46b55211fa1efb987ad56441b71a9c4fb2d9c96dbc23ea9b58e3c22314120e7c

Resubmissions

05/08/2024, 13:49

240805-q43fxsxglk 9

05/08/2024, 13:48

240805-q4lhea1gra 7

Analysis

max time kernel
146s
max time network
158s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
05/08/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

UTCWebComponents.exe
Size

2.9MB
MD5

3dde23965058db0a131cfeff60aec9e8
SHA1

a40648440ffc40eb173b637f47e5137ca1f89753
SHA256

46b55211fa1efb987ad56441b71a9c4fb2d9c96dbc23ea9b58e3c22314120e7c
SHA512

abf725658aa67ab43541c6bbbc4c96f71fe7822b423451f0d12821609ff080982038c7949b57cbc79fb69e2f48e3de11a140af8dbd2354019cef8b8c60692a33
SSDEEP

49152:l2wQV7hy6LkgY9noahp/JHkngocXekwITf6v+osO+uUiaGgoENwg9k3jAHK75CXs:AwQV7lIgY9noahpBWcXeAT+4uHfECg9O

Score

9^/10

credential_access defense_evasion discovery stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
3840	UTCWebComponents.tmp
5024	UTCWebComponents.exe
296	UTCWebComponents.tmp

Loads dropped DLL 28 IoCs

pid	Process
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
2944	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe
4176	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 29 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\UTC Web Components\is-E78LA.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-LBUG9.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-F5D98.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-SS9LQ.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-NIUVM.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-LSI75.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-L42R0.tmp	UTCWebComponents.tmp
File opened for modification	C:\Program Files (x86)\UTC Web Components\unins000.dat	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-5G5JT.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-A19OO.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-51HHT.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-6L90D.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-P3H2A.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-7S0M8.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-2V7VF.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-Q5157.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-1JULT.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-63905.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-DFTGN.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-73VKH.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-MNKVJ.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-D9MHB.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-1J4RV.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-8D8O2.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\unins000.dat	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-HTEAI.tmp	UTCWebComponents.tmp
File opened for modification	C:\Program Files (x86)\UTC Web Components\unins000.dat	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-UEM1E.tmp	UTCWebComponents.tmp
File created	C:\Program Files (x86)\UTC Web Components\is-CDVC8.tmp	UTCWebComponents.tmp

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\UTCWebComponents.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTCWebComponents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTCWebComponents.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTCWebComponents.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UTCWebComponents.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6CC35F9-4417-46A3-815D-6FC7322EF293}\ = "UTCWebVideoActiveX Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\InprocServer32\ = "C:\\PROGRA~2\\UTCWEB~1\\UTCWEB~1.OCX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\ = "_DWebVideoActiveXEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\InprocServer32\ = "C:\\PROGRA~2\\UTCWEB~1\\UTCWEB~1.OCX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}\1.0\ = "UTCWWebVideoActiveX ActiveX Control module"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\TypeLib\ = "{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Insertable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ProgID\ = "UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\UTC Web Components"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\Control\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\ = "_DWebVideoActiveX"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6CC35F9-4417-46A3-815D-6FC7322EF293}\ = "UTCWebVideoActiveX Property Page"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\MiscStatus	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\TypeLib\ = "{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1\ = "UTCWebVideoActiveX Control"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ToolboxBitmap32\ = "C:\\PROGRA~2\\UTCWEB~1\\UTCWEB~1.OCX, 1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1\Insertable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1\CLSID\ = "{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\TypeLib\ = "{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ProgID\ = "UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6CC35F9-4417-46A3-815D-6FC7322EF293}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ = "UTCWebVideoActiveX Control"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\TypeLib\ = "{F33DD1EC-CD79-46AA-92AB-22B52BF266A8}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{17C5DA3B-A1A7-401B-9D52-6EF0C4455F76}\ = "_DWebVideoActiveX"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A45FBFAA-CA68-41CF-A422-CB5B6E7B90DF}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB73DB17-348E-40DB-B6A7-FAB893B77DFD}\ToolboxBitmap32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UTCWebVideoActiveX.UTCWebVideoActiveXCtrl.1\ = "UTCWebVideoActiveX Control"	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\UTCWebComponents.exe:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	4304	firefox.exe
Token: SeDebugPrivilege	4304	firefox.exe
Token: SeDebugPrivilege	296	UTCWebComponents.tmp
Token: SeDebugPrivilege	296	UTCWebComponents.tmp
Token: SeDebugPrivilege	296	UTCWebComponents.tmp
Token: SeDebugPrivilege	296	UTCWebComponents.tmp
Token: SeDebugPrivilege	296	UTCWebComponents.tmp
Token: SeDebugPrivilege	4624	firefox.exe
Token: SeDebugPrivilege	4624	firefox.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3840	UTCWebComponents.tmp
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
296	UTCWebComponents.tmp
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe

