Malware Analysis Report

2024-10-10 11:09

Sample ID 240614-qhxzbawckn
Target ugene-50.0-win-x86-64.exe
SHA256 a2792b8d2290310062cfa14c52036192f8359af62ee7ff3be63e86ddbf637d75
Tags
discovery
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral23

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral28

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral32

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral15

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral19

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral21

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral7

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral8

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral12

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral20

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral26

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral29

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral10

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral16

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral27

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral31

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral14

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral17

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral30

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral3

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral11

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral13

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral18

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral6

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral24

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral25

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral9

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral4

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral5

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral22

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

a2792b8d2290310062cfa14c52036192f8359af62ee7ff3be63e86ddbf637d75

Threat Level: Shows suspicious behavior

The file ugene-50.0-win-x86-64.exe was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery

Modifies file permissions

Drops file in Program Files directory

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Unsigned PE

Enumerates physical storage devices

NSIS installer

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Opens file in notepad (likely ransom note)

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: AddClipboardFormatListener

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 13:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral23

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win7-20240611-en

Max time kernel

598s

Max time network

620s

Command Line

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\tools\python3\NEWS.txt

Signatures

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\tools\python3\NEWS.txt

Network

N/A

Files

N/A

Analysis: behavioral28

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:59

Platform

win10v2004-20240508-en

Max time kernel

502s

Max time network

534s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python3.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python3.dll,#1

Network

Files

N/A

Analysis: behavioral32

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 14:01

Platform

win10v2004-20240611-en

Max time kernel

433s

Max time network

453s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe

"C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 129.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 145.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 205.201.50.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral15

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:54

Platform

win7-20240508-en

Max time kernel

597s

Max time network

616s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 de3954acdc2bb5e6505c2b54b43b78f6
SHA1 13ac7d34243170a71636c05318d6d1e3d3368ca5
SHA256 8a999c47e2f5ba3c4991adaebf328f54d6cb5beae8ae6f786ce26eded571941f
SHA512 72a82357299eb91b9abc8a8170a7a81e71bee1fe6c69165838def9df5c2483560af78ac6d2720f2344c793a828e9ea63590616809841e2fc4e60cb0e95512cb9

Analysis: behavioral19

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win7-20240611-en

Max time kernel

599s

Max time network

617s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 0e4738926d5ca7b19e8e8983b088265f
SHA1 141e02393f804a0f0f51fc9f43d7b87bf0bcfe45
SHA256 70bec6b9089a8a1878f0341d92524289ab3ac986184821e412cc4356d195c617
SHA512 7ded1282546b3dec9cacd5fec676a6017c21f0ea4148518a5dbd36927e422775398a82feeab602426da6a9fe4cf148f6fda951f97d808693457eb3c842a7698d

Analysis: behavioral21

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win7-20240611-en

Max time kernel

597s

Max time network

619s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1340930862-1405011213-2821322012-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 f24b7a6aee30724beed101f6487f3520
SHA1 f921465fb2c7c37e0a63ebaa132997e837af2b72
SHA256 fdf7ba2a0c1bdb4c15e4474fa41ae9862c62cde59a39787c44e3b2dcff677eb4
SHA512 1538cd4aad5f2e8883be6e2c162a4c0211c51fa06fc0b084543c1e013e41fdbe9155b0275598e41e44f429c5266d2876310aebbcf821ae86cd972f1ab4c83a13

Analysis: behavioral7

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:45

Platform

win7-20231129-en

Max time kernel

599s

Max time network

617s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 02549bd99ae8813d6548d35cd4951da2
SHA1 bd470bc7fa50634a85d73e747dab8fd1d94c98bd
SHA256 4c48762df6386d4260cdaa7f035b4309c45fff804c74e3c38f8eb86c91660e88
SHA512 a5bdda92cb8d67ef37a9e36a003e9ef2d27c803bbb4cd5aae8790114ebcdb9627684dd37f74dcea9f99881e68220486298eb7be457058d0283afaf51da7fa910

Analysis: behavioral8

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:48

Platform

win10v2004-20240508-en

Max time kernel

443s

Max time network

473s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\turtle.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral12

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:53

Platform

win10v2004-20240611-en

Max time kernel

424s

Max time network

452s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.194:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 47.23.48.23.in-addr.arpa udp
US 8.8.8.8:53 94.65.42.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral20

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win10v2004-20240508-en

Max time kernel

514s

Max time network

546s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\wave.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral26

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:56

Platform

win10v2004-20240508-en

Max time kernel

463s

Max time network

497s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe

"C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral29

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 14:00

Platform

win7-20240508-en

Max time kernel

598s

Max time network

616s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python312.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python312.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:37

Platform

win7-20240611-en

Max time kernel

362s

Max time network

379s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

Signatures

Enumerates physical storage devices

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\nstA797.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

\Users\Admin\AppData\Local\Temp\nstA797.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

\Users\Admin\AppData\Local\Temp\nstA797.tmp\nsDialogs.dll

MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

Analysis: behavioral10

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:50

Platform

win10v2004-20240611-en

Max time kernel

420s

Max time network

449s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 131.253.33.237:443 g.bing.com tcp
BE 88.221.83.200:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 74.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 249.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 237.33.253.131.in-addr.arpa udp
US 8.8.8.8:53 200.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 95.143.109.104.in-addr.arpa udp
US 8.8.8.8:53 105.193.132.51.in-addr.arpa udp

Files

N/A

Analysis: behavioral16

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:54

Platform

win10v2004-20240508-en

Max time kernel

429s

Max time network

462s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uuid.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral27

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:59

Platform

win7-20240508-en

Max time kernel

597s

Max time network

616s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python3.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python3.dll,#1

Network

N/A

Files

N/A

Analysis: behavioral31

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 14:01

Platform

win7-20240221-en

Max time kernel

592s

Max time network

617s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe

"C:\Users\Admin\AppData\Local\Temp\tools\python3\pythonw.exe"

Network

N/A

Files

N/A

Analysis: behavioral14

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win10v2004-20240226-en

Max time kernel

524s

Max time network

659s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4104 --field-trial-handle=2280,i,11703952675008463361,17436195144517971517,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
GB 23.44.234.16:80 tcp
US 13.107.253.64:443 tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
NL 52.142.223.178:80 tcp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 129.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 10.179.89.13.in-addr.arpa udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
US 8.8.8.8:53 chromewebstore.googleapis.com udp
GB 142.250.200.42:443 chromewebstore.googleapis.com tcp
US 8.8.8.8:53 42.200.250.142.in-addr.arpa udp

Files

N/A

Analysis: behavioral17

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:54

Platform

win7-20231129-en

Max time kernel

597s

Max time network

618s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 c7103ee540d2473536a31cdb930fbb5a
SHA1 a69ac6e09bfedaa1fe702dfc6fb0851f97eb683a
SHA256 8ceabfca492a9afb8f0fae035a91a917b4432a5a52dd6f6d25f6b0d39bd3c9a0
SHA512 7d6f4c1d8793b23b88b39db8da6be447809682de9fc464bbb6fcae0f93aaedd0434f6cf652f582e045bdfa502d818f8a3ddcf13a0864ab840b6de2ddad33e14c

Analysis: behavioral30

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 14:01

Platform

win10v2004-20240611-en

Max time kernel

378s

Max time network

431s

Command Line

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python312.dll,#1

Signatures

N/A

Processes

C:\Windows\system32\rundll32.exe

rundll32.exe C:\Users\Admin\AppData\Local\Temp\tools\python3\python312.dll,#1

Network

Country Destination Domain Proto
US 20.189.173.13:443 tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 196.131.50.23.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 76.234.34.23.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 41.23.48.23.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 213.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral3

