Malware Analysis Report

2024-10-10 11:08

Sample ID 240614-pzk6eavdqk
Target ugene-50.0-win-x86-64.exe
SHA256 a2792b8d2290310062cfa14c52036192f8359af62ee7ff3be63e86ddbf637d75
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a2792b8d2290310062cfa14c52036192f8359af62ee7ff3be63e86ddbf637d75

Threat Level: Shows suspicious behavior

The file ugene-50.0-win-x86-64.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Modifies file permissions

Executes dropped EXE

Checks installed software on the system

Drops file in Program Files directory

Loads dropped DLL

Enumerates physical storage devices

Unsigned PE

NSIS installer

Suspicious use of WriteProcessMemory

Suspicious behavior: AddClipboardFormatListener

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 12:50

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240611-en

Max time kernel

296s

Max time network

318s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 a2b3017f7376890eaccfc9d41028571c
SHA1 2ae596edb5b6ee1f3f7e0a425eb812ef6ad053eb
SHA256 c6d52a0c339950085b4cce398ccbff1b953e33f5252e6883ed19a24331131290
SHA512 f1d17e27e02fa3e3b5fc1a0d0d35fd7065c57d466cf8ba6a8dd279b3e23361a758f142d7a1989c7a2070f3bf25c47b8a8269e21a13f4dd5bdba98f1bd6cba09c

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240611-en

Max time kernel

273s

Max time network

322s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-39690363-730359138-1046745555-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 73942b83acf9a063c4852be981299afa
SHA1 22ae5738a0ab49ce94fa4db16a22b11304a8bd63
SHA256 ffe52cf6e18428efe11c79959a422bdbded581a7d1ee97a1751f9cd80b5ddc17
SHA512 082919ce33d327ea5cd941f78fd4dbc8d9540d6d686929164838557854c549d1115863c57c7bf8d072e19ed2c34a8959ad0ce8211896bdf18e6bfeb78b002e93

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:03

Platform

debian9-mipsel-20240611-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240508-en

Max time kernel

41s

Max time network

61s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240508-en

Max time kernel

297s

Max time network

317s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 abf15fce7ce8531211125eea9164f4bc
SHA1 4d7a7412136e32e1a29f695034c797bb43391819
SHA256 e3d7dfa3e225fda6399118bdee7d7bd7e64465d8e8f918ff882f32c6e85de45f
SHA512 6adad2530894a4f64417a7cc8bcf05b180e83d9a1ecbcf20416c62521d8faf7e9b883cef83ee7348dc0c847a75dafb2a7079e71bdf4159e29d2d272e294fdaa3

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240611-en

Max time kernel

130s

Max time network

281s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.123:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 123.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 88.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240508-en

Max time kernel

301s

Max time network

308s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

Signatures

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\xml\sax\handler.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\GR09\Rgt1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\blast\msvcp140.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\UniJIS-UTF32-H C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\bin\pod2usage.bat C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Digest\HMAC_MD5.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\en-DK.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\encodings\utf_8_sig.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\asyncio\base_tasks.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\GR09\Nhp6a.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\blast\nghttp2.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\fastqc\Help\3 Analysis Modules\sequence_length_distribution.png C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\UniCNS-UTF16-H C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\fo.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\bas.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\Bpt\O.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\Qt5Quick.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\Cell08\Pax7_3783.1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mafft\usr\share\misc\magic C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\Asia\Novosibirsk.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Perl\Critic\Policy\ValuesAndExpressions\ProhibitVersionStrings.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\multiprocessing\resource_sharer.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\sl.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Module\Build\Platform\aix.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\CannotOverrideBodyOfMetaMethods.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\MethodExpectsMoreArgs.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Test2\Compare\Wildcard.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\Compress\Raw\Bzip2\Bzip2.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\ugenedb.map C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\workflow_samples\Scenarios\find_inverted_repeats.uwl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\bin\dbilogstrip C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Encode\Encoding.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Specio\Library\Perl.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\lib\ras8m.upp C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DBI\Gofer\Serializer\DataDumper.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\LWP\ConnCache.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Term\Table\Util.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\workflow_samples\Scenarios\group_primers_pairs.uwl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\lib2to3\pgen2\tokenize.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\isal\isa-l\Release_notes.txt C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\fastqc\net\sourceforge\iharder\base64\Base64$InputStream.class C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\bin\fontmanager.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\KSC-H C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\UniJIS-UCS2-HW-H C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Decoding\FCO_Wingdings C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\lib\ps2ps2.cmd C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\Cell08\Lhx6_2272.1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DBD\Gofer\Transport\null.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\IllegalInheritedOptions.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\InSC\Other.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Scripts\pip3.12.exe C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\POSIX.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\en_AT.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\MethodNameNotFoundInInheritanceHierarchy.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Perl\Critic\Policy\Modules\ProhibitAutomaticExportation.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\fi.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\asyncio\staggered.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\fungi\MA0288.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\plugins\genome_aligner.plugin C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Test2\Tools\Exception.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\lib2to3\fixes\fix_standarderror.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_internal\utils\wheel.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\pygments\util.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\weight_matrix\md_40.txt C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bam\ = "BAM genome assembly" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GFF format C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stockholm alignment file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.abi C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\ = "Swiss-Prot file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fastq\ = "FASTQ file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sw C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\ = "BAM genome assembly" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sto C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\ = "NEWICK tree file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdb\ = "Protein Data Bank file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fa C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA short reads file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uwl\ = "UGENE Workflow Language" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.aln\ = "Clustal alignment file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.seqs\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fna C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.seq\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.srfasta\ = "FASTA short reads file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\ = "UGENE Query Language" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msf\ = "MSF multiple sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gb C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Workflow Language\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uprj\ = "Unipro UGENE project file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA short reads file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\ = "ABIF file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAM genome assembly\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.embl\ = "EMBL file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\ = "MSF multiple sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stockholm alignment file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3136 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 3136 wrote to memory of 676 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 676 wrote to memory of 3980 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 676 wrote to memory of 3980 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 676 wrote to memory of 3892 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe
PID 676 wrote to memory of 3892 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe
PID 676 wrote to memory of 3892 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe
PID 676 wrote to memory of 4396 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 4396 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 4396 wrote to memory of 3044 N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe C:\Windows\system32\icacls.exe
PID 4396 wrote to memory of 3044 N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe C:\Windows\system32\icacls.exe
PID 676 wrote to memory of 2420 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 2420 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 3556 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastx.exe
PID 676 wrote to memory of 3556 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastx.exe
PID 676 wrote to memory of 3556 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastx.exe
PID 676 wrote to memory of 5160 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 5160 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 5168 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 5168 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 676 wrote to memory of 5656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 676 wrote to memory of 5656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 676 wrote to memory of 5656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 676 wrote to memory of 5776 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe
PID 676 wrote to memory of 5776 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe
PID 676 wrote to memory of 5864 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe
PID 676 wrote to memory of 5864 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe
PID 676 wrote to memory of 5980 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe
PID 676 wrote to memory of 5980 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe
PID 676 wrote to memory of 5968 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe
PID 676 wrote to memory of 5968 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe
PID 676 wrote to memory of 3392 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 676 wrote to memory of 3392 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 676 wrote to memory of 3392 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 676 wrote to memory of 6116 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe
PID 676 wrote to memory of 6116 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe
PID 676 wrote to memory of 3188 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 676 wrote to memory of 3188 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 676 wrote to memory of 3188 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 676 wrote to memory of 4716 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 676 wrote to memory of 4716 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 676 wrote to memory of 4716 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 676 wrote to memory of 2792 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 676 wrote to memory of 2792 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 676 wrote to memory of 3540 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe
PID 676 wrote to memory of 3540 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

C:\Program Files\Unipro UGENE\ugeneui.exe

"C:\Program Files\Unipro UGENE\ugeneui.exe"

C:\Program Files\Unipro UGENE\plugins_checker.exe

"C:\Program Files\Unipro UGENE\plugins_checker.exe" --plugins=biostruct3d_view --verify --ini-file=\"C:/Users/Admin/AppData/Roaming/Unipro/UGENE.ini\"

C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe

"C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe" -expert

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -version

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" -h

C:\Program Files\Unipro UGENE\tools\blast\blastx.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastx.exe" -h

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\trimmomatic\trimmomatic.jar" -h

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -Xmx8042M -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" databases

C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe

"C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe" -h

C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe

"C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe" ""

C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe

"C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe" --help

C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe"

C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe

"C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe" -help

C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe

"C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe" -h

C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe

"C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe" --help

C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe" -h --help

C:\Program Files\Unipro UGENE\tools\blast\blastp.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastp.exe" -h

C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe"

C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe

"C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp
US 8.8.8.8:53 www.dnaminer.com udp
US 8.8.8.8:53 snpeff.sourceforge.net udp
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp

Files

C:\Users\Admin\AppData\Local\Temp\nsa6E9A.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

C:\Users\Admin\AppData\Local\Temp\nsa6E9A.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\nsa6E9A.tmp\nsDialogs.dll

MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

C:\Program Files\Unipro UGENE\plugins\biostruct3d_view.license

MD5 ffa10f40b98be2c2bc9608f56827ed23
SHA1 dc8f2e570bf431427dbc3bab9d4d551b53a60208
SHA256 189b1af95d661151e054cea10c91b3d754e4de4d3fecfb074c1fb29476f7167b
SHA512 1420da3215ed30afcf413935e20404cabe0723822c728ea29dcb9699533355ef1bee17660facdb55655241c2db30a7314d8ad6a4a3f72576b2721f522d487aa9

C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe.manifest

MD5 7cb71b006fcdcf8ade80e31fd5ab8060
SHA1 655380fb2cca01b0ca707f748fc7dcf006732518
SHA256 be8918559280a2e74748bf8f6238b568ed7cbf75183b2180a6a8a979a1ebf243
SHA512 ce095bb84dbf2e72304471f97e80799185fab42b843f95bd84df4b97764786687807f057dc4434287c8982937329e664f7de476445ff6e2cbf298d7a44b48d55

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\share\mfold\sint6.dg

MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb

C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip-23.2.1.dist-info\top_level.txt

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Program Files\Unipro UGENE\tools\trimmomatic\LICENSE

MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\nb.pl

MD5 66ed114afca8e09fa9af4c7011abaa0e
SHA1 93c34030bb195a3b9334230de8a7970adfa9ef72
SHA256 a8ca3f8067a7215ec8f168a2bffe0846d1024a9138626f88e048dbb5b112c93f
SHA512 90762b4df5ae25ee36bd3571437301179de15454c8ebdf5758acb86fe391cd17af4fe5fd05e1bc6be5a52e8b1a8b0986c43f86dd0ace5479083daaa7564918ab