Suspicious use of SetWindowsHookEx 38 IoCs

pid	Process
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4304	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe
4624	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1820 wrote to memory of 3840	1820	UTCWebComponents.exe	70
PID 1820 wrote to memory of 3840	1820	UTCWebComponents.exe	70
PID 1820 wrote to memory of 3840	1820	UTCWebComponents.exe	70
PID 3840 wrote to memory of 2944	3840	UTCWebComponents.tmp	71
PID 3840 wrote to memory of 2944	3840	UTCWebComponents.tmp	71
PID 3840 wrote to memory of 2944	3840	UTCWebComponents.tmp	71
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 2732 wrote to memory of 4304	2732	firefox.exe	74
PID 4304 wrote to memory of 4592	4304	firefox.exe	75
PID 4304 wrote to memory of 4592	4304	firefox.exe	75
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76
PID 4304 wrote to memory of 652	4304	firefox.exe	76

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe
"C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1820
- C:\Users\Admin\AppData\Local\Temp\is-ROG6L.tmp\UTCWebComponents.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ROG6L.tmp\UTCWebComponents.tmp" /SL5="$5020C,2726915,53760,C:\Users\Admin\AppData\Local\Temp\UTCWebComponents.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UTC Web Components\UTCWebVideoActiveX.ocx"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.0.424535952\941639363" -parentBuildID 20221007134813 -prefsHandle 1716 -prefMapHandle 1708 -prefsLen 20935 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a59f9ff8-821f-4f08-ad85-3b55a66e1c23} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 1796 1ba1fcd6758 gpu
    3⤵
    PID:4592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.1.1424396640\122776587" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 21016 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2d707ab-9eda-402e-b41d-028c8754572b} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 2152 1ba1fbfb358 socket
    3⤵
    - Checks processor information in registry
    PID:652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.2.852499472\176003232" -childID 1 -isForBrowser -prefsHandle 2948 -prefMapHandle 2944 -prefsLen 21119 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {317525e2-8db9-4860-8564-85157fb2b29a} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 2956 1ba23fc3858 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.3.544784675\1376203857" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3536 -prefsLen 26212 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08eb928d-b288-4cc9-8363-b0352ad35c16} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 3552 1ba22611158 tab
    3⤵
    PID:3672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.4.1522649861\934679299" -childID 3 -isForBrowser -prefsHandle 4576 -prefMapHandle 3712 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed0f8af4-2e6e-4223-b58b-284293ae0360} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 4608 1ba25f04158 tab
    3⤵
    PID:2404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.5.699227988\966804991" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 4956 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb38c682-ac0e-4263-9e32-8c23a5a25b25} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 5004 1ba2608b658 tab
    3⤵
    PID:5028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.6.314824363\1568570555" -childID 5 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {877e55db-5bdf-455f-ae0d-5c1c02b6bbc5} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 5028 1ba2608ad58 tab
    3⤵
    PID:672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.7.354008122\336612853" -childID 6 -isForBrowser -prefsHandle 5252 -prefMapHandle 5256 -prefsLen 26274 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3cab9874-46a6-4985-8769-00034b15ab26} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 5244 1ba2608bc58 tab
    3⤵
    PID:584
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4304.8.224197508\1252796658" -childID 7 -isForBrowser -prefsHandle 2824 -prefMapHandle 4124 -prefsLen 26698 -prefMapSize 233414 -jsInitHandle 1284 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be8ca7f9-9110-43c4-8d39-fec4a420c87e} 4304 "\\.\pipe\gecko-crash-server-pipe.4304" 1600 1ba25313a58 tab
    3⤵
    PID:1416
- - C:\Users\Admin\Downloads\UTCWebComponents.exe
    "C:\Users\Admin\Downloads\UTCWebComponents.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\is-3D7A5.tmp\UTCWebComponents.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3D7A5.tmp\UTCWebComponents.tmp" /SL5="$5028C,2726915,53760,C:\Users\Admin\Downloads\UTCWebComponents.exe"
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:296
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\UTC Web Components\UTCWebVideoActiveX.ocx"
        5⤵
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1736
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.0.931898307\159350562" -parentBuildID 20221007134813 -prefsHandle 1612 -prefMapHandle 1608 -prefsLen 21234 -prefMapSize 233583 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a390a9f-9685-42ab-b9e7-1357abd739e6} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 1684 275f0ffa158 gpu
    3⤵
    PID:4588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.1.1708717893\2005295684" -parentBuildID 20221007134813 -prefsHandle 1992 -prefMapHandle 1988 -prefsLen 21279 -prefMapSize 233583 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {093c033d-79d5-4e53-b7db-87aeecfb6a6f} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 2004 275dece5e58 socket
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.2.2088533076\1279644146" -childID 1 -isForBrowser -prefsHandle 2632 -prefMapHandle 2764 -prefsLen 21740 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f729a45-d276-4e0c-83a9-4572edc85479} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 2892 275f4b2d458 tab
    3⤵
    PID:2940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.3.659704383\1133591245" -childID 2 -isForBrowser -prefsHandle 3380 -prefMapHandle 3376 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {191e3b70-d320-4990-be88-dee66ef828ee} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 3392 275dec69958 tab
    3⤵
    PID:4320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.4.1378436720\1690060169" -childID 3 -isForBrowser -prefsHandle 3852 -prefMapHandle 3848 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {de48534f-567a-4a4f-80c3-2a766522b9ad} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 3864 275dec66558 tab
    3⤵
    PID:3600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.5.1864216372\66245538" -childID 4 -isForBrowser -prefsHandle 4480 -prefMapHandle 4484 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0fed4255-3119-4de2-abb7-deb032a31ded} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 4492 275f7723d58 tab
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.6.1798246992\1852557141" -childID 5 -isForBrowser -prefsHandle 4844 -prefMapHandle 4660 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {511f81b9-bd24-4d39-8737-c3458d217085} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 4664 275f842ce58 tab
    3⤵
    PID:2640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.7.236699680\1352407280" -childID 6 -isForBrowser -prefsHandle 5056 -prefMapHandle 5060 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a6b7ce-a523-483a-9e25-1e45c662e375} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5048 275f842d458 tab
    3⤵
    PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.8.1172865903\1950848302" -childID 7 -isForBrowser -prefsHandle 5228 -prefMapHandle 5232 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {69e9100b-8755-4ec8-aa91-d97e1d75b30a} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5216 275f842ef58 tab
    3⤵
    PID:3704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4624.9.1253266437\1432639895" -childID 8 -isForBrowser -prefsHandle 5772 -prefMapHandle 5604 -prefsLen 26925 -prefMapSize 233583 -jsInitHandle 1324 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72df8361-08f9-43ea-8987-6bd4465762e8} 4624 "\\.\pipe\gecko-crash-server-pipe.4624" 5732 275f68ec558 tab
    3⤵
    PID:1892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\UTC Web Components\NetStream.dll