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:38

Platform

win7-20240508-en

Max time kernel

597s

Max time network

617s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 9cb6f05eb0e89d04c01f0e22ca7d503d
SHA1 7e9b4659ded2407f690fe0d369934f7da731d726
SHA256 41adcce6b4b85e6c198b6add660f6b409b39667199f72bfdfdcf4f82f5968459
SHA512 e63b27eea6f82b8c11a9c8b3ef4548282d5f8be8ee1e145a6c3ba6ddff5dd3a7f365fb154fc0f757e5ded966363bb5a99a63b92d0c91543e3480a4bee5313f63

Analysis: behavioral11

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:51

Platform

win7-20240508-en

Max time kernel

597s

Max time network

619s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\typing.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 7d1cbeec08cb5e3938c6356cf460fa11
SHA1 19613278fc490ca1bff6946dc60ae6a53397e463
SHA256 a7762ba10117e7ad6b2ac40b834690a2351abb25ea979db95be4f00f8342e8cb
SHA512 7a9f15f31aaa216e2bd31321f1579900fa60620b7964a40a41ce65e52f93e8a72721d38432868019622667d8693b942049ef559acf356e2e699cbd73666b1a11

Analysis: behavioral13

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:53

Platform

win7-20240611-en

Max time kernel

599s

Max time network

617s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\uu.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 fbd39024e7a999e7ddac2ce46e8a9a27
SHA1 6e47ff6ba79bef500208169b1b4eeb4955b86ce6
SHA256 e376cc6860041f6bf8e4cd959d347dd4a1858940c97d94331849e4f481d551b8
SHA512 921e45466e4d743261dafeea1cfcccedda46e22be239a63e6b3b0929201c6a20787999cea1ec9aaaf6ccc427e0ccf519ba49cee81deb5c7700a76ede9a41fb65

Analysis: behavioral18

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win10v2004-20240508-en

Max time kernel

583s

Max time network

617s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\warnings.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4228,i,5711962389779687290,1245653010537220991,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8

Network

Country Destination Domain Proto
NL 52.142.223.178:80 tcp

Files

N/A

Analysis: behavioral6

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:45

Platform

win10v2004-20240611-en

Max time kernel

434s

Max time network

457s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2080292272-204036150-2159171770-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 13.107.22.237:443 g.bing.com tcp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 237.22.107.13.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
BE 88.221.83.185:443 www.bing.com tcp
US 8.8.8.8:53 185.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 17.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 114.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 115.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 92.16.208.104.in-addr.arpa udp

Files

N/A

Analysis: behavioral24

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:56

Platform

win10v2004-20240611-en

Max time kernel

430s

Max time network

455s

Command Line

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\tools\python3\NEWS.txt

Signatures

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\system32\NOTEPAD.EXE N/A

Processes

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\tools\python3\NEWS.txt

Network

Country Destination Domain Proto
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 98.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 105.83.221.88.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 3.173.189.20.in-addr.arpa udp

Files

N/A

Analysis: behavioral25

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:56

Platform

win7-20231129-en

Max time kernel

595s

Max time network

621s

Command Line

"C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe"

Signatures

N/A

Processes

C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe

"C:\Users\Admin\AppData\Local\Temp\tools\python3\python.exe"

Network

N/A

Files

N/A

Analysis: behavioral9

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:49

Platform

win7-20240508-en

Max time kernel

596s

Max time network

616s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\types.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 d1f10ba15248880b20fc9dfb474b82a5
SHA1 cc3c6475df573df7171f0c147aebc734ab6cc841
SHA256 b8c5956af8fee13bd0e309fd7ae6a9dfa77099fd0a4d5563d2d9d037759f7087
SHA512 11e15156ff4cdb5c200f3c3bf0a2209366269d101afdc48571a1103e3e9cc91ece89c1670b1de6068bea3921e4e69983c3be6f334e3ed5b1aea29cf7ea2b6af1

Analysis: behavioral4

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:38

Platform

win10v2004-20240611-en

Max time kernel

420s

Max time network

455s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tracemalloc.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 2.17.107.122:443 www.bing.com tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 122.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 25.14.97.104.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

N/A

Analysis: behavioral5

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:38

Platform

win7-20240508-en

Max time kernel

596s

Max time network

616s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_Classes\Local Settings C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py\ = "py_auto_file" C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\ C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\.py C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read C:\Windows\system32\rundll32.exe N/A
Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell C:\Windows\system32\rundll32.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000_CLASSES\py_auto_file\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32.exe\" \"%1\"" C:\Windows\system32\rundll32.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A
N/A N/A C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Windows\system32\rundll32.exe

"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe

"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\tty.py"

Network

N/A

Files

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

MD5 068be31d665800781af81587deaa622a
SHA1 73a777a8e69b0c21e83a386cd33c6af29134b5b1
SHA256 7ad79e101ea64eff0e7ce1b8e37a93ff86f06ebdd77d2e8b812b1faafbbc6ad4
SHA512 06eae1dbb921956503138a89af3a109c6c8e03e5bb19521513336a96ca4f9d5e660887c3c273b1ea908ea6f905002f69c32469aa2e7613c3ead66739b85a76c8

Analysis: behavioral22

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:55

Platform

win10v2004-20240508-en

Max time kernel

478s

Max time network

510s

Command Line

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py

Signatures

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

Processes

C:\Windows\system32\cmd.exe

cmd /c C:\Users\Admin\AppData\Local\Temp\tools\python3\Lib\weakref.py

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp

Files

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 13:16

Reported

2024-06-14 13:29

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

Signatures

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A

Checks installed software on the system

discovery

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\pods\perlko.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\lib2to3\fixes\fix_operator.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\snpeff\scripts\gsa\bayesFactor_correction_scoreCount.sh C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\JASPAR\insects\MA0460.1.pfm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\lib\management\management.properties C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\dumpvar.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\Sub\Name\.packlist C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\Win32\Clipboard\Clipboard.dll C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\__pycache__\linecache.cpython-312.pyc.2663061435568 C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\GR09\Rds2.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\prokaryotic\NARL2.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\90msp-RKSJ-V C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Module\Runtime.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_vendor\cachecontrol\_cmd.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\prokaryotic\MELR.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\InPC\TopAndL2.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_internal\network\auth.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\Cell08\Hmx3_3490.2.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Font\C059-Roman C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip\_internal\index\package_finder.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\GR09\Oaf1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\prokaryotic\TORR.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\Adobe-Japan1-2 C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Perl\Critic\Policy\Variables\ProhibitReusedNames.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\ast.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Encoding\CEEncoding C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Compress\Raw\Zlib.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\isal\_isal.cp312-win_amd64.pyd C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\snpeff\examples\intervals.bed C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\json\__pycache__\encoder.cpython-312.pyc.2556848874256 C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\en-ER.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\To\Bpb.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\position_weight_matrix\UniPROBE\Cell08\Lhx5_2279.1.pwm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\Atlantic\Azores.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Manual\Attributes.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Meta\TypeConstraint\DuckType.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\ca-ES-VALENCIA.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\Asia\Yerevan.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Meta\Method\Accessor\Native\Hash\shallow_clone.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\is.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\TimeZone\America\Indiana\Vincennes.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\importlib\resources\readers.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\Nv\7.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\java\lib\deploy\messages.properties C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\CMap\UniJIS-UCS2-HW-H C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\mfold\gs\gs10.02.0\Resource\Font\URWGothic-BookOblique C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Exception\MetaclassMustBeDerivedFromClassMOPClass.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Specio\Library\Structured\Tuple.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\mk.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\auto\share\dist\DateTime-Locale\sg.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\snpeff\examples\samples_cancer.txt C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\data\sitecon_models\prokaryotic\ISCR3.sitecon.gz C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\vo_001.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Moose\Util\TypeConstraints\Builtins.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\PPI\Structure\For.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\Perl\Critic\Policy\ValuesAndExpressions\RequireQuotedHeredocTerminator.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\cutadapt\__pycache__\modifiers.cpython-312.pyc.2556848920400 C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\kln.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\PPIx\Regexp\Token\Comment.pm C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\pods\perlfaq3.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\Ea\W.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\DateTime\Locale\en_AI.pod C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\perl5\lib\unicore\lib\InPC\Overstru.pl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
File created C:\Program Files\Unipro UGENE\tools\python3\Lib\mailbox.py C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastp.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastn.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\blastx.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\java\bin\java.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\python3\python.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\lib\mafft\version.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\expr.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\env.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\mktemp.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Swiss-Prot file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stockholm alignment file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.genbank C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Workflow Language\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Clustal alignment file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\shell\ = "open" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAM genome assembly\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GFF format\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Workflow Language\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gff\ = "GFF format" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stockholm alignment file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fas\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fastq\ = "FASTQ file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA sequence file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file\shell\open\command C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.srfa\ = "FASTA short reads file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.emb\ = "EMBL file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.gen\ = "Genbank plain text file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stockholm alignment file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.em C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NEWICK tree file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file\ = "Protein Data Bank file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Protein Data Bank file\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA short reads file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.sw\ = "Swiss-Prot file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fasta\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.seqs\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.abif\ = "ABIF file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.aln C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\ = "EMBL file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bam C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTA short reads file C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Query Language\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ABIF file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Genbank plain text file\ = "Genbank plain text file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\EMBL file\shell C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.fsa C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\FASTQ file\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.sto C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\UGENE Database\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.uwl C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file\shell\open\command\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe \"%1\"" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.gen C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BAM genome assembly\DefaultIcon C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Unipro UGENE project file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,0" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.fna\ = "FASTA sequence file" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MSF multiple sequence file\DefaultIcon\ = "C:\\Program Files\\Unipro UGENE\\ugeneui.exe,1" C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SAM genome assembly\shell\open C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A
N/A N/A C:\Program Files\Unipro UGENE\plugins_checker.exe N/A

