220B
MD5f662d83b061b1eee9c94b7b1c7fea345
SHA158c30ee2fe0c58a018de9fbd7b9f44a452f0f3b1
SHA256da3f956d86e0a31550b664a5db1cd220db34455c3cd3f4e94acec5ac6eff7e43
SHA512c4be98a3981c4cfe48df41de5caf208d4d821b16f0d67b1c6acb3623450d6da4068e929894fbc4800ebde968221d9467e266f21bbdaef73b9eecc371955e9dec
-
Filesize
350B
MD5330a6799d0daad8cc40dea141cb3e2a7
SHA19b84c51404f72655ed8435a1305dddb7093293b7
SHA256a602471348b0cbd963c298ffc518eb004a89320d4c0b4fd282333017cd1516b1
SHA51295c8c028f4d406584e200936731075444dec7ae5aef0d2154522ff40bd5b7d7b9cab11e6931ce4c67f5b61b553666499ae3792e9c155ee3ff8023b9ecd6da4d7
-
Filesize
299B
MD59be3b6f554f5c19f4eef3f528b009351
SHA1c10097facfe20e1925d9c1f57f395f6575eb0f07
SHA25611d8bf4897d9280fd49a563b07718319c34aa53f3b5e9f0b8ada46fdd72f6f1f
SHA5125e2f676a4dc0d8423250efb6228b872f8b54132c1f080cf70143b63da3b9db61a68bb9bff04b3bf3a87da8ee4f85ba416cae138241ec8ac104e744ed90000939
-
Filesize
704B
MD537fe0ac07307e5390d1cc9ea98b3293a
SHA1d5e7c6c0f8701ca5f9978376c5007ea8a8eef050
SHA256a2ec7b29ddff70292f4375c293069b77650d325c834c079fbb3142819f20ef37
SHA51257a62f104ae199a793d7d6fbc819ff115db579ad796809b0b548ade19a6e8ecf79449cb3e2f49a3ea116af33b365ef1afe62d35e32e28a6cc7db0c888d23073a
-
Filesize
888KB
MD52b180f534ba45bcd9eeb0a5a4adf328a
SHA10b1e630c53b50a8960d7c81c0869aa39ba9b07d2
SHA2569e92b0cee11594265b48d452e9eee20c6d0a1056180b92fe2fb9e6bd46e533a4
SHA512a33327407373228dfd7b9f84975dad1ee02711817bad6ca8d8f66a600d97a707d171a31d4e79bdbb3f5d19ab3ac5ee6c4d831126cae390c58dc7ff291a89dcf2
-
Filesize
86B
MD5bf7e4c3b3d522dc5a19a587664771681
SHA1453424dcf74f4453344fa208e53925949ed72191
SHA256356605608d5e270fcd9cdd74c3cf12571b556a6ef445e170248f093c9c248b13
SHA51295e4e71b273bcb89e620ad4aff1ae5a3ca863a44e90b722d35c4f4e593dd99c091de4364c66913ec356778cb45a601fa2334fd1d64742a214b352ede94b96c9c
-
Filesize
4KB
MD50b1e63d6a343ebedd1c2f4e9d2156785
SHA1a3342389fd5642b53f0fc1b1578954597c3e9839
SHA256fa7c6362719bb095c56a3aec352983e23ebd8936e1af429ca6fcf2646c862a36
SHA512a478d0843d52be1fb08a055fc7aa5ea6e003d63e77f2daa7da4beabc42bb3ca334141009e747c1bac0941319ae7a9f7fc2fdba01790b375fd32517338ca70f0b
-
Filesize
98KB
MD589bc1be8053c77619bf263223d34bcba
SHA121beba86fef72f47f986ab6bdf9d8dcbe98b691d
SHA25623cd9da301a19672dc6fa5095a25b6787477f4b2381fb7c4ba44406bb90bfd15
SHA512b79de0acca61574b51aa15a53813e40d11d613352c332763fee662c8bf009ef5a3d7a95907d2f3f9524f93fb1097c571ceb394bc42b231a1882bc4795469b53f
-
Filesize
3KB
MD5b0c447c0996a3c621864049aa66d9b9c