Filesize
1.2MB

MD5
f7583a78a988f24966e09fd9cae71d58

SHA1
459f6e7167faea7e94079ea67b738cd16c56df01

SHA256
c88f2cfc9e91cb9618f98480ec4375de2d332ccab613112337c0ada2c9d7e975

SHA512
1d073b5c12699e9cf7f016cb6aded5c990590b0e09842d8e4f62959ca9a13ace6f2a9b08455cb0021ef418edb0e69ae5cffda1affe19329c6a2c22837acca51c

Download Submit
C:\Program Files (x86)\UTC Web Components\PlayCtrl.dll

Filesize
3.5MB

MD5
57808c7fc5c4877dc97fd1fadb661f70

SHA1
8c3092d0a5d04a02c6808140576105063cb96d87

SHA256
6caf3e51f5e6715d52404d9891d8c3a88875dde7da7e502281dd8a26b219df21

SHA512
89104ee9cc6cc483c0bc359068d3f37bcc46ba5077a7ea0a74b0814d77374c6ae50dad7cb633934131e01fa9984b8df64c623ace177c1d140d6cb0c9eed3c382

Download Submit
C:\Program Files (x86)\UTC Web Components\SystemTransform.dll

Filesize
494KB

MD5
9915a401a1ed70fc2197f1b7f2f674f8

SHA1
e967fa3a7b0e2e57256f76d86906fa85314bbbb7

SHA256
b80c2fbd14ef5a58a3882ff934c5c162320c3d4346ecbc201c3ff5aa475028dd

SHA512
fcfda77a5043c2186e7add23d9cb29d1e27da4fd8f87d1ea5f05d83f52603bf689b7ecdff73c987c54de44aacf20060733d0e7b54998562947de0653c97c1c48

Download Submit
C:\Program Files (x86)\UTC Web Components\UTCWebVideoActiveX.ocx

Filesize
346KB

MD5
1a51297ffee085d6d9c0a8259fa2675c

SHA1
6bb948a2b3a4c97fa2fa1d69148d9e093769346e

SHA256
78f4900fa7816990472666d27d70ddd090d6fa173c1809c060f72f6badea3485

SHA512
c6a3a7e4928dd1772ea80a9a4362ffe05ce7c031fa7111777a3e01c7e143011d1ed773334f84c479eb93cf9fdb01856f025b8969cbd09591f20e34b854c16292