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\myps2img.bash

MD5 e3056941bd15507718d2d4b9e808c7d0
SHA1 de9ff3fc12304d4060e2a1d40b98e6b73cf03eef
SHA256 63f155ef26f370f8e7fde423288028f355798e0923f242831d5c2c56f8ce2374
SHA512 ee85f34ca427f2413e73e93e0a41004ba2a7e072b21efedf891fafa3857c4ef7aec48c77b340f5d66619fad2a87cac2599f52deb984ce2cb59665f1a275dbe84

C:\Program Files\Unipro UGENE\tools\java\lib\images\cursors\invalid32x32.gif

MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

C:\Program Files\Unipro UGENE\ugeneui.exe

MD5 e507b1eb783b3d0c66b87bee96720b0a
SHA1 3718357ba806e220056bc08f2186e33c2f646653
SHA256 9175593c40d4190821d325d5f9dc7274c83db687c0280eb253be4b858ef5ebb1
SHA512 d7856b3d813669cfaa52ad1fb39a6302764e1d0969d10103087401b07b41bf97df2f5bb2798bd022ef1ce886c892d887218851fcf7ab1a2ce7d961f0fc777eac

C:\Users\Admin\AppData\Local\Temp\nsa6E9A.tmp\modern-wizard.bmp

MD5 59ed2684c564aa9dcb6859342a97b960
SHA1 d7ca551a1340e2a31106171ead92631e79983949
SHA256 d238273737a291fb4129e33415cb66131756782428b86fe13894d8bf1b4abb7c
SHA512 c41433f1baf5b1826496ab9146be1b9e45e1f6208a74b54120cf421fee51900409fbc92e978d9213d4c0dcd0e937c390f782e787d8d7032fae62e1d957a3e9f6

C:\Program Files\Unipro UGENE\U2Core.dll

MD5 cf0b4dd5e62ae168240d1ee781a83272
SHA1 92a9e14e5bec4dab9937f4cd8f6b37a8418a41ef
SHA256 1708ae798ed3a23e46b78364192464169ac19bd16635e9e1616d52bec4034b9d
SHA512 6029ef124a0f3bd9e2741e17133c0df861f64fcad5d4ac75b2d2a1013a3228836c8d7e584552ef295607f5518f516d3dc0b15c53a4caf914ecae6921a476a844

memory/676-20262-0x00007FF8B1940000-0x00007FF8B1B88000-memory.dmp

C:\Program Files\Unipro UGENE\platforms\qwindows.dll

MD5 ba0bb2d62821ee94ef6b5a49ddbbc42d
SHA1 165ff4991147c5314b80e62ca541c4cbc5424732
SHA256 47ca0ca24888eb3fbffac490cbb8c15f0444959f50c8a99b361e4ae54de836de
SHA512 fee807c7172144ff30e9ea18384ec0e722c8ec5b0f5ca8414aa47e3c8ecc16cb18319826dc3d4191dd1e146840719851a9116881eac4ed9834bd3f5db4f550d4

memory/676-20275-0x000001B3E48B0000-0x000001B3E48C0000-memory.dmp

C:\Program Files\Unipro UGENE\imageformats\qtiff.dll

MD5 6cd7a60aa2e8416372a83cfa1bdaab89
SHA1 66d71c47a67925bca3abfd6bf9ab9ba97fec4b83
SHA256 10af3e2b8ba7dc80de437eee4518df64b00adf9fc6023c8fd54f3182650525f6
SHA512 72d5f257f9bd7f71295baeb7de134b1cb532b5d02d65cc09e4792ee21ecaff351981946b5ffc8d22f1c0a0a672b1f08ad47c9f7e335294e5a8486f8c049e3f0f

C:\Program Files\Unipro UGENE\imageformats\qsvg.dll

MD5 8d424052cd49d47ba649d9f6299fc64e
SHA1 7622e6207aca419f192b252a5ad3d737e37f15a4
SHA256 2f04b1cdc48710d6c56f968e2e9107f5c271695f4d04c652b118defa83187083
SHA512 47a32ae9583867c986a88af0e436668d69063035fecdecb119951d33da5d636d8b3c0073d82cad11960c5b0de3859870a0c08896d80f650a0a37ac79789667be

C:\Program Files\Unipro UGENE\imageformats\qjpeg.dll

MD5 8dd6bbf14f309f562f6cd1bfaf041fd7
SHA1 dbe4af501cd268641abb49aba596137b92ef3a11
SHA256 20d8f15c7547fb40bf5cae8bec3f880c782cdb7859227fa7a7ddf62236f19d84
SHA512 6dec359a4b37aebda328f782f6e790bdeb3b8b7c695b88dbc26a24776917834d738dc276198c102a35a81771af162d74633ef7aa8b901c74f8ed0244b89622c3

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 2c181a4cd07e6f7c71185883b77553a0
SHA1 8f55b2e1580e8e2dbccc1441176349916d884afd
SHA256 6db9bf0219b0e0587f7fdec254f2643c4c4ddf218a5be4658a677347320419fe
SHA512 f6de681860e7bb71767827f5bbdf6d94896d15f7d2cd2ec9e9e12363ccc02027b226ff8e419e7ee376421041ee3baf5ac28c0f3092b4e12372510f70692c6ad6

C:\Program Files\Unipro UGENE\imageformats\qgif.dll

MD5 2dca355bf20dae868b4b5c5e03c4ee7e
SHA1 36d635bf22b8db514917080e70d849f24da485b4
SHA256 1ad13a3a59210c9e9d6846ddd8caf73d92016993b1591722c8654aec412604bb
SHA512 64ab1b06ad0d2cb5394bad15068768b8ff39b9e957fba73675c442714ed74eabdbb58b6b3af1a8cd13b121861a99783f92abadc491b93c9780c7bb33df6ce70b

C:\Program Files\Unipro UGENE\styles\qwindowsvistastyle.dll

MD5 2578e128acd8a6ef5fc5a5f46aa43fd8
SHA1 0c4f5b66ba6340376bca7f1b143fe6d13b407074
SHA256 11089f156619ee6644a50c961c1b8b278f905e61e1f9979f8965bc3e17a06ead
SHA512 6e2d95d23bc32acc96f10d959e4a7e5a8357ad6d638d6fb502683c7e4b4ba503a6a55ca902c77fb75b636cd7cac3aa4e261ba87d0ae9e1e4d8076e4e124cc4e4

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 761dccb8e08dbab70c8c439195b2cd12
SHA1 b3c6d906d799bd3c4828736af45d9754f1101277
SHA256 df116636cc29e626845e3584032757b0c8017f75a46c8ea66f53b096505c7d0e
SHA512 65efc1121a561aa9ce503685327f1d45d9e9ac36ef5baab984b875ff1ac78d24dbf2b16736c5300e43bbe2fd2b084ffe1a22c118412e4f92ef495b8987feeeb8

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.EQFquZ

MD5 660d87a65e928cce45bfb6ebff6540ed
SHA1 7b9e220e56f984b6fc5587886f7244455fa6ed08
SHA256 217ee38ff74175fb572517a205f9936d218282679cfd9482da258c7323032475
SHA512 6fcc55acec6c104f5e79f1fc3d1e71f7c5586b27cdd7d6ba96ff77a308c68a455341bc19f27b96f043190b9cd74b031548668d5e8a844cd79233cced22491ae3

memory/3980-20494-0x00007FF8B0600000-0x00007FF8B0B41000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.IJyooT

MD5 aec1477f643bd291ecd751a28eee1598
SHA1 2cd3a39e21a4a5ab339586ab9d7cb78f421ee26a
SHA256 010a2a658119856998c4df3603fc30c1a35d7c896f6877247aaf6728cd880ef6
SHA512 0cfd7e0544a52a8d2e8943137802d946244c0a14c2aaaf11541435814b966a5bb79b95d091c36c055f9ad7d4fa24b145abe937dfbebee693f576d4b4bfb326b2

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.lMdRAL

MD5 e6985f31bcd850a582d8b3be7182a80f
SHA1 664b7c087a964f87752c35d171472bba201fb0b5
SHA256 472890355537c5c46910b725d0239887b0cbe9ad24a0326e0249231b0ae22608
SHA512 63335cbcd08d28accaa79b527637b3ebe2898ad6032a7a31923b4d122ea141153517034d234b3906e0025e887933941e228ae9f934683cdfe39d574242c0ce48

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.pvbGmb

MD5 2ffdb73ed4eee9d902ab68853f3637b4
SHA1 c1eea961d277a3bcdddc76adc7daf8fabe5683f6
SHA256 700257628f2f542b268e92e8ac00ac3d570cc7604ae33f6c7db6863b19acd2e4
SHA512 91a60411d4442cd7e9737a277e2d89bbd4c8e4de9ed4c88ac2b0d34d33f7e067f58cb4b38d954c619264b97c118fd78a44fe2f329ef021c3943f050fd579c761

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.lock

MD5 f51479a504083512b7e87ac31e3f4256
SHA1 7dd87302aa1c0bb424cf4dd079faeed42e10062e
SHA256 a10456435878293f3e8ebaf4db1fdd73bc9b34e2bd61d91e77bc4c46ea76d98a
SHA512 25774398302250ae5a87a3a077f41163a3528c5daa1c6d87dcd50f03921ab61378eb36b2b784ab83dd0b29ebf35a614554e6deae0591b39786f83d7975efb3ab

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.EUbFiD

MD5 a43f462c133b4622b157c63148873249
SHA1 49443c6f4e06d279c80abad2075ed1557470915b
SHA256 072c3b4161447212455ff946eeb45bab16788bba34c76a544d3cd75df6a6f13d
SHA512 850aec6f1892623bd0ae56af07b69d516ec4cf1aa523719419a791857c2ca2b9f6babbd387a4aaf86d15562b7e0eb60409f261b040d99f25cdcdf057c054e4ef

memory/676-20300-0x00007FF8AEFE0000-0x00007FF8AF2F5000-memory.dmp

memory/676-20265-0x00007FF8B0600000-0x00007FF8B0B41000-memory.dmp

memory/676-20263-0x00007FF8B0EA0000-0x00007FF8B1361000-memory.dmp

memory/676-20264-0x00007FF8B0B50000-0x00007FF8B0E92000-memory.dmp

memory/676-20261-0x00007FF75EE30000-0x00007FF75EFDA000-memory.dmp

C:\Program Files\Unipro UGENE\msvcp140_1.dll

MD5 af3c0ba75cf280107d52aa33af926ae8
SHA1 444b89dbf382773e18e3fbc77b34817f4440160d
SHA256 758f38f7f87c7ee392297c6e742f52c966e963e1cd4d8262231548a2003ffd78
SHA512 c638e9f7973e409bf2e0e11bf4593376e234cd44f0e9cad499a6ff6e6e2dde06095e06ebaffdd02d4473d704006f242aa8b709d0ab97b32ec747d3f45ce93757