SHA169f7d46f555fa6d9359a741e15460c8f25f21d34
SHA256176e86cd670989a46662216e6b778d73529e65739175e5e37df70989d85c2a63
SHA512e3ed72f8a8cde06985ada4dcc64c01e03ac069b86ced295c489e3a037642df7087546e00033d492c0e718ddceb67a3d3d6660f0f3b932f07403b524dfa23cd34
-
Filesize
5KB
MD5bf63e7929c74ab65191180cb49e8a8f8
SHA15e5043c1e6b1f9950f9aecd382a45d5448f33022
SHA256401fdda7491acc1450b74afc43fa507cc76f883f075b930df8559f29333bfd1d
SHA512a32f9ca193ba60bcedc52d06299aa837e171b2b9d0f23e67b7bba6bfaaca72fdfa80eb7813530e9b4dd7fcdcb6998cfa22892ddeb210ae5223fcac46cea8eadc
-
Filesize
4B
MD5cb492b7df9b5c170d7c87527940eff3b
SHA166928e6cbb59c3a3bce606959ef4a865fe04e642
SHA256dba5166ad9db9ba648c1032ebbd34dcd0d085b50023b839ef5c68ca1db93a563
SHA512ce677db6ae33c5496874a2902d30d361f6cf12576e96bd8a9f6626a0ca29f0b4f97e403e54711d24ebf34d4e183235a8f9951345d32a20f2dad476d911ee7e06
-
Filesize
1KB
MD5bbbbd68433458d9238aa26230e3adfd1
SHA1a3cf431ad7a161c445edd47c448aa52462ef0778
SHA2569f46f9766ad6b59426b4b29c4a6c3a30e5e556dc54defe5583aa39bc32d79f82
SHA512ba357f938029d9493ab086b2a739260c5bcfd5628c1f8154b9cf17807cb0b13640a4891028b3dbd2229382bf4dbd26eea8c6bd7968fe80aeeb9be5768691223a
-
Filesize
615B
MD57fdbd45513cadf71eb90fe9446bca478
SHA14e52991186cc570f572585cd17a5546faad5573c
SHA2565f25f072c3b11110db68678c5ee06ce506c3e00d72e752f4d26b98208a033378
SHA5126e178fc3086cbd0f671f6dd11590163373e121b2424123675317464bb8a0fd38ceedcd686c5bbdf08ac80a1bf4b8e507831d34bb085916b2db78be52b12f90d3
-
Filesize
1.2MB
MD5da425c228f084a8016e0d544c568a441
SHA15fc1100768dc8b3d22e9681c67bd92df55fc6351
SHA256e284e224db99a6603f358b5e73e774f80e7cdb7a3e8dcb26ecc3a8662b19d1eb
SHA51252cd004ddf5b369964ee4f380e8fb830cb3f3b4903ac407e92fbcb8f6ac8b947d625b31b670533fa46561d6055ca6bc19e8bd0b39b444d24c129a9c50b973fbd
-
Filesize
413KB
MD51f4315e7750a0fe96050fefc42eedc7d
SHA11504b661db7b1876afe1b74f0e84cdfe0b046fd4
SHA2560bba424ce8ae4a607ab4a8b2c508fb4fc1998478e0f00917da43642af8997841
SHA5125109c85cd44260dd1dad516aa7749767a88f1b6dbc9c1052d5986bdc6075d52e828e7c291fd7ef7215e7723cf3a942096faceac2062723f132e1d9015ce49493
-
Filesize
536B
MD5649aa442cf25dd9d7982d220a3de9869
SHA1b8e6b314e929b0ebb0a0e13af863169491feb3c8
SHA25664af63535e6b1f20ba9f67231d41530b4bc00f3074840546ebbb71207481f587
SHA5120e59f5ad2dec03e536973b28de411d77e06f744789966486f9870cd6f7efb44fbb6afa745655ae362ef6c9af6f056539edd9779522436eb4702fe0c7f72448b5
-
Filesize
126.6MB
MD523cf8272acbf64c07a8b2c044a843cbb
SHA1db48e1af91448f9396c631ce902b27dff7445fe1