Download Submit
C:\Program Files (x86)\UTC Web Components\d3dx9_43.dll

Filesize
1.9MB

MD5
86e39e9161c3d930d93822f1563c280d

SHA1
f5944df4142983714a6d9955e6e393d9876c1e11

SHA256
0b28546be22c71834501f7d7185ede5d79742457331c7ee09efc14490dd64f5f

SHA512
0a3e311c4fd5c2194a8807469e47156af35502e10aeb8a3f64a01ff802cd8669c7e668cc87b593b182fd830a126d002b5d5d7b6c77991158bffdb0b5b997f6b3

Download Submit
C:\Program Files (x86)\UTC Web Components\npUTCWebVideoPlugin.dll

Filesize
406KB

MD5
e7bed0f71f5c412dde49664198b0d97b

SHA1
c94c278bd526d88964c3b8939f732d53d38cd567

SHA256
18789ec3d7746da14e12719909aff55c0ac286d8e7825ef7335652efd55b5b9a

SHA512
0b7682198467e6847325aac385561cb7348599163b573bb6bf006f16893a5c7b4d6d3405aa0952b3567c31ac8db7920ccc9fb555eb670427cef99feaf4b2f5bd

Download Submit
C:\Program Files (x86)\UTC Web Components\unins000.dat

Filesize
2KB

MD5
a2c7b1ba30e98bc692a7f6889a508e61

SHA1
c623c76058a2a1020dbd97aafb876e735e03e67f

SHA256
f9a155a0281e440824fbaa4fdb53c99c1e1736cb939f2a153e72d024a2464301

SHA512
79d1b593dc177fc06a7afb28dc5bf352364a42fbc7cfd665c7c4b67006f244ba0cb588baf55704aec896109407d89b5c9791be536a9765eaf41fba5f3a8a2a98

Download Submit
C:\Program Files (x86)\UTC Web Components\unins000.exe

Filesize
690KB

MD5
50208f4ccf181af080e0c19365b67c10

SHA1
50e9e0052728a14b84379c79ea31dde9964beeae

SHA256
244953fd3eb8a5f502a9bbeffead504905e94d8a59e3da8808178fed5f2a5d4b

SHA512
5bec203f932aad4446e3cb7dc71f689b92bb88c8ffc06c0001757ec15cdd78a5cf873c4ab4348ec095db3ca936ada5bcfb777f9b6ed81d91bb3ceb4274311169

Download Submit
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\UTCWebComponents\Uninstall UTC Web Components.lnk

Filesize
1KB

MD5
52e1e4a138b799e2ebac2add183eee20

SHA1
916b94001abfc5a07a5cb42789c3f27b62c828fc

SHA256
9b7372311379b62ab02bc018a5131801d4dd9f9ed0b639f3cbec26d353ab3ab8

SHA512
2f2d98b2be36187e4c4485714fdd5e82c5ff96b60f8e7d92bc443d80b3f62bf74692ee327566316aa41c254c4a7f3d8687fca23833850bcc15f9d76cdd7d5dc1

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\activity-stream.discovery_stream.json.tmp

Filesize
22KB

MD5
2d4229661aad0ec457acf800abb70b27

SHA1
e0cb9b42a21431475f91b93cf78d02993879603e

SHA256
93922ef395aca0a0c73635df756dab38c923930136bbf50ddb443c403f14a1c7

SHA512
4067f10789541936c67ec5fb7638d3c8ad333cb2d364a8e6c4973237a3dcdb8018878ecd47ac48683eba77f1c95121a7253d2bbd8ec286e6b2fd8426d5648d18

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\1012

Filesize
10KB

MD5
8c0aeeb7dfd991304c6e5019761eed91

SHA1
2d253ae0c5176c68cdd468c1459942c25c9a9d3e

SHA256
461ebf1ed5d4ca8cd3116895313aaa0724a6cb7bdfb929501657310fe043f9bc

SHA512
eb07411680be88d2261554bc327724763be2760c0479150ef808bc201e742ff32691379c2624eb9e6c341eaadcd728437f69e996360517f9d5d80d3a65d5829c

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\cache2\doomed\5860

Filesize
14KB

MD5
598f762a53a7fd1b8c7475b35e61a287

SHA1
cd25d4852744b646f805cdce9229edf6dcbf9fa8

SHA256
a1d306e697b0c1a9cfe05d898f972d6348902725d0f5c6eaaeaf0ce48213505d

SHA512
10aa45e7a0550b69a7fcdf3745ce72f8ec1658b241e86cbc47c497011fbf368d95b5cb3e0acf85db722e5e58d2c4812f5557720b6b5e573a5976ae8c04a81cd0