Suspicious behavior: GetForegroundWindowSpam

Description Indicator Process Target
N/A N/A C:\Program Files\Unipro UGENE\ugeneui.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
Token: SeBackupPrivilege N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A
Token: SeRestorePrivilege N/A C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 852 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 852 wrote to memory of 3856 N/A C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe C:\Program Files\Unipro UGENE\ugeneui.exe
PID 3856 wrote to memory of 4888 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 3856 wrote to memory of 4888 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\plugins_checker.exe
PID 3856 wrote to memory of 5024 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe
PID 3856 wrote to memory of 5024 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe
PID 3856 wrote to memory of 5024 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe
PID 3856 wrote to memory of 2636 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe
PID 3856 wrote to memory of 2636 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe
PID 3856 wrote to memory of 4916 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe
PID 3856 wrote to memory of 4916 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe
PID 3856 wrote to memory of 1512 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 3856 wrote to memory of 1512 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe
PID 3856 wrote to memory of 5088 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe
PID 3856 wrote to memory of 5088 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe
PID 3856 wrote to memory of 2412 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe
PID 3856 wrote to memory of 2412 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe
PID 3856 wrote to memory of 3016 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 3856 wrote to memory of 3016 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 3856 wrote to memory of 3016 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe
PID 3856 wrote to memory of 1188 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe
PID 3856 wrote to memory of 1188 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe
PID 3856 wrote to memory of 1036 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 3856 wrote to memory of 1036 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 3856 wrote to memory of 1036 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe
PID 3856 wrote to memory of 3564 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe
PID 3856 wrote to memory of 3564 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe
PID 3856 wrote to memory of 1492 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 3856 wrote to memory of 1492 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 3856 wrote to memory of 1492 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastp.exe
PID 3856 wrote to memory of 4332 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe
PID 3856 wrote to memory of 4332 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe
PID 3856 wrote to memory of 2092 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Windows\system32\cmd.exe
PID 3856 wrote to memory of 2092 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Windows\system32\cmd.exe
PID 2092 wrote to memory of 4948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2092 wrote to memory of 4948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\chcp.com
PID 2092 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2092 wrote to memory of 2160 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 2092 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 2092 wrote to memory of 5004 N/A C:\Windows\system32\cmd.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 5004 wrote to memory of 4612 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 5004 wrote to memory of 4612 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 5004 wrote to memory of 4612 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4612 wrote to memory of 3080 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4612 wrote to memory of 3080 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4612 wrote to memory of 3080 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4612 wrote to memory of 4356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4612 wrote to memory of 4356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 3080 wrote to memory of 2488 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe
PID 3080 wrote to memory of 2488 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe
PID 4612 wrote to memory of 4356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 4356 wrote to memory of 3520 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe
PID 4356 wrote to memory of 3520 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe
PID 5004 wrote to memory of 3356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 5004 wrote to memory of 3356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 5004 wrote to memory of 3356 N/A C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe
PID 3856 wrote to memory of 3984 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe
PID 3856 wrote to memory of 3984 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe
PID 3856 wrote to memory of 3984 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe
PID 3856 wrote to memory of 3840 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastn.exe
PID 3856 wrote to memory of 3840 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastn.exe
PID 3856 wrote to memory of 3840 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\blast\blastn.exe
PID 3856 wrote to memory of 2444 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe
PID 3856 wrote to memory of 2444 N/A C:\Program Files\Unipro UGENE\ugeneui.exe C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe

"C:\Users\Admin\AppData\Local\Temp\ugene-50.0-win-x86-64.exe"

C:\Program Files\Unipro UGENE\ugeneui.exe

"C:\Program Files\Unipro UGENE\ugeneui.exe"

C:\Program Files\Unipro UGENE\plugins_checker.exe

"C:\Program Files\Unipro UGENE\plugins_checker.exe" --plugins=biostruct3d_view --verify --ini-file=\"C:/Users/Admin/AppData/Roaming/Unipro/UGENE.ini\"

C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe

"C:\Program Files\Unipro UGENE\tools\clustalw\clustalw2.exe" -help

C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\hmmsearch.exe" -h

C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe

"C:\Program Files\Unipro UGENE\tools\samtools\tabix.exe" -help

C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\bcftools.exe"

C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe

"C:\Program Files\Unipro UGENE\tools\iqtree\iqtree.exe" --version

C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe

"C:\Program Files\Unipro UGENE\tools\kalign\kalign.exe" --version

C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe

"C:\Program Files\Unipro UGENE\tools\blast\rpsblast.exe" -h

C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe

"C:\Program Files\Unipro UGENE\tools\samtools\samtools.exe"

C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe

"C:\Program Files\Unipro UGENE\tools\blast\tblastn.exe" -h

C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-align-s.exe" --version

C:\Program Files\Unipro UGENE\tools\blast\blastp.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastp.exe" -h

C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe

"C:\Program Files\Unipro UGENE\tools\bedtools\bedtools.exe" --version

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files\Unipro UGENE\tools\mfold\mfold.bat" -v"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cd

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe

"C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\mfold_datdir.exe"

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe

"C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\sed.exe" -e s@/$@@

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mfold\\msys64\usr\bin\bash.exe" "C:\Program Files\Unipro UGENE\tools\mfold\\mfold-3.6\bin\mfold" -v

C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe

"C:\Program Files\Unipro UGENE\tools\spidey\Spidey.exe"

C:\Program Files\Unipro UGENE\tools\blast\blastn.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastn.exe" -h

C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe

"C:\Program Files\Unipro UGENE\tools\fasttree\FastTree.exe" -expert

C:\Program Files\Unipro UGENE\tools\blast\blastx.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastx.exe" -h

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -version

C:\Windows\system32\icacls.exe

C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

C:\Program Files\Unipro UGENE\tools\python3\python.exe

"C:\Program Files\Unipro UGENE\tools\python3\python.exe" --version

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" -h

C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe

"C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe" -h -help

C:\Program Files\Unipro UGENE\tools\python3\python.exe

"C:\Program Files\Unipro UGENE\tools\python3\python.exe" "C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build" --version

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -Xmx8042M -jar "C:\Program Files\Unipro UGENE\tools\snpeff\snpEff.jar" databases

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -jar "C:\Program Files\Unipro UGENE\tools\trimmomatic\trimmomatic.jar" -h

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-build-s" --wrapper basic-0 --version

C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe

"C:\Program Files\Unipro UGENE\tools\mrbayes\mb.exe" ""