C:\Program Files\Unipro UGENE\breakpad.dll

MD5 24c41de7e373ed3a12155e7c120303f7
SHA1 048ba3d6fd6f613138d7ef875c615ae9ef0b2b3b
SHA256 46c347eabff11a06b4cca30e17586d790115bceeb1d2bf4a3ba86e1aa0724629
SHA512 81e6017e38bd5ffb4c4a0c16394a959661f2d2dad388c664117e2f6e4945a107ae8f4a18faa68aa576aef83bd8ba07df7fb550b94ffe88f318d63acd8b581760

C:\Program Files\Unipro UGENE\Qt5PrintSupport.dll

MD5 2270a22b787010d0ab80f1469deed718
SHA1 bbf2b000d50069718cfd5c3ab092e7b91f93f921
SHA256 8943a4a305dd5119760639244185bb7c52327bf9341720f0e0e0b12a329e6472
SHA512 fcc2b1fe9682f4b4c99a8b3407c3963f5e6f754ed60c48137e854884a077fcdc79a9e0ef5bda1e467d3d49bb98995bf47e7262ea252bcb5b7f008838bf134eb6

C:\Program Files\Unipro UGENE\Qt5Svg.dll

MD5 b0831355a9659174c7bdc7dfd729cf5f
SHA1 9831c5ff2f81c207e6788f7d2ae2bb05ea5be3c9
SHA256 7837ce9d8865b38da0177ff022a946a645edcd0e85e708b936ccb8430da39540
SHA512 65e39972339d7894f78bd55b7c5a3183954eee3057d4dcc00cc3bf1e91b22cfceffce7acba61bd43b3c572a5b00bdb0684779ad1a76f902405afa8f4eb06cb23

C:\Program Files\Unipro UGENE\msvcp140.dll

MD5 206afdd686e4f42e3a92e688d788cf0a
SHA1 b3178367052908ebd642ba485709a46b725fe73e
SHA256 db8b072cbcb18cf350b82c1731e75fc02b8bcc02fe22e28ddbc3485d65f3ecad
SHA512 a4dc319576a9ca4e6263f72b466749ba4150e5018602daa20b816ab461b45f19d4f9631d768fc48e975f04f791f0599f957e4220cec8128cc8e7ac96e33883bf

C:\Program Files\Unipro UGENE\Qt5Script.dll

MD5 15da266adbe5233583ba371977e0c3c8
SHA1 1c229360dbcb50c8de7217010cb1a3d6ab3e066d
SHA256 e19555cac5893d21813dd5610a62f14c6d6d463dfa70329b662134d7607f35c9
SHA512 e7e6fbab73e48b82e4ca3574da21e69547cef4815edb9f3233a0ad38a776f23e515cec0b497d6feb8ff4da33b371e0cf5fd04b2aa24c73b90733d99998ce8686

C:\Program Files\Unipro UGENE\ugenedb.dll

MD5 4ebdabc471eb9d7123780c103a7c63db
SHA1 4c01c79349e2d7d9eb69d3fbd91b04b542da6178
SHA256 703f7eecd05756411544f09ce8e6f195c9134799b1044a4e4ddf159eebd417f0
SHA512 e25809348511b2cb14f7662ad3829845f7a72e16c8730b018882e61358778938faa9d3cd02585e4226d4a5bedcb56fa8be35a14bff87c9ec48f2fce5deee0d26

C:\Program Files\Unipro UGENE\vcruntime140_1.dll

MD5 21ae0d0cfe9ab13f266ad7cd683296be
SHA1 f13878738f2932c56e07aa3c6325e4e19d64ae9f
SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
SHA512 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

C:\Program Files\Unipro UGENE\vcruntime140.dll

MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

C:\Program Files\Unipro UGENE\Qt5Core.dll

MD5 597ed85ad126dc292bd076e9a5b6608b
SHA1 51e896aaba471d1ce16ebc81a31098d218c28301
SHA256 d94c19a434e2fef17ca93ea1efdace37474dce9612e018e6b4c3694a7b4d2e77
SHA512 12643ed63cb93a96798c98948629e3513f1abeaa4b9eb08444d693ec3993273a669f523f139c84ff0b89beb0e7336778afbe37830d7b72bd9dda2c99e336e9d7

C:\Program Files\Unipro UGENE\Qt5Network.dll

MD5 c8e8fbfa0b6b8d57c5a5705df5aa44cd
SHA1 f7d33ddcfb053318eac1ea7779ea4cd626465509
SHA256 80ff946325ae4c3160448cf7cf4a3585d3ab5a8546ab092588f429b1e6d4962c
SHA512 c601d871654d98fc8a16ac621cbd84360b792511c8a609da4024357782b9d11db11777d7ac55af1b1c778df0717d9630638aa77f172d4fcba22834d236a9cf0d

C:\Program Files\Unipro UGENE\Qt5Xml.dll

MD5 68cfd69993c8d7e12674a5b4b7f58759
SHA1 741c933e2334ca3bbf831848a27fccfffc32734d
SHA256 c9d4dbcb83dbbd0b220ac6d7b76a6cab046f38acda6bef6184785c616bd54185
SHA512 b4f8efdbc3d9266301d73d7ecec867b31084c2e35a97dad4d2b6a808719eaa53b8874f22084a814ec1075d127a057c5580c8c35ae3c2a16db9a5ab6f02a1a8dc

C:\Program Files\Unipro UGENE\Qt5Gui.dll

MD5 3ace761376d23ea3bbb518fba9623160
SHA1 343c704a4c41400b2f52e97d1875065cc5431053
SHA256 5a8fdbc99b6ca04b47ae7d60366aa17a0c0282ab8751db1a4fef319f11204494
SHA512 a44f623039daad3ad49984868408480fcc66043c4f858b055aa40d64b63094a0787ca195fa71eb110f1e0c715f2e79e6808ebe646a49822a2f759c60fc6b15be

C:\Program Files\Unipro UGENE\Qt5Widgets.dll

MD5 6138dc6612f30a96f9918b012c867a89
SHA1 b43b0e1150656c96faafa748afa827774e7414e2
SHA256 40eed4076ccffabe5b7e1d00baa67b5845ca45db57771042ab59f677fd229870
SHA512 e61bc2c3682d1e017fd33046850b42e02c6babc7791ffdf405900164e58950fe8385b1514ff1ed3ea422b527fdbfd8705f357d16ff0f91ecab71d404af7d8590

C:\Program Files\Unipro UGENE\U2Designer.dll

MD5 3bb593bca7763cefc3e4fe3634e8b908
SHA1 9b8cf8b2ad16e7551c5a7d6b7f8324ef620ac0c7
SHA256 a889b40319fee4720504fbfbc4517f743192cb793590b31b15ccb88dc70e9e27
SHA512 8928652c030c2b386819bd4a02242316649b5b6a9bcd944d516c5fda8e2def379774fd459791e9fda32617a4cf11b84bbf29a2d83cc7b4c3f29868ba1be22e6e

C:\Program Files\Unipro UGENE\U2Private.dll

MD5 bb18fe48e821e41b38b3b09ce921afb6
SHA1 e786a4b53e102b17ebac33b975959eb035035ca5
SHA256 6f747c9300b87c14f6e78bc05df910ef34927aa9c3d48fa7a62c8a7bd868f0eb
SHA512 5a3a0292fe0f415ff689d6e8a096994c0e6c8afaf01c0092190104fd8a84c0b702bc0bac0734f9a5c95af74ac31e9309a1a143741938aca008f419ce7179d2ed

memory/3980-20496-0x00007FF8B0EA0000-0x00007FF8B1361000-memory.dmp

memory/3980-20495-0x00007FF8B1940000-0x00007FF8B1B88000-memory.dmp

C:\Program Files\Unipro UGENE\U2Lang.dll

MD5 c8e767c575a4eb6b408cdafe90b701da
SHA1 6c44c6666c81d44dde591a2c16c5859898604b55
SHA256 e1f9d535128dd77895bca1ab8e224710aa5cd122a697c188957e4442024c855d
SHA512 8228710ce3c6e3e9e797469a9a2764e2d0c17b2439fe544239df6f883d820eb35e4f6c626015d3491cf889f6d645d22d3124588fb1eb1ace179dadd80bd58baf

C:\Program Files\Unipro UGENE\U2Test.dll

MD5 a3f6b9b1c7e77b850286a2498335ffcb
SHA1 b8c3cc3641609973a5dbcf03792718e1de31b670
SHA256 24eb55db639de9bfd9f56a17f36751c3f58df6fcf678298102b71f875e7f035e
SHA512 604bb9b8a6296ef07f87f8443c7a7d99439600dfcf0ce61f2b1a20799f0182b37b276687e1a9701e8b3493feddb61494287c5ce942c31c4e94d3505a7f856b14

C:\Program Files\Unipro UGENE\U2View.dll

MD5 13b304c3c3997810bad9a6efa0229db7
SHA1 2e0eaa35978e0c05c3e4faaaadcf87935fa31b1a
SHA256 cc302eac63869d7e5d0b821c33989e2df6d8601acf7a07fa0163d91e0875f4b4
SHA512 cbf0d2a0943a5e132cfb1589e3b06cdd51e0037a7041b498cccef1a22b07954f033a317d85e5222cb890f2ee2ca89616e76e7480eb18c0a4ffa482cc33d86530

C:\Program Files\Unipro UGENE\U2Gui.dll

MD5 d20f3cca7d3b32cf4a7695be2dbfda5d
SHA1 367ba3bcd7d17824ee3c1cbfa1acb711270f5be5
SHA256 1087ada7c96048ef5cbd0c58328f30b4ac62b76564ab57302a92fd857bc9a6ec
SHA512 7f467d84848f68d8c830069a2df176441a3950cafb5f75c661a48fa67ece7ed56013738d549e8b072c8969542fb7de02054e0e2d55ffc9b49259b2536cdbcd46

C:\Program Files\Unipro UGENE\U2Formats.dll

MD5 0ed34dd92eea1e4a73d6a4ed036e4683
SHA1 8d5a8b781f42070131dc40a8b80f81db8977497c
SHA256 36e79757bdfe9c9dfdd2f6920366540e346d2941bfc88ad99343aa6f3a88e010
SHA512 848b173e17ff3e550f39e88141472186c70cc24e635fbea367d30c8eaefe19f74cc6d15c685941ebc855ff2b82bb856b980101dd692eef02afdd6ad82f573965