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\startupCache\urlCache.bin

Filesize
2KB

MD5
92dd77539f6e2ac5e010ea2ac1cb9442

SHA1
391546122b2ca47fb4d8868117ed6c29f0152998

SHA256
bc26dc0b7805e045c41f1eef9f74d38fb21ebbbe53da507d8a5b1d9fa65fc879

SHA512
29dc0240ed8ae7927aa8ecac0ffb75eaa857e8d48f59890551e43583a67f273003b9d4ee5ea74091495797a28182e59daac4299bc011b5460d49203be95dcf0e

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\2b7acdhd.default-release\thumbnails\7fcba1f627830f312b8a719411c8b650.png

Filesize
16KB

MD5
7caedf62302dfa913b45946a11c8c3e3

SHA1
d1eea1342cad49b5ef7fdf61e3df8bf87002133f

SHA256
1ed46314556698a1aa39672e69deda9055a359a1375a1957bdbda0b61fc5a5b2

SHA512
45c8c329300fb01a7bc28f54655c48cc7bf51cf38c22aaf920fb46092ec7c6c0e9adb21a55806e63c11ab5093ea629834bf870b3954c43a403c69e05d04f95e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G1P5D.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ROG6L.tmp\UTCWebComponents.tmp

Filesize
680KB

MD5
14924c1b767c6e6a24be1235b250eb86

SHA1
6a11e672b51d597db871ede8dde868ef3cdea0a7

SHA256
8148e8e6916f0df121f26fa5465021ce192546eea4c0a363859ef5ea39e65386

SHA512
1200e08f1f0167cee1443ac4ec57cacdb468061295d8708d831a7947f4baf056027734ca73cdb2031af3ca1e1dd72c1f63563d309325aa0be7ebc0df14895e06

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
792b2bb7d34b545fac6ab093cbe01021

SHA1
de63cb135cdc6bf57c0456e4e45ef67b9daa83c9

SHA256
3aad2c5e9877ae3184a1c632db78b13d19dc535983d50a4ca914c93b4042d6d3

SHA512
5e55c5c3bfdaeac9df6f7993385d4e29263ecf7f956983808617dbb91702a37b43255f005520bc2d77c2a2c6426800e7713fc6e166035759c473c30a1a3ec58d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
15KB

MD5
29e7c282e9470e1bfde4336f88f13b02

SHA1
05f68a610216fb9f308a131cb35b0b50435c6561

SHA256
4e53742b97b0c2f916509f42d4d6e3b1b22175f02831209cb36a788d1660c1a5

SHA512
3c693086a7262abffe91afaebcc11aecb2eba14ba22b5fd006104cb805b733974a3f7784e26c0836caaadd0926f0eef1582f4dfafbe7fa8058704eb9b618052a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
711c3292268ea215574de8886ae10fca

SHA1
2a7e89da087fec866a631fd1d28a71d3b3def5fd

SHA256
6faa8f753af38085f5a7e98f085af95914381bc0a59c9e2e8b6c2d8cd8691559

SHA512
e46f3c1db7f971af9e36ee73d4069e4f0fea57420802f996e82ada4240d26e1c75be470c1920c44dc98d1e7afe9bd0bd091e6797cc7bb26a9d318e0cc5cf3a62

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\375593c7-35c0-4f11-a206-84baabfb0d8e

Filesize
790B

MD5
2c0a74c7d4a21f524dc0c774e6d383cc

SHA1
cd681d7c5074bc6ce661cf77ddf073cd9d62fddd

SHA256
653c1db98c3bf285d106178c475c51c269710cfba704d8926c4f9cddb8f0ad73

SHA512
323917a3bdc4a8840c3585b3ebde66cf79cbaeb9917f4a37e216282f9649bd7827c94c3d425c53940f4a6cb64e4ce42171038d4a8d868a2c939e72a35e615d27

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\3ad0ebe8-07b6-48a5-a95f-625b497ba468

Filesize
746B

MD5
19d03158d70e8d6e1fe2b5137b617132

SHA1
64cf30961c5632a88edc4763108b8309c7db177b

SHA256
f6611769ca6d646b14515af0fbe6410f97c2631003c58eab16d30fd1dcff1865

SHA512
fcad926203c3126064baf51c042a4fa1662045e5b5b69d9fe0d2f4af7891981dc16a7c63418a2324606d19d7ea90b53d7aff3ed650e193d762840dd719bf24c6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\4a1f66e4-fd8d-4c3c-8e5d-b49fdc43c156

Filesize
767B

MD5
f1213c67c43bcc41d792c5a6d86fb508

SHA1
a6bf829dfe697ca91181b386f2e492561e40ddf7

SHA256
450e1e566b7a6c73ae91531694c783e8e70447bbbb33296e1dc66771a997045a

SHA512
308e983f4734caa9be9c3924d1bc607823d6959867e1ad150f2ef81a43ee3f8abf06dccbbf7a5acb4a9f5acd674d607ac858a04ccde927108e80437b3378d403