C:\Program Files\Unipro UGENE\tools\python3\python.exe

"C:\Program Files\Unipro UGENE\tools\python3\python.exe" -m cutadapt --version

C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe

"C:\Program Files\Unipro UGENE\tools\clustalo\ClustalO.exe" --help

C:\Program Files\Unipro UGENE\tools\python3\python.exe

"C:\Program Files\Unipro UGENE\tools\python3\python.exe" "C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect" --version

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-inspect-s" --wrapper basic-0 --version

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Program Files\Unipro UGENE\tools\mafft\mafft.bat" -help"

C:\Windows\system32\chcp.com

chcp 65001

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c cd

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\dirname.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\uname.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\basename.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\grep.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\lib\mafft\version.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\lib\mafft\version.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\expr.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\expr.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\env.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\env.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\mktemp.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\mktemp.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\awk.exe"

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

"C:\Program Files\Unipro UGENE\tools\mafft\\usr\bin\bash" "/usr/bin/mafft" -help

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\rm.exe

"C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\rm.exe"

C:\Program Files\Unipro UGENE\tools\blast\tblastx.exe

"C:\Program Files\Unipro UGENE\tools\blast\tblastx.exe" -h

C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe

"C:\Program Files\Unipro UGENE\tools\bigwig\bedGraphToBigWig.exe" ""

C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe

"C:\Program Files\Unipro UGENE\tools\bwa\bwa.exe"

C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe

"C:\Program Files\Unipro UGENE\tools\blast\blastdbcmd.exe" -h --help

C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie1\bowtie-build-s.exe" --version

C:\Program Files\Unipro UGENE\tools\hmmer3\phmmer.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\phmmer.exe" -h

C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe

"C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe"

C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe

"C:\Program Files\Unipro UGENE\tools\cap3\cap3.exe"

C:\Program Files\Unipro UGENE\tools\hmmer3\hmmbuild.exe

"C:\Program Files\Unipro UGENE\tools\hmmer3\hmmbuild.exe" -h

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" --version

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\vcftools\vcf-consensus" -help

C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe

"C:\Program Files\Unipro UGENE\tools\phyml\PhyML.exe" --help

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\samtools\vcfutils.pl"

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2" --help

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe" --wrapper basic-0 --arg-desc

C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe

"C:\Program Files\Unipro UGENE\tools\bowtie2\bowtie2-align-s.exe" --wrapper basic-0 --help

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

"C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe" "C:\Program Files\Unipro UGENE\tools\fastqc\fastqc" -v -java "C:\Program Files\Unipro UGENE\tools\java\bin\java.exe"

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

"C:\Program Files\Unipro UGENE\tools\java\bin\java.exe" -Xmx512m -XX:+ExitOnOutOfMemoryError -Dfastqc.show_version=true -Djava.awt.headless=true uk.ac.babraham.FastQC.FastQCApplication

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp
US 8.8.8.8:53 www.dnaminer.com udp
US 8.8.8.8:53 www.ncbi.nlm.nih.gov udp

Files

C:\Users\Admin\AppData\Local\Temp\nsz6C77.tmp\System.dll

MD5 fbe295e5a1acfbd0a6271898f885fe6a
SHA1 d6d205922e61635472efb13c2bb92c9ac6cb96da
SHA256 a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1
SHA512 2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

C:\Users\Admin\AppData\Local\Temp\nsz6C77.tmp\LangDLL.dll

MD5 de3558ce305e32f742ff25b697407fec
SHA1 d55c50c546001421647f2e91780c324dbb8d6ebb
SHA256 98160b4ebb4870f64b13a45f5384b693614ae5ca1b5243edf461ca0b5a6d479a
SHA512 7081654001cba9263e6fb8d5b8570ba29a3de89621f52524aa7941ba9e6dfd963e5ef7b073f193b9df70300af04d7f72f93d0241d8c70ccdbecfd9092e166cac

C:\Users\Admin\AppData\Local\Temp\nsz6C77.tmp\nsDialogs.dll

MD5 ab101f38562c8545a641e95172c354b4
SHA1 ec47ac5449f6ee4b14f6dd7ddde841a3e723e567
SHA256 3cdf3e24c87666ed5c582b8b028c01ee6ac16d5a9b8d8d684ae67605376786ea
SHA512 72d4b6dc439f40b7d68b03353a748fc3ad7ed10b0401741c5030705d9b1adef856406075e9ce4f1a08e4345a16e1c759f636c38ad92a57ef369867a9533b7037

C:\Program Files\Unipro UGENE\plugins\biostruct3d_view.license

MD5 ffa10f40b98be2c2bc9608f56827ed23
SHA1 dc8f2e570bf431427dbc3bab9d4d551b53a60208
SHA256 189b1af95d661151e054cea10c91b3d754e4de4d3fecfb074c1fb29476f7167b
SHA512 1420da3215ed30afcf413935e20404cabe0723822c728ea29dcb9699533355ef1bee17660facdb55655241c2db30a7314d8ad6a4a3f72576b2721f522d487aa9

C:\Program Files\Unipro UGENE\tools\blast\makeblastdb.exe.manifest

MD5 7cb71b006fcdcf8ade80e31fd5ab8060
SHA1 655380fb2cca01b0ca707f748fc7dcf006732518
SHA256 be8918559280a2e74748bf8f6238b568ed7cbf75183b2180a6a8a979a1ebf243
SHA512 ce095bb84dbf2e72304471f97e80799185fab42b843f95bd84df4b97764786687807f057dc4434287c8982937329e664f7de476445ff6e2cbf298d7a44b48d55

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\share\mfold\sint6.dg

MD5 897316929176464ebc9ad085f31e7284
SHA1 09d2af8dd22201dd8d48e5dcfcaed281ff9422c7
SHA256 9a271f2a916b0b6ee6cecb2426f0b3206ef074578be55d9bc94f6f3fe3ab86aa
SHA512 a546d1300f49037a465ecec8bc1ebd07d57015a5ff1abfa1c94da9b30576933fb68e3898ff764d4de6e6741da822a7c93adc6e845806a266a63aa14c8bb09ebb

C:\Program Files\Unipro UGENE\tools\python3\Lib\site-packages\pip-23.2.1.dist-info\top_level.txt

MD5 365c9bfeb7d89244f2ce01c1de44cb85
SHA1 d7a03141d5d6b1e88b6b59ef08b6681df212c599
SHA256 ceebae7b8927a3227e5303cf5e0f1f7b34bb542ad7250ac03fbcde36ec2f1508
SHA512 d220d322a4053d84130567d626a9f7bb2fb8f0b854da1621f001826dc61b0ed6d3f91793627e6f0ac2ac27aea2b986b6a7a63427f05fe004d8a2adfbdadc13c1

C:\Program Files\Unipro UGENE\tools\trimmomatic\LICENSE

MD5 d32239bcb673463ab874e80d47fae504
SHA1 8624bcdae55baeef00cd11d5dfcfa60f68710a02
SHA256 8ceb4b9ee5adedde47b31e975c1d90c73ad27b6b165a1dcd80c7c545eb65b903
SHA512 7633623b66b5e686bb94dd96a7cdb5a7e5ee00e87004fab416a5610d59c62badaf512a2e26e34e2455b7ed6b76690d2cd47464836d7d85d78b51d50f7e933d5c

C:\Program Files\Unipro UGENE\tools\perl5\lib\Unicode\Collate\Locale\nb.pl

MD5 66ed114afca8e09fa9af4c7011abaa0e
SHA1 93c34030bb195a3b9334230de8a7970adfa9ef72
SHA256 a8ca3f8067a7215ec8f168a2bffe0846d1024a9138626f88e048dbb5b112c93f
SHA512 90762b4df5ae25ee36bd3571437301179de15454c8ebdf5758acb86fe391cd17af4fe5fd05e1bc6be5a52e8b1a8b0986c43f86dd0ace5479083daaa7564918ab