C:\Program Files\Unipro UGENE\U2Algorithm.dll

MD5 63ebd8afed58315e4504ac3a687d9f3e
SHA1 84c78d1e315bbadcb65c46ba9d9bdd3733d04405
SHA256 eb54570ca630781dbf22315efac978c90e2ad6645274607863ff8a4f9d9ea31a
SHA512 39ee203b8514114002c620a2f7343e3cc63944cf8a5810bfc0a6c0d81f0d31ed51755907c5918e861b7a37b691f86254cd1ae561748525c2345d1456fabc8b8e

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 f038bddcb5f00201333cdce48bba4a4d
SHA1 1aecc35eecc57660b0dcb083c0e3dc33bfaf53e3
SHA256 04de6cd887736d003378ead3e16e5843ef8252e6014a4959500ca4d32f92cbca
SHA512 01c6d1ba2240cf158c978e32dcfb593b36cd2e8935571f7ed2e276f4c1b14033e53d8defaa5c3d4c684bc489579671bcb41d4ac6ae0d0f4b44a924d45acc7267

memory/3892-20511-0x0000000000400000-0x0000000000453000-memory.dmp

memory/4396-20530-0x0000000000A70000-0x0000000000A71000-memory.dmp

memory/2420-20549-0x0000000000B80000-0x0000000000B81000-memory.dmp

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

MD5 cab437a45738692b65dd5f822c30794d
SHA1 5a6800a0c6bd0bfa6cee10eade8e43b2107461db
SHA256 a668db19cf5eb8944ed6343aad9409f1ab9e2b6731a9fb298f087c0d0156f7e5
SHA512 1bd5c938ff5b15043f2caac4fa031e9e304ca56674e4cfafa801721a3249dd2ed1001afe482cfd70a940617c492456cf1cc3a703206ad7449e47bc35e9866a97

memory/5160-20576-0x0000000001130000-0x0000000001131000-memory.dmp

memory/5168-20586-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/5168-20587-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

memory/5168-20614-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 0386754cc38d683e26eaa79f94d2e627
SHA1 faab12724e009d01633922a6460d99991be54b2c
SHA256 3f0d5f3d1289b3a2aa6ba32da2e4da58214befb20e4424f63862e4ace978882f
SHA512 3512a5aa3bc21a7fc7212d8aaaa00a5c94fdafb8c13136c39b3732449d9146382c6cf85cd6e2154b235921bd4e31811dcee8c5e22aa7a6f3c5c5803e0be23b52

memory/5776-20640-0x0000000100400000-0x0000000100603000-memory.dmp

memory/5776-20642-0x0000000180040000-0x00000001805F0000-memory.dmp

memory/5864-20650-0x00007FF8AAF70000-0x00007FF8AB272000-memory.dmp

memory/5864-20652-0x0000000100400000-0x000000010056C000-memory.dmp

memory/5864-20654-0x00007FF8AAF70000-0x00007FF8AB272000-memory.dmp

memory/5980-20663-0x0000000100400000-0x000000010059E000-memory.dmp

memory/5980-20666-0x00000003FE740000-0x00000003FE75D000-memory.dmp

memory/5980-20667-0x0000000180040000-0x0000000180640000-memory.dmp

memory/5980-20664-0x00000003FF010000-0x00000003FF05C000-memory.dmp

memory/676-20676-0x000001B3E48B0000-0x000001B3E48C0000-memory.dmp

memory/5968-20675-0x0000000000AD0000-0x00000000010D0000-memory.dmp

memory/5968-20677-0x0000000180040000-0x0000000180640000-memory.dmp

memory/5968-20679-0x0000000100400000-0x0000000100452000-memory.dmp

memory/5968-20680-0x00000003FE740000-0x00000003FE75D000-memory.dmp

memory/5968-20682-0x0000000180040000-0x0000000180640000-memory.dmp

memory/6116-20703-0x000000006CEC0000-0x000000006CEDA000-memory.dmp

memory/6116-20704-0x000000006FC40000-0x000000006FD38000-memory.dmp

memory/6116-20706-0x0000000069280000-0x0000000069293000-memory.dmp

memory/6116-20705-0x0000000063600000-0x0000000063613000-memory.dmp

memory/6116-20702-0x0000000000400000-0x000000000066E000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 5949a99b6579de9fbd4d118a0da2af17
SHA1 2fa2649c21da1fa854392e10da6641d0a45f0a24
SHA256 d561fec8d3a00c0ded7928c32cbbc85ce1824a8e99604cd22708d1deebd63791
SHA512 ba4b74cce25d4d8534251c6890198828a3b05fc45814a7f55b6137437fe2f3e3b5b3c26911096160ecf5dbca0b9df9b1519037af31df2d1950a759e4b77984a1

memory/2792-20739-0x0000000100400000-0x000000010049B000-memory.dmp

memory/2792-20742-0x0000000180040000-0x0000000180640000-memory.dmp

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240508-en

Max time kernel

296s

Max time network

317s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 73d4e8c85f9daf87f26358d4477322e3
SHA1 ab4b1950a0979db1ebdaf26e6755c0cb53a9a7b3
SHA256 d780ffc6b9213b3d76c65e15c222203d0163de55247c8b4086a36b9e2c6f8a96
SHA512 d4a34708a48911877e9052294d592f68f493e52fae5f7dded591f705805635a52975492ab0979951cf53d528229d25690241c6d99429426c86077eaea23c38c4

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240508-en

Max time kernel

297s

Max time network

316s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 fff6a809b292d1a0fec7b09ca4a6c6d1
SHA1 a8d12c9a7e874a201d6e326408c53fe7151c6e37
SHA256 89c9e263dc2d9ef3dbe8770ccbc27fb57ec268d387c0b9e0adaf1062546747ce
SHA512 526a0042d743cb9deb030b52f443d30ebbd394c0f2caf11681249fa50849d1d9e3cb5352e3dcf4d7bcf569b0adde51d8fa630f572bbe2b16e894630c28e4face

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win7-20240221-en

Max time kernel

298s

Max time network

320s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 cabacd72579dd2e2aea81d32f1a7199e
SHA1 ce1a03946d968717a89a2b095230ccd2eca0bbcd
SHA256 c1e3eec7552f48e94f61b30106770343aa7cb06b6606c556dac603dfe00e8f83
SHA512 aeb2596c4ac0e05ca293b20c1a71db10dfc78c649a0b50960759fe8ccfcf71e22db6370e40ebccdbca49163fc65d71194b01540e466f4471b05d725f5bd4b2c0

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:02

Platform

debian9-mipsbe-20240418-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240508-en

Max time kernel

297s

Max time network

319s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\traceback.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 fe941e75fdaf46d7e73dc7bb937c416a
SHA1 148ce277d897561fd292c53b60de7508299aefa2
SHA256 09c2ebbe18e72fd3591767861a8b676530df17b7d3a86d2a315f7d52b3690f43
SHA512 48ce5d76fc740f61bf658d632717bb669adab110dc90773c9b22c28ff0c17b1f65e09e2a2aed06d4d192621039fe867e08a518f8fcf33eebd73cabe858c11e71

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240508-en

Max time kernel

297s

Max time network

316s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 c1f9a017889a3700b17f5de6c35f27cd
SHA1 6e4e3c5045be9a186cff3ad5913c8e0003ddc4a8
SHA256 da48e64f3306dd9b3b65e2379cf56dac97fb02aca73aba762d91ffd6abc513f8
SHA512 10dab6b9432bacf4dff9a6bed426ecf5fdbfbc1765d2e39343f4223da398883786c73a25f61385746be6c76905d26176a789189c5b6673a5c6371502935d6b43

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win7-20240508-en

Max time kernel

297s

Max time network

316s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 da040350270af9a4b4fb3b616a2b374c
SHA1 f2ff33d0f291a440f10ad6cd629199703e6e6273
SHA256 5e70b09d14a2e0fd2677375e6fd5a4611d68242311ebaee5f29e3d8bddc0cae4
SHA512 e5c9c4fa84afccbace94dd3b59bed46653aa8b5e80865f8a679cc48fab5acd190a0d3c9aa27a80ceae110b15ff4e2f9ef3ba2d99b0fece44f99747dabacb4b4b

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240508-en

Max time kernel

248s

Max time network

278s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\timeit.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win7-20231129-en

Max time kernel

297s

Max time network

319s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 c528562ffc59a0708d469cf6abb81b53
SHA1 4855ceea827866e66d8c82c62b90c485955d75e0
SHA256 2a3f4aeaf9888e57fffc873c8c1ec4e0b557383e4b6577476b605d75c7b33743
SHA512 7cd6796efa080b9630c85dc6cc51f60ed2e040e839b853637cd0ed27e0d82968a253d2fa7f2c006887376113c1def12372282fbd598936348b413e87b7f6cc7a

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240221-en

Max time kernel

299s

Max time network

317s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 e23e8ca2ff12ab1bcb7ab4f445d56d5b
SHA1 534d609efc855e0ba07eba3f14dff8103f94096c
SHA256 9c55cd34224895c04628f2999965c35e4af6081c046bed00e5d5d665185a35e9
SHA512 dc0017e9390e68574c41367cd044eb451d6cf93fcb06341ff68659ebd9351704e3954a853a57f733bd30e1c9b8a52ccbf00f5eea753ffc5c72faa63b2cae30f7

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240508-en

Max time kernel

215s

Max time network

246s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win7-20240611-en

Max time kernel

189s

Max time network

184s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

Signatures

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\CORE\op_reg_common.h C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Format\Natural\Compat.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\ff.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Meta\Role\Attribute.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\PPI\Statement\Null.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\eukaryotic\Nf_e2.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\fastqc\org\apache\commons\math3\distribution\CauchyDistribution.class C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Font\C059-BdIta C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\requests\certs.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\trimmomatic\version.txt C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\In\5_1.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\snpeff\scripts\gsa\checkGeneNames.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\fungi\MA0318.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\CNS-EUC-V C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\yue_Hant_HK.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\PPI\Token\Quote\Literal.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\America\Punta_Arenas.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\CannotCalculateNativeType.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\luy_KE.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\lib\ext\access-bridge-64.jar C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Font\NimbusRoman-Italic C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\lg.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\Cell08\Pou2f2_3748.1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\resolvelib\compat\__init__.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\tr.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\urllib3\exceptions.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\fungi\MA0400.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\lib\deploy\messages_zh_HK.properties C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Devel\NYTProf\Util.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\samples\PDB\1CF7.PDB C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\CPAN\Meta.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\gl.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\weight_matrix\pam160.txt C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\ar_JO.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\DLLs\_decimal.pyd C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\Qt5Network.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\insects\MA0168.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\vertebrates\MA0051.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\ar-KM.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\Dt\NonCanon.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\bin\runperl.bat C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\ActiveState\Handy.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\PPIx\Utilities.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\bin\zip.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\CPAN\Meta\Requirements.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\encodings\mac_latin2.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\prokaryotic\NARL2.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\workflow_samples\NGS\tuxedo\tuxedo_single_dataset_paired.uwl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\OverrideConflictInComposition.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\mailbox.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\eukaryotic\Gata2.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\fastqc\Help\3 Analysis Modules\6 Per Base N Content.html C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\MethodExpectsFewerArgs.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\SQL\Statement\Embed.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Test2\Tools\Ref.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\pygments\formatters\bbcode.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\ActivePerl\PPM\images\gecko.png C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\America\Chihuahua.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\AttributeValueIsNotAnObject.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Convert\NLS_DATE_FORMAT.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\Australia\Lindeman.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\en-SI.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastp.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\tblastx.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastn.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Enumerates physical storage devices