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\datareporting\glean\pending_pings\fffaa3c9-50ee-4e14-b469-392eb237f1a5

Filesize
10KB

MD5
ee44d2112b359ec9213cc6c617e791ba

SHA1
78e0fa6bb02077a2e0a6b2d435be07092e3f8591

SHA256
5d1e8b426f829f2d375441ad45064a3494c951d23a1b84bb55b492f232a2beea

SHA512
2ee032693caedcd01ce057fb9ef05d9f877f6c52bff646ffa70355f2cb47ca5c6d547dbfbac71d5a411fb566160c5df6f4dd4c3ed2eab23080557ac1af4f2e56

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
c1e0dce8d414af656e919da2f7e8230c

SHA1
868072bbc3f0f0b861022e459e83716f57e087e9

SHA256
cd96b281103b0e163417de236148be3483de4ff66436b6f9bd466358bba3403e

SHA512
5a80fb316b54ad3586bada985baa883b4ed3cd43fcdaf22e7347d4a75139a4d6773dd04ca741cfce03d1f77c537fc5a36f0b1dffe659a8ad8ce90474754e196b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
59e65046c7240d539cde487796ea8268

SHA1
724092f12264511c1e083de334669ef413623bf2

SHA256
3e7afa722ea4902399edb05820e1520d6fcb5954663cef584b8b9240ba683082

SHA512
d029da77968738f8723ea512cc588b130a9be83861c8ea7f4bd4dcf0d1755759a342047dc12d03b18b48af73d9fd243e96544a688c5fd8bf4e35ad75f5975322

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs-1.js

Filesize
6KB

MD5
d721ae48b991c3ec620eb3a0f628a917

SHA1
3883415001077715851760cedc4df6e3259556f9

SHA256
5d6c8a83321e3f59e7d40d9da9eebcba6c01451d3532c3ec83c4990d763d682f

SHA512
3e19896479a3b3570fc12ca016e9c3acd3a902c5289ce6171b8740f8248fc8a82d04691a1fe8f972ac6ba4ea3afc357b94c5e5dd0b41c5ca3ac61ff19a813984

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\prefs.js

Filesize
6KB

MD5
fccf8df12a208d7be710cf70580dc09e

SHA1
166610c3e33997055e93cb37bf2f6b310a0620d7

SHA256
b268e5317b9eb65ccbbcf20f593ac3c8065e19a55784c3a5701528e2a79fd88e

SHA512
41d3a2fc90a6284a752908eca30e090b94aba85bb4eaddd9adc3fd1a86ef6c7eb1f319440e486ff402998c978029650fe21bdcddeed26ab11901e42881f94b35

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
53B

MD5
ea8b62857dfdbd3d0be7d7e4a954ec9a

SHA1
b43bc4b3ea206a02ef8f63d5bfad0c96bf2a3b2a

SHA256
792955295ae9c382986222c6731c5870bd0e921e7f7e34cc4615f5cd67f225da

SHA512
076ee83534f42563046d25086166f82e1a3ec61840c113aec67abe2d8195daa247d827d0c54e7e8f8a1bbf2d082a3763577587e84342ec160ff97905243e6d19

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionCheckpoints.json.tmp

Filesize
90B

MD5
c4ab2ee59ca41b6d6a6ea911f35bdc00

SHA1
5942cd6505fc8a9daba403b082067e1cdefdfbc4

SHA256
00ad9799527c3fd21f3a85012565eae817490f3e0d417413bf9567bb5909f6a2

SHA512
71ea16900479e6af161e0aad08c8d1e9ded5868a8d848e7647272f3002e2f2013e16382b677abe3c6f17792a26293b9e27ec78e16f00bd24ba3d21072bd1cae2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
c16be3568ecd48daf598d591ba469975

SHA1
112071fbf8d8d1cd9211575dd82bb10e1d6db765

SHA256
4743e8946c99e77f171edfe1277a40a7155be9fec2c6f2fb12ef30c7e41f9049

SHA512
59976193aca4abd1e1abfc7405e4d5e1ee33809fddb64d84c65d0cd49ceaf48429ff2a8669bececf4c06256592e6c566f68e06330df83a16f498f3139be5306c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
6d7f38ab800ec355ec4869dbc7f89ca6