C:\Program Files\Unipro UGENE\tools\mfold\mfold-3.6\bin\myps2img.bash

MD5 e3056941bd15507718d2d4b9e808c7d0
SHA1 de9ff3fc12304d4060e2a1d40b98e6b73cf03eef
SHA256 63f155ef26f370f8e7fde423288028f355798e0923f242831d5c2c56f8ce2374
SHA512 ee85f34ca427f2413e73e93e0a41004ba2a7e072b21efedf891fafa3857c4ef7aec48c77b340f5d66619fad2a87cac2599f52deb984ce2cb59665f1a275dbe84

C:\Program Files\Unipro UGENE\tools\java\lib\images\cursors\invalid32x32.gif

MD5 1e9d8f133a442da6b0c74d49bc84a341
SHA1 259edc45b4569427e8319895a444f4295d54348f
SHA256 1a1d3079d49583837662b84e11d8c0870698511d9110e710eb8e7eb20df7ae3b
SHA512 63d6f70c8cab9735f0f857f5bf99e319f6ae98238dc7829dd706b7d6855c70be206e32e3e55df884402483cf8bebad00d139283af5c0b85dc1c5bf8f253acd37

C:\Users\Admin\AppData\Local\Temp\nsz6C77.tmp\modern-wizard.bmp

MD5 59ed2684c564aa9dcb6859342a97b960
SHA1 d7ca551a1340e2a31106171ead92631e79983949
SHA256 d238273737a291fb4129e33415cb66131756782428b86fe13894d8bf1b4abb7c
SHA512 c41433f1baf5b1826496ab9146be1b9e45e1f6208a74b54120cf421fee51900409fbc92e978d9213d4c0dcd0e937c390f782e787d8d7032fae62e1d957a3e9f6

C:\Program Files\Unipro UGENE\ugeneui.exe

MD5 e507b1eb783b3d0c66b87bee96720b0a
SHA1 3718357ba806e220056bc08f2186e33c2f646653
SHA256 9175593c40d4190821d325d5f9dc7274c83db687c0280eb253be4b858ef5ebb1
SHA512 d7856b3d813669cfaa52ad1fb39a6302764e1d0969d10103087401b07b41bf97df2f5bb2798bd022ef1ce886c892d887218851fcf7ab1a2ce7d961f0fc777eac

C:\Program Files\Unipro UGENE\U2View.dll

MD5 13b304c3c3997810bad9a6efa0229db7
SHA1 2e0eaa35978e0c05c3e4faaaadcf87935fa31b1a
SHA256 cc302eac63869d7e5d0b821c33989e2df6d8601acf7a07fa0163d91e0875f4b4
SHA512 cbf0d2a0943a5e132cfb1589e3b06cdd51e0037a7041b498cccef1a22b07954f033a317d85e5222cb890f2ee2ca89616e76e7480eb18c0a4ffa482cc33d86530

C:\Program Files\Unipro UGENE\msvcp140.dll

MD5 206afdd686e4f42e3a92e688d788cf0a
SHA1 b3178367052908ebd642ba485709a46b725fe73e
SHA256 db8b072cbcb18cf350b82c1731e75fc02b8bcc02fe22e28ddbc3485d65f3ecad
SHA512 a4dc319576a9ca4e6263f72b466749ba4150e5018602daa20b816ab461b45f19d4f9631d768fc48e975f04f791f0599f957e4220cec8128cc8e7ac96e33883bf

memory/3856-20263-0x00007FFE7FD30000-0x00007FFE7FF78000-memory.dmp

memory/3856-20273-0x00007FF763E10000-0x00007FF763FBA000-memory.dmp

memory/3856-20264-0x00007FFE7F860000-0x00007FFE7FD21000-memory.dmp

memory/3856-20265-0x00007FFE7F0E0000-0x00007FFE7F621000-memory.dmp

C:\Program Files\Unipro UGENE\vcruntime140_1.dll

MD5 21ae0d0cfe9ab13f266ad7cd683296be
SHA1 f13878738f2932c56e07aa3c6325e4e19d64ae9f
SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
SHA512 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c

C:\Program Files\Unipro UGENE\msvcp140_1.dll

MD5 af3c0ba75cf280107d52aa33af926ae8
SHA1 444b89dbf382773e18e3fbc77b34817f4440160d
SHA256 758f38f7f87c7ee392297c6e742f52c966e963e1cd4d8262231548a2003ffd78
SHA512 c638e9f7973e409bf2e0e11bf4593376e234cd44f0e9cad499a6ff6e6e2dde06095e06ebaffdd02d4473d704006f242aa8b709d0ab97b32ec747d3f45ce93757

C:\Program Files\Unipro UGENE\breakpad.dll

MD5 24c41de7e373ed3a12155e7c120303f7
SHA1 048ba3d6fd6f613138d7ef875c615ae9ef0b2b3b
SHA256 46c347eabff11a06b4cca30e17586d790115bceeb1d2bf4a3ba86e1aa0724629
SHA512 81e6017e38bd5ffb4c4a0c16394a959661f2d2dad388c664117e2f6e4945a107ae8f4a18faa68aa576aef83bd8ba07df7fb550b94ffe88f318d63acd8b581760

C:\Program Files\Unipro UGENE\Qt5PrintSupport.dll

MD5 2270a22b787010d0ab80f1469deed718
SHA1 bbf2b000d50069718cfd5c3ab092e7b91f93f921
SHA256 8943a4a305dd5119760639244185bb7c52327bf9341720f0e0e0b12a329e6472
SHA512 fcc2b1fe9682f4b4c99a8b3407c3963f5e6f754ed60c48137e854884a077fcdc79a9e0ef5bda1e467d3d49bb98995bf47e7262ea252bcb5b7f008838bf134eb6

C:\Program Files\Unipro UGENE\Qt5Svg.dll

MD5 b0831355a9659174c7bdc7dfd729cf5f
SHA1 9831c5ff2f81c207e6788f7d2ae2bb05ea5be3c9
SHA256 7837ce9d8865b38da0177ff022a946a645edcd0e85e708b936ccb8430da39540
SHA512 65e39972339d7894f78bd55b7c5a3183954eee3057d4dcc00cc3bf1e91b22cfceffce7acba61bd43b3c572a5b00bdb0684779ad1a76f902405afa8f4eb06cb23

memory/3856-20261-0x00007FFE801D0000-0x00007FFE80512000-memory.dmp

C:\Program Files\Unipro UGENE\Qt5Script.dll

MD5 15da266adbe5233583ba371977e0c3c8
SHA1 1c229360dbcb50c8de7217010cb1a3d6ab3e066d
SHA256 e19555cac5893d21813dd5610a62f14c6d6d463dfa70329b662134d7607f35c9
SHA512 e7e6fbab73e48b82e4ca3574da21e69547cef4815edb9f3233a0ad38a776f23e515cec0b497d6feb8ff4da33b371e0cf5fd04b2aa24c73b90733d99998ce8686

C:\Program Files\Unipro UGENE\ugenedb.dll

MD5 4ebdabc471eb9d7123780c103a7c63db
SHA1 4c01c79349e2d7d9eb69d3fbd91b04b542da6178
SHA256 703f7eecd05756411544f09ce8e6f195c9134799b1044a4e4ddf159eebd417f0
SHA512 e25809348511b2cb14f7662ad3829845f7a72e16c8730b018882e61358778938faa9d3cd02585e4226d4a5bedcb56fa8be35a14bff87c9ec48f2fce5deee0d26

C:\Program Files\Unipro UGENE\vcruntime140.dll

MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987

C:\Program Files\Unipro UGENE\Qt5Core.dll

MD5 597ed85ad126dc292bd076e9a5b6608b
SHA1 51e896aaba471d1ce16ebc81a31098d218c28301
SHA256 d94c19a434e2fef17ca93ea1efdace37474dce9612e018e6b4c3694a7b4d2e77
SHA512 12643ed63cb93a96798c98948629e3513f1abeaa4b9eb08444d693ec3993273a669f523f139c84ff0b89beb0e7336778afbe37830d7b72bd9dda2c99e336e9d7