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.uwl\ = "UGENE Workflow Language" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.ab1 C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.seq\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\ = "EMBL file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uwl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gff\ = "GFF format" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.msf\ = "MSF multiple sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fa C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fsa\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.msf C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sw\ = "Swiss-Prot file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\ = "NEWICK tree file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.ab1\ = "ABIF file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Workflow Language\ = "UGENE Workflow Language" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GFF format\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bam\ = "BAM genome assembly" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA short reads file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fastq C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.pdb C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sto\ = "Stockholm alignment file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GFF format\ = "GFF format" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.srfasta\ = "FASTA short reads file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.embl\ = "EMBL file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fasta C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uql C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fastq\ = "FASTQ file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.genbank\ = "Genbank plain text file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAM genome assembly\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe N/A
Token: SeCreateGlobalPrivilege N/A C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2456 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 2456 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 2456 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 2456 wrote to memory of 3560 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 3560 wrote to memory of 3944 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 3560 wrote to memory of 3944 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 3560 wrote to memory of 3944 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 3560 wrote to memory of 3784 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe
PID 3560 wrote to memory of 3784 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe
PID 3560 wrote to memory of 3784 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe
PID 3560 wrote to memory of 328 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 328 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 328 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 656 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 844 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe
PID 3560 wrote to memory of 844 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe
PID 3560 wrote to memory of 844 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe
PID 3560 wrote to memory of 1376 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 1376 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 1376 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 1376 wrote to memory of 984 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 1376 wrote to memory of 984 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 1376 wrote to memory of 984 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 3560 wrote to memory of 2008 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 3560 wrote to memory of 2008 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 3560 wrote to memory of 2008 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 3560 wrote to memory of 2008 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe
PID 1376 wrote to memory of 1760 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 1376 wrote to memory of 1760 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 1376 wrote to memory of 1760 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe
PID 3560 wrote to memory of 1952 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe
PID 3560 wrote to memory of 1952 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe
PID 3560 wrote to memory of 1952 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe
PID 3560 wrote to memory of 112 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 112 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 112 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 112 wrote to memory of 2248 N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe C:\Windows\system32\icacls.exe
PID 112 wrote to memory of 2248 N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe C:\Windows\system32\icacls.exe
PID 112 wrote to memory of 2248 N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe C:\Windows\system32\icacls.exe
PID 3560 wrote to memory of 2684 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2684 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2684 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2528 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe
PID 3560 wrote to memory of 2528 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe
PID 3560 wrote to memory of 2528 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe
PID 3560 wrote to memory of 2528 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe
PID 3560 wrote to memory of 2032 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2032 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2032 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 2332 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 2332 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 2332 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe
PID 3560 wrote to memory of 1500 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 1500 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 1500 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 2332 wrote to memory of 2484 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 2332 wrote to memory of 2484 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 2332 wrote to memory of 2484 N/A C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe C:\Program Files\Unipro UGENE\tools\java\bin\java.exe
PID 3560 wrote to memory of 1076 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 3560 wrote to memory of 1076 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 3560 wrote to memory of 1076 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 3560 wrote to memory of 936 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

C:\Program Files\Unipro UGENE\ugeneui.exe

"C:\Program Files\Unipro UGENE\ugeneui.exe"

C:\Program Files\Unipro UGENE\plugins_checker.exe

"C:\Program Files\Unipro UGENE\plugins_checker.exe" --plugins=biostruct3d_view --verify --ini-file=\"C:/Users/Admin/AppData/Roaming/Unipro/UGENE.ini\"

C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe" --version

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" --version

C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe

"C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe" --help

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\samtools\vcfutils.pl"

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2" --help

C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe" -h --help

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe" --wrapper basic-0 --arg-desc

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe" --wrapper basic-0 --help

C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe" --version

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -version

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\trimmomatic\trimmomatic.jar" -h

C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe

"C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe" -h -help

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" -h

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\fastqc\fastqc" -v -java "C:\Program Files\Unipro UGENE\tools\java\bin\java.exe"

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -Xmx1897M -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" databases

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -Xmx512m -XX:+ExitOnOutOfMemoryError -Dfastqc.show_version=true -Djava.awt.headless=true uk.ac.babraham.FastQC.FastQCApplication

C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe"

C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe

"C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe" ""

C:\Program Files\Unipro UGENE\tools\blast\blastp.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastp.exe" -h

C:\Program Files\Unipro UGENE\tools\python3\python.exe

"C:\Program Files\Unipro UGENE\tools\python3\python.exe" --version

C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe

"C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe" -expert

C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe

"C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe" -help

C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe

"C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe" ""

C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe" -h

C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe

"C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe" --help

C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe"

C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe

"C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe" --version

C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe

"C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe"

C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe

"C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe"

C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe

"C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe" -help

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\vcftools\vcf-consensus" -help

C:\Program Files\Unipro UGENE\tools\blast\tblastx.exe

"C:\Program Files\Unipro UGENE\tools\blast\tblastx.exe" -h

C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe

"C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe" -h

C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe

"C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe" -h

C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe

"C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe"

C:\Program Files\Unipro UGENE\tools\blast\blastn.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastn.exe" -h

C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe

"C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe" --version

C:\Windows\system32\cmd.exe

cmd /c ""C:\Program Files\Unipro UGENE\tools\mfold\mfold.bat" -v"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cd

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe

"C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe"

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe

"C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe" -e s@/$@@

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Windows\system32\cmd.exe

cmd /c ""C:\Program Files\Unipro UGENE\tools\mafft\mafft.bat" -help"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cd

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\lib\mafft\version.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\lib\mafft\version.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\expr.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\expr.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\env.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\env.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\mktemp.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\mktemp.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\rm.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\rm.exe"

C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe

"C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe" --version

C:\Program Files\Unipro UGENE\tools\hmmer3\hmmbuild.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\hmmbuild.exe" -h

C:\Program Files\Unipro UGENE\tools\hmmer3\phmmer.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\phmmer.exe" -h

C:\Program Files\Unipro UGENE\tools\blast\blastx.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastx.exe" -h

Network

Country Destination Domain Proto
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 8.8.8.8:53 www.dnaminer.com udp
US 199.59.243.226:80 www.dnaminer.com tcp
US 8.8.8.8:53 snpeff.sourceforge.net udp
US 172.64.150.145:80 snpeff.sourceforge.net tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 130.14.29.110:443 www.ncbi.nlm.nih.gov tcp
US 8.8.8.8:53 ugene.net udp
US 185.199.110.153:80 ugene.net tcp
US 185.199.110.153:80 ugene.net tcp
US 8.8.8.8:53 api.ugene.net udp
RU 95.170.150.116:80 api.ugene.net tcp

Files

\Users\Admin\AppData\Local\Temp\nsd2BD3.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

\Users\Admin\AppData\Local\Temp\nsd2BD3.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

\Users\Admin\AppData\Local\Temp\nsd2BD3.tmp\nsDialogs.dll

MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

C:\Program Files\Unipro UGENE\plugins\biostruct3d_view.license

MD5 ffa10f40b98be2c2bc9608f56827ed23
SHA1 dc8f2e570bf431427dbc3bab9d4d551b53a60208
SHA256 189b1af95d661151e054cea10c91b3d754e4de4d3fecfb074c1fb29476f7167b
SHA512 1420da3215ed30afcf413935e20404cabe0723822c728ea29dcb9699533355ef1bee17660facdb55655241c2db30a7314d8ad6a4a3f72576b2721f522d487aa9

C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe.manifest

MD5 7cb71b006fcdcf8ade80e31fd5ab8060
SHA1 655380fb2cca01b0ca707f748fc7dcf006732518
SHA256 be8918559280a2e74748bf8f6238b568ed7cbf75183b2180a6a8a979a1ebf243
SHA512 ce095bb84dbf2e72304471f97e80799185fab42b843f95bd84df4b97764786687807f057dc4434287c8982937329e664f7de476445ff6e2cbf298d7a44b48d55

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\share\mfold\sint6.dg

MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb

C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip-23.2.1.dist-info\top_level.txt

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Program Files\Unipro UGENE\tools\trimmomatic\LICENSE

MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\nb.pl

MD5 66ed114afca8e09fa9af4c7011abaa0e
SHA1 93c34030bb195a3b9334230de8a7970adfa9ef72
SHA256 a8ca3f8067a7215ec8f168a2bffe0846d1024a9138626f88e048dbb5b112c93f
SHA512 90762b4df5ae25ee36bd3571437301179de15454c8ebdf5758acb86fe391cd17af4fe5fd05e1bc6be5a52e8b1a8b0986c43f86dd0ace5479083daaa7564918ab

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\myps2img.bash

MD5 e3056941bd15507718d2d4b9e808c7d0
SHA1 de9ff3fc12304d4060e2a1d40b98e6b73cf03eef
SHA256 63f155ef26f370f8e7fde423288028f355798e0923f242831d5c2c56f8ce2374
SHA512 ee85f34ca427f2413e73e93e0a41004ba2a7e072b21efedf891fafa3857c4ef7aec48c77b340f5d66619fad2a87cac2599f52deb984ce2cb59665f1a275dbe84

C:\Program Files\Unipro UGENE\tools\java\lib\images\cursors\invalid32x32.gif

MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

\Program Files\Unipro UGENE\ugeneui.exe

MD5 e507b1eb783b3d0c66b87bee96720b0a
SHA1 3718357ba806e220056bc08f2186e33c2f646653
SHA256 9175593c40d4190821d325d5f9dc7274c83db687c0280eb253be4b858ef5ebb1
SHA512 d7856b3d813669cfaa52ad1fb39a6302764e1d0969d10103087401b07b41bf97df2f5bb2798bd022ef1ce886c892d887218851fcf7ab1a2ce7d961f0fc777eac