SHA256f7b854c246d1261c6be22cc07d0bf9f9d4852321009a5faf09df7f2ea0a37f17
SHA5125eac6af100179110e4d0aca93186d8f18ce935e214b5e5c1beec1856e4445884e0810189debf075be94e9e739d8eccef6a0e0312e036792e011ba2e01e0a56f5
-
Filesize
74KB
MD5ca1dfc4c929bff3482a2231d642bcb86
SHA1164b81976e094a53e7e17adc8a98ff6d3d30baee
SHA256a2933d3a086411a7d6732f2861f65f1c352579c7b4f084fae3bf783f399a9cef
SHA5125f81fc7185684ab62135ba232b2eb09d50a5a46308e0c2d83d35190940f74b800897d6b5b0bac3210c5f9244cd4fc5eaaf3c59472c0d255b9606a4190ececfe3
-
Filesize
704B
MD5163048b32197d3c5711c525530e0546a
SHA1460daf6a395240f69dfaa272e16f1a1dc45019b1
SHA256674558e48d565c3d317f96f58e47cb2469c7dd5afc38644f42a664cf72d0ed07
SHA512a6bc583d6d521f11c8569c6d8111f1bdd505207e10b45afd19a5889a51fbc218171397795d102cc58e61376d080c5095ce13e1910aba3de4ef2868417f27d4d0
-
Filesize
254B
MD58dc39e8968de9eb42efbe6c563bba962
SHA1076fa003cbf4f3238a624b7f2367c1ab2e5ccb37
SHA256549c455461adb540102abdb286696fd7c1a2f4dc50e58f00e5df771b33f27f57
SHA512e4a71e332abd194c4770a6aa969eccb85069bb7679651c2581df329cd3c67faf0030965c666a94f54f45b3ee4dc5fdec9d8e1e493c1bbc8e8641b8d5f2f55c5f
-
Filesize
257KB
MD5a997059f6f633b8e8176a892f54c4775
SHA1ac622844514b077486a889740bcfee974f7c2a46
SHA2566f865fcb325d166daa2f9ae6da92a93e1816896dce280db99d8b542f2aead461
SHA512ecac0dcdc2cfa017dd6d45bad721cb8b2cdd776b7e6375732cf85260af2ce85e2408f81fe68d939231d3946832640e973aaf2f2c04f1357d68172fecce94a1ad
-
Filesize
906KB
MD582e2269fad4d6d4b1bc2f043bd86b2b2
SHA1158a5c3af624baadd2b330718eb24408c3e40897
SHA256c8d5bd633b634808066066feea07d9b34d0edd629a8eb7345a48c83a51587d5a
SHA512c60c6d0a9947dc1d586d2e31d0225f797d3a97375017544862dfb4c01eb71349b2001d178a83eff112f30ba4aeb5f5735440ea14a24a8491e793cfda766aff44
-
Filesize
219B
MD5fa17539815cf2d8ead25b6d1a101f0da
SHA15cfae601b124470e911c68a195b7cad35590d97d
SHA256b1ca14acee4cc64c25cc0c3621857c9a58bffb7dcd60d17d0a2e72861882ee6e
SHA512263fc4a308ab02b1d49fc90f3b66ae7427fa36b794c4b402f2b38754dc101c9a1d94823711e2e528e3e45ade7df8be63614da79d49a1c0b7036abbd23c69ee0b
-
Filesize
176B
MD507bab4d1a21cdf9e6db66d169b519919
SHA166eeabb55a64eb83766745793b197103290aa9c7
SHA256dab047516f0685a64844b1c7ec91317b23cabe271a9b2588b4c4a24c9543b91e
SHA512f708c373e5c4fa5431255df2d52d1dfb2aa22ffaddcb39bf81f04c7e7b6f7e65177a703c67f74f07163d606ff64b9b9efe295e7527f1ddc3daeb1659e0a25c23
-
Filesize
19KB
MD52f9535926ec863ba998efdee95a0cd8f
SHA1bcaf9596a6051594cf8c129671433ea048b539ff
SHA256f19884fcc3cf2dc2bc07d43290c3ea0eed0174f064235c8e7cb5e0375861d6b0