C:\Program Files\Unipro UGENE\Qt5Network.dll

MD5 c8e8fbfa0b6b8d57c5a5705df5aa44cd
SHA1 f7d33ddcfb053318eac1ea7779ea4cd626465509
SHA256 80ff946325ae4c3160448cf7cf4a3585d3ab5a8546ab092588f429b1e6d4962c
SHA512 c601d871654d98fc8a16ac621cbd84360b792511c8a609da4024357782b9d11db11777d7ac55af1b1c778df0717d9630638aa77f172d4fcba22834d236a9cf0d

C:\Program Files\Unipro UGENE\Qt5Xml.dll

MD5 68cfd69993c8d7e12674a5b4b7f58759
SHA1 741c933e2334ca3bbf831848a27fccfffc32734d
SHA256 c9d4dbcb83dbbd0b220ac6d7b76a6cab046f38acda6bef6184785c616bd54185
SHA512 b4f8efdbc3d9266301d73d7ecec867b31084c2e35a97dad4d2b6a808719eaa53b8874f22084a814ec1075d127a057c5580c8c35ae3c2a16db9a5ab6f02a1a8dc

C:\Program Files\Unipro UGENE\Qt5Widgets.dll

MD5 6138dc6612f30a96f9918b012c867a89
SHA1 b43b0e1150656c96faafa748afa827774e7414e2
SHA256 40eed4076ccffabe5b7e1d00baa67b5845ca45db57771042ab59f677fd229870
SHA512 e61bc2c3682d1e017fd33046850b42e02c6babc7791ffdf405900164e58950fe8385b1514ff1ed3ea422b527fdbfd8705f357d16ff0f91ecab71d404af7d8590

C:\Program Files\Unipro UGENE\Qt5Gui.dll

MD5 3ace761376d23ea3bbb518fba9623160
SHA1 343c704a4c41400b2f52e97d1875065cc5431053
SHA256 5a8fdbc99b6ca04b47ae7d60366aa17a0c0282ab8751db1a4fef319f11204494
SHA512 a44f623039daad3ad49984868408480fcc66043c4f858b055aa40d64b63094a0787ca195fa71eb110f1e0c715f2e79e6808ebe646a49822a2f759c60fc6b15be

C:\Program Files\Unipro UGENE\U2Private.dll

MD5 bb18fe48e821e41b38b3b09ce921afb6
SHA1 e786a4b53e102b17ebac33b975959eb035035ca5
SHA256 6f747c9300b87c14f6e78bc05df910ef34927aa9c3d48fa7a62c8a7bd868f0eb
SHA512 5a3a0292fe0f415ff689d6e8a096994c0e6c8afaf01c0092190104fd8a84c0b702bc0bac0734f9a5c95af74ac31e9309a1a143741938aca008f419ce7179d2ed

C:\Program Files\Unipro UGENE\U2Lang.dll

MD5 c8e767c575a4eb6b408cdafe90b701da
SHA1 6c44c6666c81d44dde591a2c16c5859898604b55
SHA256 e1f9d535128dd77895bca1ab8e224710aa5cd122a697c188957e4442024c855d
SHA512 8228710ce3c6e3e9e797469a9a2764e2d0c17b2439fe544239df6f883d820eb35e4f6c626015d3491cf889f6d645d22d3124588fb1eb1ace179dadd80bd58baf

C:\Program Files\Unipro UGENE\U2Test.dll

MD5 a3f6b9b1c7e77b850286a2498335ffcb
SHA1 b8c3cc3641609973a5dbcf03792718e1de31b670
SHA256 24eb55db639de9bfd9f56a17f36751c3f58df6fcf678298102b71f875e7f035e
SHA512 604bb9b8a6296ef07f87f8443c7a7d99439600dfcf0ce61f2b1a20799f0182b37b276687e1a9701e8b3493feddb61494287c5ce942c31c4e94d3505a7f856b14

C:\Program Files\Unipro UGENE\U2Algorithm.dll

MD5 63ebd8afed58315e4504ac3a687d9f3e
SHA1 84c78d1e315bbadcb65c46ba9d9bdd3733d04405
SHA256 eb54570ca630781dbf22315efac978c90e2ad6645274607863ff8a4f9d9ea31a
SHA512 39ee203b8514114002c620a2f7343e3cc63944cf8a5810bfc0a6c0d81f0d31ed51755907c5918e861b7a37b691f86254cd1ae561748525c2345d1456fabc8b8e

C:\Program Files\Unipro UGENE\U2Gui.dll

MD5 d20f3cca7d3b32cf4a7695be2dbfda5d
SHA1 367ba3bcd7d17824ee3c1cbfa1acb711270f5be5
SHA256 1087ada7c96048ef5cbd0c58328f30b4ac62b76564ab57302a92fd857bc9a6ec
SHA512 7f467d84848f68d8c830069a2df176441a3950cafb5f75c661a48fa67ece7ed56013738d549e8b072c8969542fb7de02054e0e2d55ffc9b49259b2536cdbcd46

C:\Program Files\Unipro UGENE\U2Formats.dll

MD5 0ed34dd92eea1e4a73d6a4ed036e4683
SHA1 8d5a8b781f42070131dc40a8b80f81db8977497c
SHA256 36e79757bdfe9c9dfdd2f6920366540e346d2941bfc88ad99343aa6f3a88e010
SHA512 848b173e17ff3e550f39e88141472186c70cc24e635fbea367d30c8eaefe19f74cc6d15c685941ebc855ff2b82bb856b980101dd692eef02afdd6ad82f573965

C:\Program Files\Unipro UGENE\U2Designer.dll

MD5 3bb593bca7763cefc3e4fe3634e8b908
SHA1 9b8cf8b2ad16e7551c5a7d6b7f8324ef620ac0c7
SHA256 a889b40319fee4720504fbfbc4517f743192cb793590b31b15ccb88dc70e9e27
SHA512 8928652c030c2b386819bd4a02242316649b5b6a9bcd944d516c5fda8e2def379774fd459791e9fda32617a4cf11b84bbf29a2d83cc7b4c3f29868ba1be22e6e

C:\Program Files\Unipro UGENE\U2Core.dll

MD5 cf0b4dd5e62ae168240d1ee781a83272
SHA1 92a9e14e5bec4dab9937f4cd8f6b37a8418a41ef
SHA256 1708ae798ed3a23e46b78364192464169ac19bd16635e9e1616d52bec4034b9d
SHA512 6029ef124a0f3bd9e2741e17133c0df861f64fcad5d4ac75b2d2a1013a3228836c8d7e584552ef295607f5518f516d3dc0b15c53a4caf914ecae6921a476a844

memory/3856-20280-0x0000024088820000-0x0000024088830000-memory.dmp

C:\Program Files\Unipro UGENE\platforms\qwindows.dll

MD5 ba0bb2d62821ee94ef6b5a49ddbbc42d
SHA1 165ff4991147c5314b80e62ca541c4cbc5424732
SHA256 47ca0ca24888eb3fbffac490cbb8c15f0444959f50c8a99b361e4ae54de836de
SHA512 fee807c7172144ff30e9ea18384ec0e722c8ec5b0f5ca8414aa47e3c8ecc16cb18319826dc3d4191dd1e146840719851a9116881eac4ed9834bd3f5db4f550d4

C:\Program Files\Unipro UGENE\imageformats\qjpeg.dll

MD5 8dd6bbf14f309f562f6cd1bfaf041fd7
SHA1 dbe4af501cd268641abb49aba596137b92ef3a11
SHA256 20d8f15c7547fb40bf5cae8bec3f880c782cdb7859227fa7a7ddf62236f19d84
SHA512 6dec359a4b37aebda328f782f6e790bdeb3b8b7c695b88dbc26a24776917834d738dc276198c102a35a81771af162d74633ef7aa8b901c74f8ed0244b89622c3