\Program Files\Unipro UGENE\Uninst.exe

MD5 17baabed1288e8c0f8e3ff152804aa89
SHA1 13cbfab9cf10e041cb4d4450b2b51800abaacc33
SHA256 5befc3ef39d7b4603122d5adc8600f63ae3333f1c8f1807addab4f5464e3f439
SHA512 e3246b060be76bbc8bf9b06f4da88aa6b06c017a103fc2a7f2f9d92dbf07371a4a41da2d927e4702d26bed73e89f6723c41a11593cc587a70202fe4b867f721a

C:\Users\Admin\AppData\Local\Temp\nsd2BD3.tmp\modern-wizard.bmp

MD5 59ed2684c564aa9dcb6859342a97b960
SHA1 d7ca551a1340e2a31106171ead92631e79983949
SHA256 d238273737a291fb4129e33415cb66131756782428b86fe13894d8bf1b4abb7c
SHA512 c41433f1baf5b1826496ab9146be1b9e45e1f6208a74b54120cf421fee51900409fbc92e978d9213d4c0dcd0e937c390f782e787d8d7032fae62e1d957a3e9f6

C:\Program Files\Unipro UGENE\U2Core.dll

MD5 cf0b4dd5e62ae168240d1ee781a83272
SHA1 92a9e14e5bec4dab9937f4cd8f6b37a8418a41ef
SHA256 1708ae798ed3a23e46b78364192464169ac19bd16635e9e1616d52bec4034b9d
SHA512 6029ef124a0f3bd9e2741e17133c0df861f64fcad5d4ac75b2d2a1013a3228836c8d7e584552ef295607f5518f516d3dc0b15c53a4caf914ecae6921a476a844

C:\Program Files\Unipro UGENE\VCRUNTIME140.dll

MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

\Program Files\Unipro UGENE\ugenedb.dll

MD5 4ebdabc471eb9d7123780c103a7c63db
SHA1 4c01c79349e2d7d9eb69d3fbd91b04b542da6178
SHA256 703f7eecd05756411544f09ce8e6f195c9134799b1044a4e4ddf159eebd417f0
SHA512 e25809348511b2cb14f7662ad3829845f7a72e16c8730b018882e61358778938faa9d3cd02585e4226d4a5bedcb56fa8be35a14bff87c9ec48f2fce5deee0d26

C:\Program Files\Unipro UGENE\Qt5Widgets.dll

MD5 6138dc6612f30a96f9918b012c867a89
SHA1 b43b0e1150656c96faafa748afa827774e7414e2
SHA256 40eed4076ccffabe5b7e1d00baa67b5845ca45db57771042ab59f677fd229870
SHA512 e61bc2c3682d1e017fd33046850b42e02c6babc7791ffdf405900164e58950fe8385b1514ff1ed3ea422b527fdbfd8705f357d16ff0f91ecab71d404af7d8590

C:\Program Files\Unipro UGENE\Qt5Gui.dll

MD5 3ace761376d23ea3bbb518fba9623160
SHA1 343c704a4c41400b2f52e97d1875065cc5431053
SHA256 5a8fdbc99b6ca04b47ae7d60366aa17a0c0282ab8751db1a4fef319f11204494
SHA512 a44f623039daad3ad49984868408480fcc66043c4f858b055aa40d64b63094a0787ca195fa71eb110f1e0c715f2e79e6808ebe646a49822a2f759c60fc6b15be

\Program Files\Unipro UGENE\Qt5Core.dll

MD5 597ed85ad126dc292bd076e9a5b6608b
SHA1 51e896aaba471d1ce16ebc81a31098d218c28301
SHA256 d94c19a434e2fef17ca93ea1efdace37474dce9612e018e6b4c3694a7b4d2e77
SHA512 12643ed63cb93a96798c98948629e3513f1abeaa4b9eb08444d693ec3993273a669f523f139c84ff0b89beb0e7336778afbe37830d7b72bd9dda2c99e336e9d7

\Program Files\Unipro UGENE\msvcp140.dll

MD5 206afdd686e4f42e3a92e688d788cf0a
SHA1 b3178367052908ebd642ba485709a46b725fe73e
SHA256 db8b072cbcb18cf350b82c1731e75fc02b8bcc02fe22e28ddbc3485d65f3ecad
SHA512 a4dc319576a9ca4e6263f72b466749ba4150e5018602daa20b816ab461b45f19d4f9631d768fc48e975f04f791f0599f957e4220cec8128cc8e7ac96e33883bf

\Program Files\Unipro UGENE\vcruntime140_1.dll

MD5 21ae0d0cfe9ab13f266ad7cd683296be
SHA1 f13878738f2932c56e07aa3c6325e4e19d64ae9f
SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
SHA512 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

\Program Files\Unipro UGENE\msvcp140_1.dll

MD5 af3c0ba75cf280107d52aa33af926ae8
SHA1 444b89dbf382773e18e3fbc77b34817f4440160d
SHA256 758f38f7f87c7ee392297c6e742f52c966e963e1cd4d8262231548a2003ffd78
SHA512 c638e9f7973e409bf2e0e11bf4593376e234cd44f0e9cad499a6ff6e6e2dde06095e06ebaffdd02d4473d704006f242aa8b709d0ab97b32ec747d3f45ce93757

\Program Files\Unipro UGENE\Qt5Script.dll

MD5 15da266adbe5233583ba371977e0c3c8
SHA1 1c229360dbcb50c8de7217010cb1a3d6ab3e066d
SHA256 e19555cac5893d21813dd5610a62f14c6d6d463dfa70329b662134d7607f35c9
SHA512 e7e6fbab73e48b82e4ca3574da21e69547cef4815edb9f3233a0ad38a776f23e515cec0b497d6feb8ff4da33b371e0cf5fd04b2aa24c73b90733d99998ce8686

memory/3560-20254-0x000007FEF60E0000-0x000007FEF6621000-memory.dmp

\Program Files\Unipro UGENE\Qt5Network.dll

MD5 c8e8fbfa0b6b8d57c5a5705df5aa44cd
SHA1 f7d33ddcfb053318eac1ea7779ea4cd626465509
SHA256 80ff946325ae4c3160448cf7cf4a3585d3ab5a8546ab092588f429b1e6d4962c
SHA512 c601d871654d98fc8a16ac621cbd84360b792511c8a609da4024357782b9d11db11777d7ac55af1b1c778df0717d9630638aa77f172d4fcba22834d236a9cf0d

\Program Files\Unipro UGENE\Qt5Xml.dll

MD5 68cfd69993c8d7e12674a5b4b7f58759
SHA1 741c933e2334ca3bbf831848a27fccfffc32734d
SHA256 c9d4dbcb83dbbd0b220ac6d7b76a6cab046f38acda6bef6184785c616bd54185
SHA512 b4f8efdbc3d9266301d73d7ecec867b31084c2e35a97dad4d2b6a808719eaa53b8874f22084a814ec1075d127a057c5580c8c35ae3c2a16db9a5ab6f02a1a8dc

C:\Program Files\Unipro UGENE\U2Designer.dll

MD5 3bb593bca7763cefc3e4fe3634e8b908
SHA1 9b8cf8b2ad16e7551c5a7d6b7f8324ef620ac0c7
SHA256 a889b40319fee4720504fbfbc4517f743192cb793590b31b15ccb88dc70e9e27
SHA512 8928652c030c2b386819bd4a02242316649b5b6a9bcd944d516c5fda8e2def379774fd459791e9fda32617a4cf11b84bbf29a2d83cc7b4c3f29868ba1be22e6e

C:\Program Files\Unipro UGENE\U2Lang.dll

MD5 c8e767c575a4eb6b408cdafe90b701da
SHA1 6c44c6666c81d44dde591a2c16c5859898604b55
SHA256 e1f9d535128dd77895bca1ab8e224710aa5cd122a697c188957e4442024c855d
SHA512 8228710ce3c6e3e9e797469a9a2764e2d0c17b2439fe544239df6f883d820eb35e4f6c626015d3491cf889f6d645d22d3124588fb1eb1ace179dadd80bd58baf

C:\Program Files\Unipro UGENE\U2Gui.dll

MD5 d20f3cca7d3b32cf4a7695be2dbfda5d
SHA1 367ba3bcd7d17824ee3c1cbfa1acb711270f5be5
SHA256 1087ada7c96048ef5cbd0c58328f30b4ac62b76564ab57302a92fd857bc9a6ec
SHA512 7f467d84848f68d8c830069a2df176441a3950cafb5f75c661a48fa67ece7ed56013738d549e8b072c8969542fb7de02054e0e2d55ffc9b49259b2536cdbcd46

C:\Program Files\Unipro UGENE\U2Formats.dll

MD5 0ed34dd92eea1e4a73d6a4ed036e4683
SHA1 8d5a8b781f42070131dc40a8b80f81db8977497c
SHA256 36e79757bdfe9c9dfdd2f6920366540e346d2941bfc88ad99343aa6f3a88e010
SHA512 848b173e17ff3e550f39e88141472186c70cc24e635fbea367d30c8eaefe19f74cc6d15c685941ebc855ff2b82bb856b980101dd692eef02afdd6ad82f573965

\Program Files\Unipro UGENE\U2Algorithm.dll

MD5 63ebd8afed58315e4504ac3a687d9f3e
SHA1 84c78d1e315bbadcb65c46ba9d9bdd3733d04405
SHA256 eb54570ca630781dbf22315efac978c90e2ad6645274607863ff8a4f9d9ea31a
SHA512 39ee203b8514114002c620a2f7343e3cc63944cf8a5810bfc0a6c0d81f0d31ed51755907c5918e861b7a37b691f86254cd1ae561748525c2345d1456fabc8b8e

C:\Program Files\Unipro UGENE\U2Private.dll

MD5 bb18fe48e821e41b38b3b09ce921afb6
SHA1 e786a4b53e102b17ebac33b975959eb035035ca5
SHA256 6f747c9300b87c14f6e78bc05df910ef34927aa9c3d48fa7a62c8a7bd868f0eb
SHA512 5a3a0292fe0f415ff689d6e8a096994c0e6c8afaf01c0092190104fd8a84c0b702bc0bac0734f9a5c95af74ac31e9309a1a143741938aca008f419ce7179d2ed

\Program Files\Unipro UGENE\breakpad.dll

MD5 24c41de7e373ed3a12155e7c120303f7
SHA1 048ba3d6fd6f613138d7ef875c615ae9ef0b2b3b
SHA256 46c347eabff11a06b4cca30e17586d790115bceeb1d2bf4a3ba86e1aa0724629
SHA512 81e6017e38bd5ffb4c4a0c16394a959661f2d2dad388c664117e2f6e4945a107ae8f4a18faa68aa576aef83bd8ba07df7fb550b94ffe88f318d63acd8b581760