SHA1
ae948470bb610ff8f2117767eee30e4ac83b5bfd

SHA256
bcda693e0eb45d2834e200bf37681f4e57772cdbb4bdbf1017654251d66c8c98

SHA512
eb79932cfde8d38ecc670fa2c5aca287432ecf9a46d3175a190c06e7e29af1ac25b6a169a7c7c299e2340a98b9b34ffcc1449bb3ed520228e68c4eecb1738cc4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
a847aedafae7af72313811c6d0f998c4

SHA1
dc655665a05f74da35d7668b330d56a7e7f71797

SHA256
6bd0de99638daff48af464e6143ec44e605e6426ce5c6fc5cb5853a2fcc4012f

SHA512
9f5ee73d86ef0e91eda910750d7642d7b56b02e90f1f5f80f2b60be17aefd5a2bc63efa76305393fbb59ef4a8eaad4a162d17ecc4fd5d0324043f86bc8eebd99

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
f0db14ca71edcc5fc17a7b71944f188a

SHA1
b902928a6aa04b4ebb6ce92cdd0815c9fe54a564

SHA256
95a421b2dff462beac0a4bcb93d2cbb7c344bc158147bcb9d8849b09af7fcad8

SHA512
f3538d6b4ff3f44d57e1eff1178f6bd73213dade4cb0188bc2c8edf445d7c4a78d49b00bff47ecc3f41dcaa3e39ff1fe3331ce29fd7c8df951c97e3a1e126063

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
1KB

MD5
b089ae2e7dcb0c2d7628c671e59ce999

SHA1
a2bb3bc29ad6052f55cd09f9a38533151736c517

SHA256
091e84ac33369f85888d19fd8b1ea9553c247b56aa50c6356254ed6974d32f6b

SHA512
58f3513bf30ed9895204db25c24cf0dded60327f4b7f490bc6437be5c4f8fafec5318c0761ff65767967fff5a8a6015d296221f44bac7b04f2e1e55e575559dd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
caa04fa37d5f17fe0ab48b18219b98ab

SHA1
0db54d2414a3f6a68f919a88325ede620cedd283

SHA256
92f08fcc5a93ac7de0575522c643d4377f6bcfed1110d1f53582d88464dcfb04

SHA512
a86b5d70d14d14088d8cf5f12b9ad721bf5c99ce8424b241a91f87b41eae03cd677c717994b2eee78a3d87a802ec42b83b80a6bb7c64611b0925c6248afb8851

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\sessionstore.jsonlz4

Filesize
2KB

MD5
c1f3775d300a325911c8be9af554da21

SHA1
ada27068a9806e1f4efbf50495a0967a0ceb6e6d

SHA256
5b9a67adf3e2f329c57ae4f489f51b84c34b3c257338049e2e485767d56c8bc3

SHA512
790eef1d5c0c111b8348849ca5e93a72338d1e79dd50444ea43930e224a6f4a1760b673d8a82b29c682f26520484200028add59718255e81d95893e7e307e83f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2b7acdhd.default-release\xulstore.json

Filesize
217B

MD5
58e240288763218d12bf235d34e5aee2

SHA1
89135494b57f590011c09668dec3b90d2c5ee9ae

SHA256
615f80e71dfde24711e7fefc1b7959f7592c5e5cf9ad0f3aecb4235b93187176

SHA512
caed2638902987aead199e73cffb90881bf245bbb616cb38c46b281d4aaaa54dc20a54e9bfe17a8d6e68847394c113fb7606e94b64f44ab0b52bf7846f26e936

Download Submit
C:\Users\Admin\Downloads\UTCWebComponents.BIRtgjel.exe.part

Filesize
9KB

MD5
2b4a6ee02cf7ee76519e543e430c453e

SHA1
43605895cf03ab49f2c55ccda4e1c4d89029afb5

SHA256
d858a21ac808b25dd82f9c51533c6a8a237c0314941b5c8f98f295ef0a10f309

SHA512
36b0171b3520c9940c7bb2a7d005b323a0cd4a7fea66ae98547e3992e0f2e59a02fca636daa6d3c1e228a8dc7dd7f08564585e0fa8cf3973dbcd1fb6edb72d50

Download Submit
C:\Users\Admin\Downloads\UTCWebComponents.exe

Filesize
2.9MB

MD5
3dde23965058db0a131cfeff60aec9e8

SHA1
a40648440ffc40eb173b637f47e5137ca1f89753

SHA256
46b55211fa1efb987ad56441b71a9c4fb2d9c96dbc23ea9b58e3c22314120e7c

SHA512
abf725658aa67ab43541c6bbbc4c96f71fe7822b423451f0d12821609ff080982038c7949b57cbc79fb69e2f48e3de11a140af8dbd2354019cef8b8c60692a33