C:\Program Files\Unipro UGENE\imageformats\qtiff.dll

MD5 6cd7a60aa2e8416372a83cfa1bdaab89
SHA1 66d71c47a67925bca3abfd6bf9ab9ba97fec4b83
SHA256 10af3e2b8ba7dc80de437eee4518df64b00adf9fc6023c8fd54f3182650525f6
SHA512 72d5f257f9bd7f71295baeb7de134b1cb532b5d02d65cc09e4792ee21ecaff351981946b5ffc8d22f1c0a0a672b1f08ad47c9f7e335294e5a8486f8c049e3f0f

C:\Program Files\Unipro UGENE\imageformats\qsvg.dll

MD5 8d424052cd49d47ba649d9f6299fc64e
SHA1 7622e6207aca419f192b252a5ad3d737e37f15a4
SHA256 2f04b1cdc48710d6c56f968e2e9107f5c271695f4d04c652b118defa83187083
SHA512 47a32ae9583867c986a88af0e436668d69063035fecdecb119951d33da5d636d8b3c0073d82cad11960c5b0de3859870a0c08896d80f650a0a37ac79789667be

C:\Program Files\Unipro UGENE\imageformats\qgif.dll

MD5 2dca355bf20dae868b4b5c5e03c4ee7e
SHA1 36d635bf22b8db514917080e70d849f24da485b4
SHA256 1ad13a3a59210c9e9d6846ddd8caf73d92016993b1591722c8654aec412604bb
SHA512 64ab1b06ad0d2cb5394bad15068768b8ff39b9e957fba73675c442714ed74eabdbb58b6b3af1a8cd13b121861a99783f92abadc491b93c9780c7bb33df6ce70b

C:\Program Files\Unipro UGENE\styles\qwindowsvistastyle.dll

MD5 2578e128acd8a6ef5fc5a5f46aa43fd8
SHA1 0c4f5b66ba6340376bca7f1b143fe6d13b407074
SHA256 11089f156619ee6644a50c961c1b8b278f905e61e1f9979f8965bc3e17a06ead
SHA512 6e2d95d23bc32acc96f10d959e4a7e5a8357ad6d638d6fb502683c7e4b4ba503a6a55ca902c77fb75b636cd7cac3aa4e261ba87d0ae9e1e4d8076e4e124cc4e4

memory/3856-20295-0x00007FFE7D980000-0x00007FFE7DC95000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.lock

MD5 b8ac91119a4ae9fd7291c544f1ed0518
SHA1 653874b37afa5e7a225e8e9d612dd82779497397
SHA256 58d3a0f5b15d0fb07583e80427f5e34861c671ae4fef88a2eae90f68b13d9393
SHA512 5ede2ec68ee99243280ba31f3ebd169b1a3c415bfcf6d9cd712d1ddde7eda34188ed2f6335ba10ee8ec5d79720bef7180a467cd0989e1e6e5a1bd2fff0a27c5d

memory/4888-20322-0x00007FFE7F0E0000-0x00007FFE7F621000-memory.dmp

memory/4888-20323-0x00007FFE7FD30000-0x00007FFE7FF78000-memory.dmp

memory/4888-20324-0x00007FFE7F860000-0x00007FFE7FD21000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 9110979b57c746cb9d2f4f7be1a9f194
SHA1 ae7913868c16a1cc7fa2ae1cc1fab182a87d065d
SHA256 68146a3508c67d2f668890e54b8223511fcc5abbebbb45785888f5cdf4820de3
SHA512 8f34940a0e4388391482a1753fdbb9b96f8ae70f94575a3b14b531d26a4345b7c87d5470b5a704159753ae5a48a3f3dc2d11ddd3592bca1fb394d8fe79ebdfd1

memory/2636-20348-0x0000000100400000-0x000000010050C000-memory.dmp

memory/2636-20350-0x0000000180040000-0x0000000180650000-memory.dmp

memory/2636-20349-0x0000000180040000-0x0000000180650000-memory.dmp

memory/4916-20360-0x00000003FE740000-0x00000003FE75D000-memory.dmp

memory/4916-20359-0x0000000100400000-0x0000000100452000-memory.dmp

memory/4916-20361-0x0000000180040000-0x0000000180640000-memory.dmp

memory/1512-20371-0x0000000100400000-0x000000010049B000-memory.dmp

memory/1512-20374-0x0000000180040000-0x0000000180640000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 01b8c75484627e56d29287f562de86bc
SHA1 47d0e31a745aeba8313946776a6c6b407ead629f
SHA256 bdebaeaa886b2495aff16d64297fae801034c3b2c820b177017f7249f3a8b0de
SHA512 f6d5931be413e8d3fa51504dcdfd3b9d7d061a91567f56132b6f986b2ce9c5e9394c9d49025e693e98c154f37784a174e5dc621c000f2668554ea3525a61b176

memory/5088-20382-0x0000000000400000-0x0000000000B0F000-memory.dmp

memory/2412-20391-0x0000000100400000-0x000000010043E000-memory.dmp

memory/2412-20392-0x00007FFE77B70000-0x00007FFE77E72000-memory.dmp

memory/3856-20408-0x0000024088820000-0x0000024088830000-memory.dmp

memory/1188-20410-0x0000000100400000-0x000000010059E000-memory.dmp

memory/1188-20414-0x0000000180040000-0x0000000180640000-memory.dmp

memory/1188-20413-0x00000003FE740000-0x00000003FE75D000-memory.dmp

memory/1188-20412-0x0000000180040000-0x0000000180640000-memory.dmp

memory/1188-20411-0x00000003FF010000-0x00000003FF05C000-memory.dmp

memory/3564-20430-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/3564-20433-0x00000003FE760000-0x00000003FE77E000-memory.dmp

memory/3564-20435-0x00000003FFB70000-0x00000003FFB8A000-memory.dmp

memory/3564-20437-0x0000000180040000-0x0000000180650000-memory.dmp

memory/3564-20432-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/3564-20429-0x0000000100400000-0x00000001004C7000-memory.dmp

memory/3564-20436-0x00000003FE970000-0x00000003FEB19000-memory.dmp

memory/4332-20452-0x00000003FF6B0000-0x00000003FF6DC000-memory.dmp

memory/4332-20453-0x0000000100400000-0x00000001005AE000-memory.dmp

memory/4332-20456-0x0000000180040000-0x0000000180650000-memory.dmp

memory/4332-20462-0x00000003FFB70000-0x00000003FFB8A000-memory.dmp

memory/4332-20463-0x00000003FE970000-0x00000003FEB19000-memory.dmp

memory/2488-20482-0x00007FF79E660000-0x00007FF79E686000-memory.dmp

memory/3080-20488-0x0000000100400000-0x0000000100642000-memory.dmp

memory/3080-20493-0x0000000180040000-0x0000000180344000-memory.dmp

memory/4612-20499-0x0000000180040000-0x0000000180344000-memory.dmp

memory/3520-20498-0x00000005603F0000-0x0000000560500000-memory.dmp

memory/3520-20497-0x0000000430B30000-0x0000000430B52000-memory.dmp

memory/5004-20496-0x0000000180040000-0x0000000180344000-memory.dmp

memory/3520-20494-0x0000000100400000-0x0000000100434000-memory.dmp

memory/4356-20487-0x0000000180040000-0x0000000180344000-memory.dmp

memory/4356-20485-0x0000000100400000-0x0000000100642000-memory.dmp

C:\Program Files\Unipro UGENE\tools\mfold\msys64\usr\bin\bash.exe

MD5 490a9fae59062d20a29b849ba21f6760
SHA1 60c83b3b5f5f3ccc24740caa125015ae30872197
SHA256 ece759740a984f3a068483fb1eb71e912876421e1c5ae18e004af34f1dea538f
SHA512 05a3ec19e05dc48c968f6ce967ac85dd6681821bf79152b94e153a14530985564eec9279f8a261956abfe6cec0a2e1b9f89e3f146c23ec5c53610b6ca318c208