C:\Program Files\Unipro UGENE\Qt5Svg.dll

MD5 b0831355a9659174c7bdc7dfd729cf5f
SHA1 9831c5ff2f81c207e6788f7d2ae2bb05ea5be3c9
SHA256 7837ce9d8865b38da0177ff022a946a645edcd0e85e708b936ccb8430da39540
SHA512 65e39972339d7894f78bd55b7c5a3183954eee3057d4dcc00cc3bf1e91b22cfceffce7acba61bd43b3c572a5b00bdb0684779ad1a76f902405afa8f4eb06cb23

\Program Files\Unipro UGENE\Qt5PrintSupport.dll

MD5 2270a22b787010d0ab80f1469deed718
SHA1 bbf2b000d50069718cfd5c3ab092e7b91f93f921
SHA256 8943a4a305dd5119760639244185bb7c52327bf9341720f0e0e0b12a329e6472
SHA512 fcc2b1fe9682f4b4c99a8b3407c3963f5e6f754ed60c48137e854884a077fcdc79a9e0ef5bda1e467d3d49bb98995bf47e7262ea252bcb5b7f008838bf134eb6

C:\Program Files\Unipro UGENE\U2View.dll

MD5 13b304c3c3997810bad9a6efa0229db7
SHA1 2e0eaa35978e0c05c3e4faaaadcf87935fa31b1a
SHA256 cc302eac63869d7e5d0b821c33989e2df6d8601acf7a07fa0163d91e0875f4b4
SHA512 cbf0d2a0943a5e132cfb1589e3b06cdd51e0037a7041b498cccef1a22b07954f033a317d85e5222cb890f2ee2ca89616e76e7480eb18c0a4ffa482cc33d86530

\Program Files\Unipro UGENE\U2Test.dll

MD5 a3f6b9b1c7e77b850286a2498335ffcb
SHA1 b8c3cc3641609973a5dbcf03792718e1de31b670
SHA256 24eb55db639de9bfd9f56a17f36751c3f58df6fcf678298102b71f875e7f035e
SHA512 604bb9b8a6296ef07f87f8443c7a7d99439600dfcf0ce61f2b1a20799f0182b37b276687e1a9701e8b3493feddb61494287c5ce942c31c4e94d3505a7f856b14

memory/3560-20283-0x000000013F4E0000-0x000000013F68A000-memory.dmp

C:\Program Files\Unipro UGENE\platforms\qwindows.dll

MD5 ba0bb2d62821ee94ef6b5a49ddbbc42d
SHA1 165ff4991147c5314b80e62ca541c4cbc5424732
SHA256 47ca0ca24888eb3fbffac490cbb8c15f0444959f50c8a99b361e4ae54de836de
SHA512 fee807c7172144ff30e9ea18384ec0e722c8ec5b0f5ca8414aa47e3c8ecc16cb18319826dc3d4191dd1e146840719851a9116881eac4ed9834bd3f5db4f550d4

memory/3560-20285-0x0000000000510000-0x0000000000520000-memory.dmp

C:\Program Files\Unipro UGENE\styles\qwindowsvistastyle.dll

MD5 2578e128acd8a6ef5fc5a5f46aa43fd8
SHA1 0c4f5b66ba6340376bca7f1b143fe6d13b407074
SHA256 11089f156619ee6644a50c961c1b8b278f905e61e1f9979f8965bc3e17a06ead
SHA512 6e2d95d23bc32acc96f10d959e4a7e5a8357ad6d638d6fb502683c7e4b4ba503a6a55ca902c77fb75b636cd7cac3aa4e261ba87d0ae9e1e4d8076e4e124cc4e4

C:\Program Files\Unipro UGENE\imageformats\qgif.dll

MD5 2dca355bf20dae868b4b5c5e03c4ee7e
SHA1 36d635bf22b8db514917080e70d849f24da485b4
SHA256 1ad13a3a59210c9e9d6846ddd8caf73d92016993b1591722c8654aec412604bb
SHA512 64ab1b06ad0d2cb5394bad15068768b8ff39b9e957fba73675c442714ed74eabdbb58b6b3af1a8cd13b121861a99783f92abadc491b93c9780c7bb33df6ce70b

C:\Program Files\Unipro UGENE\imageformats\qjpeg.dll

MD5 8dd6bbf14f309f562f6cd1bfaf041fd7
SHA1 dbe4af501cd268641abb49aba596137b92ef3a11
SHA256 20d8f15c7547fb40bf5cae8bec3f880c782cdb7859227fa7a7ddf62236f19d84
SHA512 6dec359a4b37aebda328f782f6e790bdeb3b8b7c695b88dbc26a24776917834d738dc276198c102a35a81771af162d74633ef7aa8b901c74f8ed0244b89622c3

C:\Program Files\Unipro UGENE\imageformats\qsvg.dll

MD5 8d424052cd49d47ba649d9f6299fc64e
SHA1 7622e6207aca419f192b252a5ad3d737e37f15a4
SHA256 2f04b1cdc48710d6c56f968e2e9107f5c271695f4d04c652b118defa83187083
SHA512 47a32ae9583867c986a88af0e436668d69063035fecdecb119951d33da5d636d8b3c0073d82cad11960c5b0de3859870a0c08896d80f650a0a37ac79789667be

memory/3560-20292-0x0000000001E10000-0x0000000001E1A000-memory.dmp

memory/3560-20293-0x0000000001E10000-0x0000000001E1A000-memory.dmp

memory/3560-20298-0x000007FEF3760000-0x000007FEF3A75000-memory.dmp

memory/3560-20309-0x000007FEF3260000-0x000007FEF3317000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.lock

MD5 41711a84eb6d1a552f29600249823bdf
SHA1 b00a9599b9d2749b0fce606a055224ea87242c05
SHA256 3e5e1f6b8837b433cfc3565cf80411f8dc01c59ddc51c99835802a765c363834
SHA512 df5e48f7edb820d396cab304290fcd2e85a375f0da32d283b3c79c9f92d85d4f1423166439dd9fe4191e299bc78fe97648e4dbc37da92e55643784d108e63c73

memory/3944-20327-0x000007FEF4B30000-0x000007FEF4D78000-memory.dmp

memory/3784-20342-0x0000000100400000-0x0000000100478000-memory.dmp

memory/3784-20344-0x0000000100400000-0x0000000100478000-memory.dmp

memory/3784-20347-0x00000003FFB70000-0x00000003FFB8A000-memory.dmp

memory/3784-20346-0x00000003FE760000-0x00000003FE77E000-memory.dmp

memory/3784-20349-0x0000000180040000-0x0000000180650000-memory.dmp

memory/3784-20345-0x0000000180040000-0x0000000180650000-memory.dmp

memory/3784-20348-0x00000003FE970000-0x00000003FEB19000-memory.dmp

memory/328-20358-0x0000000000400000-0x0000000000429000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 22d343b7164681654ce4917d8a8a4992
SHA1 9decb02fff290c58f17a32efcfc972559a0f4797
SHA256 ba587af36237ce6874407fe95780c45f5a7b14dbcbe7df52d3e03a9e4f1dbc7d
SHA512 03c5d9a7dbe170e39214c952fd17a86bd4bd6b9f716a26e01a44e4a2fe99084f1bf074ec734653f7a0e45c8afba02d7e2f785a3bd5b7e5271fcd746ecdb54ce6

memory/328-20359-0x000000006DAC0000-0x000000006DC9D000-memory.dmp

memory/656-20374-0x0000000000400000-0x0000000000429000-memory.dmp

memory/844-20373-0x0000000100400000-0x000000010056C000-memory.dmp

memory/844-20377-0x000007FEEFC50000-0x000007FEEFF52000-memory.dmp

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

MD5 87b3b15fdaf99a549899325c55b079ea
SHA1 7564aac91fb1fc17ca445caa6531be375b170b3f
SHA256 a6c341a9e3d423ea4f130f44d1904a7768e6963a045425796aa8475df899a15e
SHA512 efbd2173782173c47f8575804c23d59a0e83ef500563847b4e85ae291dbec4dd8f8df2ee5c0cae02a863847fbe7abd519b82ab0add8cfea412cb25482ecfad39

memory/656-20375-0x000000006DAC0000-0x000000006DC9D000-memory.dmp

memory/984-20399-0x0000000180040000-0x0000000180650000-memory.dmp

memory/1760-20407-0x0000000180040000-0x0000000180650000-memory.dmp

memory/984-20406-0x0000000180040000-0x0000000180650000-memory.dmp

memory/984-20405-0x00000003FE970000-0x00000003FEB19000-memory.dmp

memory/1760-20414-0x00000003FE970000-0x00000003FEB19000-memory.dmp

memory/984-20404-0x00000003FFB70000-0x00000003FFB8A000-memory.dmp

memory/984-20401-0x0000000100400000-0x0000000105A7A000-memory.dmp

memory/984-20403-0x00000003FE760000-0x00000003FE77E000-memory.dmp

memory/1376-20417-0x000000006DAC0000-0x000000006DC9D000-memory.dmp

memory/1760-20415-0x0000000180040000-0x0000000180650000-memory.dmp

memory/1376-20422-0x00000000707C0000-0x00000000707D0000-memory.dmp

memory/1376-20421-0x0000000064400000-0x000000006440D000-memory.dmp

memory/1376-20420-0x0000000063880000-0x00000000638A2000-memory.dmp

memory/1376-20419-0x0000000066E00000-0x0000000066E0E000-memory.dmp

memory/1376-20418-0x0000000062580000-0x000000006258F000-memory.dmp

memory/1760-20408-0x0000000100400000-0x0000000105A7A000-memory.dmp

memory/1376-20416-0x0000000000400000-0x0000000000429000-memory.dmp

memory/1952-20433-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/1952-20437-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/1952-20436-0x0000000180040000-0x0000000180650000-memory.dmp

memory/1952-20434-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/1952-20442-0x0000000180040000-0x0000000180650000-memory.dmp

memory/112-20463-0x0000000000140000-0x0000000000141000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 6703057d0e61ef43cd7de76b75ab3b9c
SHA1 5539438c9e65a3b361b68ec181ab58525e9ffb05
SHA256 7477e3445005246e0011bff2f27a3ac7258a897b3d0c4990860d71d3be398d85
SHA512 ae744fdb32391e9d9eb38c39576c58608dd25fa39cbc8162ac11c8d59c64cb7c83f4136608a91fff638183414a85ecc8ec7dd3ef40818bbb88988ce87009c186

memory/2684-20483-0x0000000000140000-0x0000000000141000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 e12b79b6ed4b4342d2054aac08966418
SHA1 cf3299b34ab4d7f0b03c5187635703d5768ff3b2
SHA256 0303a3b811df6a2aa65219a0e78c19aa184fdad0d54a26853f04cb0245e691f6
SHA512 bffcf148a58827d5e59ed2dd74668fe2907555286c272af2acd6ff9d36b010dc14fb3f817763ee39396ed46319845bff2b80b65d45837e521f2f2fe19cb715ea