Download Submit
C:\Users\Admin\UTCWebComponents\localconfig.xml

Filesize
783B

MD5
3d419d08ec1c27685c8a84500e8b00a3

SHA1
de0ff888ceaf6752b0812d69239182712b7d52e0

SHA256
ced6bd62f05799c2a7b9ed37b74cf287df1e44379f60b1c6db78bae6ab8010ab

SHA512
5645c5bed6f093f11be5ac07bcf219c6066c17d52e0291cdbe756d6337c231ec86e79cbc50632958b94f62ae3316b74e4fb70f352f679d832513d27937f5ad49

Download Submit
\Program Files (x86)\UTC Web Components\AudioIntercom.dll

Filesize
354KB

MD5
1e6ea5d69451c7165e4481001e484d3d

SHA1
deb97c00703021247ea08573360bc539c3e695fc

SHA256
4d6a7800c6fae1754d43070087bab71ed70b3e9051dcb756b85b7398ec03a28d

SHA512
5ac3dacdd989a00ffcb3549f8cd8d5b2c293c600a5638d191c07188a111620572eb89afbf83acdecd07635009892027ac4890509a0f8768307409fa9209818ec

Download Submit
\Program Files (x86)\UTC Web Components\AudioRender.dll

Filesize
80KB

MD5
dc44c208f60e7451fad7a28455a8aee1

SHA1
9fba99f7f584f49005bd665b08ec21c382e2e307

SHA256
cebbdd04b47d619b02fced2ca28aa19796f80ade141457ad391a5f1bff75ea51

SHA512
e967eec6f8faa42876c95d6c9d3ecf6d4b9397622c8ab81cc2937148362d06dca69d56e25a218ffe69c625f542417b29b5d7b0d23ece8dbbcedca04625907788

Download Submit
\Program Files (x86)\UTC Web Components\OpenAL32.dll

Filesize
417KB

MD5
52c83a72943b529b7f495b0606c117b6

SHA1
dcc74f5109a09c4cec8274f2968159c80016002d

SHA256
b21ae0059a8182a51d1645a44f403429e60e26453353c0d708d7f501557ca01c

SHA512
17179685e6e65c9130ccaea16c8953be818e4c6502595cb2e6dabebbc05f904e98b1797173e880ddfb64276cb0b53d48d8caae28457d1531160810af90eb6706

Download Submit
\Program Files (x86)\UTC Web Components\StreamTransClient.dll

Filesize
256KB

MD5
653c99f74f00ac7d6bdb8b997908693a

SHA1
f71590b81fe9846060e460395ef6812de8493d1c

SHA256
d4c1daf83ddee781834cf6c9de40141c11736b1fcf250974a34206970ac65cef

SHA512
dff628ab593133991b2323239723c0b8eb2d4e9e67ef46d868a72f865ad8da4fcc24ad82d335bb41d88f269b96bd57fa872a5135ac50d59565b0aacf69d0ed1e

Download Submit
\Program Files (x86)\UTC Web Components\SuperRender.dll

Filesize
326KB

MD5
3f7e90cb0c6f6a420701ec3a88d54db3

SHA1
0a83ab45ebb3997a2b0e6452d730ecc874930ade

SHA256
804c577d54a35e81c8eac74bf00f00adb7fe0c8760368aedde3fb285a5d565bf

SHA512
d552ec2cf828e1aed89d390c39d26ff5ebb980fac3c7e75ca37ff87730579f633d1361c19eb10c6594bc13edadf448b5ceb0f0556fdab51280c26d0edbc65ba0

Download Submit
memory/296-527-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/296-531-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/296-467-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1820-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1820-79-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1820-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2944-47-0x0000000005020000-0x0000000005258000-memory.dmp

Filesize
2.2MB

Download
memory/2944-51-0x0000000005460000-0x00000000055AE000-memory.dmp

Filesize
1.3MB

Download
memory/2944-63-0x00000000062D0000-0x0000000006352000-memory.dmp

Filesize
520KB

Download
memory/2944-70-0x00000000063A0000-0x0000000006402000-memory.dmp

Filesize
392KB

Download
memory/2944-56-0x0000000005F00000-0x00000000062C4000-memory.dmp

Filesize
3.8MB

Download
memory/3840-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3840-78-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4176-520-0x0000000006380000-0x00000000063E2000-memory.dmp

Filesize
392KB

Download
memory/4176-506-0x0000000005EB0000-0x0000000006274000-memory.dmp

Filesize
3.8MB

Download
memory/4176-513-0x0000000006280000-0x0000000006302000-memory.dmp

Filesize
520KB

Download
memory/4176-501-0x00000000053A0000-0x00000000054EE000-memory.dmp

Filesize
1.3MB

Download
memory/4176-496-0x0000000004EF0000-0x0000000005128000-memory.dmp

Filesize
2.2MB

Download
memory/5024-374-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5024-466-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5024-532-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download