memory/4612-20476-0x0000000100400000-0x0000000100642000-memory.dmp

memory/5004-20474-0x0000000100400000-0x0000000100642000-memory.dmp

memory/3520-20500-0x0000000180040000-0x0000000180344000-memory.dmp

memory/4612-20503-0x0000000100400000-0x0000000100642000-memory.dmp

memory/3356-20512-0x0000000100400000-0x0000000100642000-memory.dmp

memory/4612-20506-0x0000000180040000-0x0000000180344000-memory.dmp

memory/3356-20514-0x0000000180040000-0x0000000180344000-memory.dmp

memory/5004-20519-0x0000000180040000-0x0000000180344000-memory.dmp

memory/5004-20517-0x0000000100400000-0x0000000100642000-memory.dmp

memory/4332-20461-0x00000003FE760000-0x00000003FE77E000-memory.dmp

memory/4332-20460-0x00000003FF6B0000-0x00000003FF6DC000-memory.dmp

memory/4332-20458-0x00000003FFF40000-0x00000003FFF58000-memory.dmp

memory/4332-20457-0x0000000100400000-0x00000001005AE000-memory.dmp

memory/4916-20455-0x0000000180040000-0x0000000180640000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 4a22e0fd45c5118332d05c98efae3c22
SHA1 8074310288fe21d58c507285a592b6ad03af8fff
SHA256 06dbd62677301f3223035806cf8242f6a52e50ca36bf1644cd993d39a94ea2ca
SHA512 dff6e85044dc1b3cd35c910220f944b78d808ca4a0734aa39f5485d8e5f7651c6e4f76d1351d05e65900b916df8737fec142cb4295b88e2caff2e783a0049278

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 3f4f962e7434a194d1f95c9a977c6033
SHA1 f4e2bfef2c61b3fb78c495accd7a89cc16bbd86b
SHA256 4999f9a1a2dd9345216003e5f797f9c051b0ce58acda412df2e0c309e90fd99d
SHA512 b25b59a3fa5ecb37e5d1ea0e26c94ef9ed5819fd8cda16e31f976520c7ec157d1110aeda8d73df3845b1255401d653348525db17a766974f47aa8e95a6dba95e

memory/2444-20553-0x0000000000400000-0x0000000000453000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 e68658381a04b7af04bbc10fcaee82b7
SHA1 d8c706b4d72b468fea044a5738b55b733d977630
SHA256 fc7ce72d6b071b4f78b2b34edf0544f59b0b57801d6063e233c9f9d61adeb4ea
SHA512 b4518ba3dc7cbb1ec7e82d435456555702b84cb017d3a7f91de1fe258df8b0286aa2acea70aa95d0df573e794b2fa8e9654f70bb2520d22ca9ed91bea0d26ab8

memory/4244-20589-0x0000000002800000-0x0000000002801000-memory.dmp

memory/1544-20622-0x0000000002E40000-0x0000000002E41000-memory.dmp

C:\Program Files\Unipro UGENE\tools\java\bin\java.exe

MD5 cab437a45738692b65dd5f822c30794d
SHA1 5a6800a0c6bd0bfa6cee10eade8e43b2107461db
SHA256 a668db19cf5eb8944ed6343aad9409f1ab9e2b6731a9fb298f087c0d0156f7e5
SHA512 1bd5c938ff5b15043f2caac4fa031e9e304ca56674e4cfafa801721a3249dd2ed1001afe482cfd70a940617c492456cf1cc3a703206ad7449e47bc35e9866a97

memory/4308-20745-0x0000000180040000-0x0000000180650000-memory.dmp

memory/4308-20757-0x0000000180040000-0x0000000180650000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini.aFyaax

MD5 b4a6017fc7ba6f6b063a85af484c8dc7
SHA1 8422c2dab7febcb262a761ff2c240a70560b3901
SHA256 0e7bcc39932df76fb3d3dbbdb0ebcfadcdca23e6c1c3434b6391d68980b65df9
SHA512 33b5d594bcb4ca627175d6d3f2a8346d6e8711d126da6d60253bf91d087d225e3121fcc1de2a459074c56daa0a1df00a14b6d7ae8e2019004dd1d00a7008e87f

C:\Program Files\Unipro UGENE\tools\python3\python.exe

MD5 243ed5d8ca0250cd2e39b9ae340a21dd
SHA1 bd1df08e40c9439da337e66d091a17dd86ba3424
SHA256 5a9b59b451351aa7a82f28ea3f7f4bf411c549714e4113e8f6655dc47c38ce2b
SHA512 7bb79296613a120911d9afd51f9e450842fe962b6d9f16e9a50eea4c1b7d1f6af6b6cfcd597f475aeaf74e45c8241a65ddfc5a3d97c70b44e4ed358841566f17

memory/2620-20923-0x0000000180040000-0x00000001805F0000-memory.dmp

memory/1412-20949-0x0000000180040000-0x0000000180650000-memory.dmp

memory/1412-20956-0x0000000180040000-0x0000000180650000-memory.dmp

memory/3356-20989-0x0000000180040000-0x0000000180600000-memory.dmp

memory/2016-20993-0x0000000180040000-0x0000000180600000-memory.dmp

memory/3872-21003-0x0000000180040000-0x0000000180600000-memory.dmp

memory/2016-21006-0x0000000180040000-0x0000000180600000-memory.dmp

C:\Program Files\Unipro UGENE\tools\mafft\usr\bin\bash.exe

MD5 9de1b7aaa1702506f2877b536e28b1ce
SHA1 bbc25e35d240c25be44b499c5d64cc703d3313df
SHA256 8cb0d8a627df2894665b78a64c153de8441b341722ddea0c42285449ae0a322e
SHA512 b6997e7ea41449896afd86b96a2cb5c7095d9eebd80294feceb1f4cd33335918b0eaa3bb716f1c03f489e9acac4faa370e0bb6ed27969602faf68cbcd593b1fd

memory/740-21009-0x0000000180040000-0x0000000180600000-memory.dmp

memory/740-21020-0x0000000180040000-0x0000000180600000-memory.dmp

memory/3356-21412-0x0000000180040000-0x0000000180600000-memory.dmp

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 89ac1bac02b0736e9b5968acf03410f8
SHA1 65a05e6ca48f918cac4972c7be4477b9a13ca931
SHA256 b6ff3f3d2a00a535e75a29703c936a236c4be61a4c408c7aa7d446513125b2d4
SHA512 57e24e6d34003bd7dfa9d44ab865b5929c019d03dc621bddd31692e4cd34356184b63d3d048b7b93cd7a49ed912282324a8f3ab19db4a783986d618c0bbbaca1

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 82edb043ff4e94935f3b1a7dd4e69292
SHA1 cce13930ae054fc5d2e1504dddbafaf0c6b0a83e
SHA256 235273e66d7ad1e4be2054d1ec1806564d9082e8d0f014ea96705c862eee1a5f
SHA512 15c9b5987eba51411a59c0244394b3df5e12a0da77ac58b75f1369ed3c3aad05f589392a071fa15d325c26dd0a52893102c18925d8280ae935c47c7ca95e6cb9

C:\Program Files\Unipro UGENE\tools\perl5\bin\perl.exe

MD5 87b3b15fdaf99a549899325c55b079ea
SHA1 7564aac91fb1fc17ca445caa6531be375b170b3f
SHA256 a6c341a9e3d423ea4f130f44d1904a7768e6963a045425796aa8475df899a15e
SHA512 efbd2173782173c47f8575804c23d59a0e83ef500563847b4e85ae291dbec4dd8f8df2ee5c0cae02a863847fbe7abd519b82ab0add8cfea412cb25482ecfad39

C:\Users\Admin\AppData\Roaming\Unipro\UGENE.ini

MD5 4b825aabebf50bf6fc90952af0d68a7a
SHA1 d6b5582cde9cb7ee3d8cb95e80aa56728d47999a
SHA256 e1e48f9a9e71c181a21427ac5459b3b331bd7e680faa8c14a85650fb58394c11
SHA512 14670617a9486affa27fa0abb1507dc901569475b737d091f5cca46ddfd92953bee095983905ea77c6d0d3a25cc64c745854df40e79cac22baa069b5734b9adc