SHA51267697b52cc639dee3ab158921a8b11ba5b00993e843960b5c4ecbc1d08c8a61056215db375d7311053c153d4b48b058d2dc4a0c4d70fd0612788677866d9ed01
-
Filesize
1KB
MD57278bb43f65b465d80405fd574798b4e
SHA1fe279c24ae83052b0b7ee5432f68daf0a512c36b
SHA25688ccfbaae8e6638dcb1caa001054e813553fe037864cabcefe93d23e5b492e06
SHA51218936edb70bf34d0ee3b712608536397e8701b875c707132ffb73032d7cf36a995f21cda7c23d2d188d872c7d3867d4093e495139ea4280af7940fd1e795566a
-
Filesize
118KB
MD5c689939ed853068853fb2fc7ed1f7c32
SHA1e7ecad94a93942b6b99ae17980a66010dc442bcd
SHA2567d463d04bb075c4aca335a37b1668a3ee17b2649d7c45aabd1af1d1310404d3c
SHA512c48fbfeda1a0738a96387bcd21a93c17dcbed2f4edb1353ffcafee112db72cb2410e1d4f0808b4a5dd71b8f82c8ee89f7ceb8fdd1c9dbd6f8e4ab2e6903066eb
-
Filesize
86B
MD593ed554d8fc485fb99234593cf50720c
SHA16c46592f53af6f37fa25bfaa380feb6074e01876
SHA256d2ed041d662a805b9d4f080043842963d45fb489020a90cac014cf219cea8943
SHA512b1a834d05f24888907fa2058bac752dd973d75c1a094e56596b0085b45dbe846a3694a9aa8fda7c5ac28bf929fe3c96c0f51199f705914f944c1736c2e02c9c9
-
Filesize
908KB
MD5775a7a8df4f0c3cc21a589b823ff390d
SHA14c6e190b48c4a333ba497216b58eb334a10be933
SHA256188a321d7465e24e9d8a4f07f67eef1131c0f663399488f4e083dcdcd7230c39
SHA51223952f122665caa7afd4fd37847bbea53938ab7ddd25bf49b58e8219e09c93834e6408514afa10d379f1e0640fe49cbe53c066424975c538b0438e2e9c0cd009
-
Filesize
336B
MD585610ebb57d5ed947a0f9a568616e36a
SHA15e9bf858f5e2393d49b4eec92201b5a9a8976fb8
SHA256d96b3a1e3f9eff6a28011ea6117af2408b20711a78f69e8ea7fc4b10a4b373a0
SHA512e00d14bd19c00bea85e80a76362e2300b024ece9cd8f9dd437b572c950ff5a3613013f567e40cd52b1d0e144bdf6b14af5e4e05ac74e39d8a70f3bdc1dfc7cf8
-
Filesize
616B
MD5fd3deb57ebcec6be6da748f5552d14e5
SHA15cb23464293dadc1fccb5536c1c10767a7af0612
SHA25653f09bd4d7795c57f1b9ae0bcf69853e7914ed2a1c2bc2178eb4946973719b84
SHA51247a9061c95b24440be7cf99a48c1a65eb30c6f018727580cda15281ef5318aac2ca8f0b40e509c74499d590eccb11e11c029b301d809720902eb13e0307770eb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51623d02c7c3947f18652a575760c0218
SHA134c8de109810eef5763db90c9382d8cad82e085f
SHA25624c1f06604d1365dd5204cf641035f24fbf26d919096e0b17fbbdc81eabdf42c
SHA51271fc21f3f1b8db37e729e45415f8ccc573915a07278de9a9994720dc665aab201e8e43e9abcbd68450b5ba9979e098daa72a81052408e6a1ff49b65822f065df
-
Filesize
11KB
MD59625d5b1754bc4ff29281d415d27a0fd
SHA180e85afc5cccd4c0a3775edbb90595a1a59f5ce0
SHA256c2f405d7402f815d0c3fadd9a50f0bbbb1bab9aa38fe347823478a2587299448