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

MD5 cab437a45738692b65dd5f822c30794d
SHA1 5a6800a0c6bd0bfa6cee10eade8e43b2107461db
SHA256 a668db19cf5eb8944ed6343aad9409f1ab9e2b6731a9fb298f087c0d0156f7e5
SHA512 1bd5c938ff5b15043f2caac4fa031e9e304ca56674e4cfafa801721a3249dd2ed1001afe482cfd70a940617c492456cf1cc3a703206ad7449e47bc35e9866a97

memory/2032-20502-0x0000000000250000-0x0000000000251000-memory.dmp

memory/1500-20536-0x0000000000140000-0x0000000000141000-memory.dmp

memory/1500-20542-0x0000000000140000-0x0000000000141000-memory.dmp

memory/1076-20544-0x0000000180040000-0x0000000180640000-memory.dmp

memory/1076-20549-0x0000000100400000-0x000000010049B000-memory.dmp

memory/1076-20555-0x00000003FE740000-0x00000003FE75D000-memory.dmp

memory/1076-20552-0x0000000180040000-0x0000000180640000-memory.dmp

memory/2332-20554-0x0000000070840000-0x0000000070855000-memory.dmp

memory/2332-20553-0x0000000062580000-0x000000006258F000-memory.dmp

memory/2332-20551-0x000000006DAC0000-0x000000006DC9D000-memory.dmp

memory/2332-20550-0x0000000000400000-0x0000000000429000-memory.dmp

memory/2484-20547-0x0000000001B70000-0x0000000001B71000-memory.dmp

memory/936-20570-0x00000003FD120000-0x00000003FD2DD000-memory.dmp

memory/936-20569-0x0000000100400000-0x0000000100546000-memory.dmp

memory/936-20567-0x0000000100400000-0x0000000100546000-memory.dmp

memory/936-20597-0x0000000180040000-0x00000001805E0000-memory.dmp

memory/3560-20634-0x0000000000510000-0x0000000000520000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 96f2482e533dc66e846819d6ac2e94a2
SHA1 e427f37786fbdeb8b83672c1faa3e99c2cb75f49
SHA256 1b1efda218ea966a1982153ee23d87527d19cb9f4ed22a8e1713c2fe034e0e87
SHA512 1aed91fb45162abfbe9c4873ff32ede36b94b9bd98a2532e3eea726d2c146d1950fd24038bd53b920a0edbeec6c670d323d1965cf020447b5a66472ccb9fd82b

memory/3560-20645-0x0000000001E10000-0x0000000001E1A000-memory.dmp

memory/3560-20646-0x0000000001E10000-0x0000000001E1A000-memory.dmp

memory/3784-20647-0x0000000180040000-0x0000000180650000-memory.dmp

memory/3888-20682-0x0000000180040000-0x00000001805F0000-memory.dmp

memory/3848-20701-0x0000000180040000-0x0000000180650000-memory.dmp

memory/2776-20730-0x0000000180040000-0x0000000180640000-memory.dmp

memory/1880-20759-0x0000000061000000-0x0000000061450000-memory.dmp

memory/2352-20772-0x0000000180040000-0x0000000180650000-memory.dmp

memory/936-20777-0x0000000180040000-0x00000001805E0000-memory.dmp

memory/2004-20778-0x0000000180040000-0x0000000180640000-memory.dmp

memory/2248-20861-0x0000000180040000-0x0000000180650000-memory.dmp

memory/2248-20862-0x0000000180040000-0x0000000180650000-memory.dmp

memory/2824-20875-0x0000000180040000-0x0000000180344000-memory.dmp

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

MD5 490a9fae59062d20a29b849ba21f6760
SHA1 60c83b3b5f5f3ccc24740caa125015ae30872197
SHA256 ece759740a984f3a068483fb1eb71e912876421e1c5ae18e004af34f1dea538f
SHA512 05a3ec19e05dc48c968f6ce967ac85dd6681821bf79152b94e153a14530985564eec9279f8a261956abfe6cec0a2e1b9f89e3f146c23ec5c53610b6ca318c208

memory/2988-20880-0x0000000180040000-0x0000000180344000-memory.dmp

memory/1200-20924-0x0000000180040000-0x0000000180344000-memory.dmp

memory/1312-20903-0x0000000180040000-0x0000000180344000-memory.dmp

memory/2988-20912-0x0000000180040000-0x0000000180344000-memory.dmp

memory/2764-20906-0x0000000180040000-0x0000000180344000-memory.dmp

memory/1972-20899-0x0000000180040000-0x0000000180344000-memory.dmp

memory/2824-20930-0x0000000180040000-0x0000000180344000-memory.dmp

memory/2776-20941-0x0000000180040000-0x0000000180640000-memory.dmp

memory/3848-20940-0x0000000180040000-0x0000000180650000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.eaXbuV

MD5 e3a732e118e7a9a9c489a82d67c37598
SHA1 2d16e36110709c47b1696ca91581367cfc078b9d
SHA256 8f7ac25037491da844254fff1afa9c02223e6daa2024b952c96588bc9a7ab2d2
SHA512 f149535861239f76c445e4f334a5c785104abfdf8f67f6ff67d8c1948ded5f3fd7c40dbe027a8b2bf58dc5158bc477f261cacc00e32d65581e0e3f70681a0d77

memory/2764-20890-0x0000000180040000-0x0000000180344000-memory.dmp

memory/3888-20889-0x0000000180040000-0x00000001805F0000-memory.dmp

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

MD5 9de1b7aaa1702506f2877b536e28b1ce
SHA1 bbc25e35d240c25be44b499c5d64cc703d3313df
SHA256 8cb0d8a627df2894665b78a64c153de8441b341722ddea0c42285449ae0a322e
SHA512 b6997e7ea41449896afd86b96a2cb5c7095d9eebd80294feceb1f4cd33335918b0eaa3bb716f1c03f489e9acac4faa370e0bb6ed27969602faf68cbcd593b1fd

memory/1880-21487-0x0000000061000000-0x0000000061450000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 48be416f46cf3d1069a78b439b4c273e
SHA1 c14ecd5cbedaa5a6990faf4d42204515ba69c2d0
SHA256 14ac12571d6468005dae33277a9bb47f40cf03f65dd6b2b38770a2aa61470a3e
SHA512 49bf6e89251f0ee7a07b1943b6afb879449d974df61074d76981dae279df46cfc98781b455c41ac8b737791c66d7c324675279acaf43cef3149083df41092d11

memory/2352-21499-0x0000000180040000-0x0000000180650000-memory.dmp

memory/1972-21500-0x0000000180040000-0x0000000180344000-memory.dmp

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240611-en

Max time kernel

299s

Max time network

326s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tokenize.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
NL 23.62.61.131:443 www.bing.com tcp
US 8.8.8.8:53 131.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 19.53.126.40.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 71.242.123.52.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

ubuntu1804-amd64-20240611-en

Max time kernel

0s

Max time network

268s

Command Line

[/tmp/tools/python3/Lib/trace.py]

Signatures

N/A

Processes

/tmp/tools/python3/Lib/trace.py

[/tmp/tools/python3/Lib/trace.py]

/usr/local/sbin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/usr/local/bin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/usr/sbin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/usr/bin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/sbin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/bin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

/snap/bin/python3

[python3 /tmp/tools/python3/Lib/trace.py]

Network

Country Destination Domain Proto
US 151.101.129.91:443 tcp
GB 195.181.164.20:443 tcp
N/A 224.0.0.251:5353 udp
GB 185.125.188.61:443 tcp
GB 185.125.188.62:443 tcp
US 151.101.129.91:443 tcp
US 1.1.1.1:53 connectivity-check.ubuntu.com udp
US 1.1.1.1:53 connectivity-check.ubuntu.com udp
US 91.189.91.48:80 connectivity-check.ubuntu.com tcp

Files

N/A

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:06

Platform

debian9-armhf-20240611-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240611-en

Max time kernel

130s

Max time network

276s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.177:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
NL 23.62.61.177:443 www.bing.com tcp
US 8.8.8.8:53 177.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 1.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240221-en

Max time kernel

290s

Max time network

318s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 53a02c0b513c43f3402bc9d36ed359a6
SHA1 d4ec9c676589d209dd20c7aeba6e5cc95463b005
SHA256 d488e03767ac400d8530972ab3143f1c3f43bbd17b4588899947042358d0559d
SHA512 dc44145009e43a0156969e20d3734d930c72f879620c17adc910ca405a969dcfe37b4d331504e9adee47247165af5b905f4ca02d22ff4087a4b6da129fa444d0

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:07

Platform

win10v2004-20240226-en

Max time kernel

255s

Max time network

365s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\threading.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 79.121.231.20.in-addr.arpa udp
GB 96.16.110.114:80 tcp
US 13.107.253.64:443 tcp
GB 172.217.169.74:443 tcp
US 8.8.8.8:53 57.234.16.2.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 67.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 99.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:06

Platform

win10v2004-20240226-en

Max time kernel

258s

Max time network

365s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 20.231.121.79:80 tcp
US 13.107.246.64:443 tcp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.178.89.13.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 172.217.169.74:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 74.169.217.172.in-addr.arpa udp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240611-en

Max time kernel

131s

Max time network

283s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\textwrap.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.139:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
NL 23.62.61.139:443 www.bing.com tcp
US 8.8.8.8:53 139.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 107.116.69.13.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win7-20240221-en

Max time kernel

291s

Max time network

318s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 0eaf07e46d12d19acd99992f5789d33c
SHA1 873f0694b7622681c10d3d99f623c490db8e8246
SHA256 e04a42b4b1972aca8785fc5be49a8d8db9663b711d89e2e3a6687736a22297cc
SHA512 dc932c5403f496568cc37dfd5cdfb05f326417cb3199ddfa87dd12a23d2e5c625ad52b45bfd019698fa2f6950d1069dfb1a41f548b8d283e19c719de34535efb

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240611-en

Max time kernel

129s

Max time network

195s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\token.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
NL 23.62.61.192:443 www.bing.com tcp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 192.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 203.142.123.92.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp

Files

N/A

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240611-en

Max time kernel

138s

Max time network

206s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:04

Platform

win10v2004-20240611-en

Max time kernel

131s

Max time network

269s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-200405930-3877336739-3533750831-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tempfile.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.136:443 www.bing.com tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 136.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 65.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.210.23.2.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 12:46

Reported

2024-06-14 13:05

Platform

win10v2004-20240508-en

Max time kernel

298s

Max time network

322s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\this.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Files

N/A