SHA512dce52b640897c2e8dbfd0a1472d5377fa91fb9cf1aeff62604d014bccbe5b56af1378f173132abeb0edd18c225b9f8f5e3d3e72434aed946661e036c779f165b
-
Filesize
84KB
MD5e3223147899fee2eeec148993598f2b3
SHA178126b8fd178401fc568161549b1c5eb2d0dd5da
SHA2561a14e8dc8b2d02fae1b40da9dfeb8918933778c7bebee927f77bb44c19d4868c
SHA5120ed8cba8aeae4a69253c424488e49ceb17f412041361370a5439f27091238acbcf697746bf5dce2c3ce0c624f615c945b537aef41a50a67592a0dc010ede3fb9
-
Filesize
4KB
MD5a0efe0f3ef127dce9c59f407583061d9
SHA125ed3628daf08758870d0fe47f6997a9e97bedd3
SHA2564506ff20ddc5eefb21d690e954f52df3da46fa47ec263ea965d86a683e74db40
SHA512c403927a9def453a4fa031c7b45bcf202f0b4063f7dc39e3abfdffce3d663f3d7330ce70d8033befa6c45f7297ffd3f00d080a68d4c2611f8bd928d914e4881f
-
Filesize
6KB
MD535200be9cf105f3defe2ae0ee44cea12
SHA13f4a09eeb477d3f048cdfb848b95aa39b20d89dc
SHA2560096ae873c75f4e4d802dc97eec9893acc0749a7346e63f25a8d52ba8e11c527
SHA512f8f7d8a844d588c6e2d6dc54e0d4bcbb1c4229a6e8f4d110a5e3d47eb0b8b5e0860ff5d31762229a731e08d7b232468b2a78c29778a9f0c62a7381db89175833
-
Filesize
9KB
MD5304a7b8218b230c80370958e5219581e
SHA1ac7419b4d7887c05254bb0a2a6cf552942e3afab
SHA2565a3b1662a9ec0fffa064dcc20aaac11fcea11c48a6ee6fc2f483e73102b6d7d4
SHA51262f6601fff1489558df4546245cf5bdc3b1d424a459c5c0dd7d32a171d4b81620434b525c558e1e33a35d32e4f532b6994d4a3bfa44fc7b13551230152bf640b
-
Filesize
48KB
MD5f939506c4639cf91cbdc846b56aaf0a6
SHA17681c5dba15dde4c1ffac0f74372789c708d4377
SHA256347f0ba15d0a38196e94d289054af2190e5ecd83b6009e0a788933497f0ee65f
SHA512ac54d644f318703ba3e015e83c8c418fe8a61af2d174101a9450c45fbc8aae2097b3f86f332edac2eaeddb1567c8918d040f04f4292208182b478c71185b6cd4
-
C:\Users\Admin\AppData\Roaming\NSIS Uninstall Information\{C311A2C9-A8F9-408A-8386-B3118338754C}\SKUtil2008.dll
Filesize179KB
MD529c9fcd77551e05d83752c76d10a7a17
SHA126802dbee2dc8c4a4c2b61fdccfdc88459dc2f29
SHA25604c9eaf385e33c5039909d4512ca654d6db8c69fe92aea1cb605c62b21f36cff
SHA51243f8f05de983766037165a188bb7496277ba323458cb1b96b14b58b06bd334f644d4f1c27bcb4adb539802ac81d458e8e6c1a40da4c9043487a425fa9a86293d
-
C:\Users\Admin\AppData\Roaming\NSIS Uninstall Information\{C311A2C9-A8F9-408A-8386-B3118338754C}\Setup.exe
Filesize438KB
MD5e4407d1b46ade4653de16bfc9823a05e
SHA16c5be692fe5a9ffbec216147673e6e35b3e5d47d
SHA25612f5ed3f8b8813e701d1fcce3364dd9cca87ac5602dad2ab7c3c734e9fe49523
SHA512fb1e03c494ab5ee5d49ae008df7def6e1b76babfcac3f19e176e3a8c7bafef258520b0f8456e77507c38f4640185f156b1cb31de2397606a320a4459342e7d79