Trojan.Siggen18.23797

Technical Information

To ensure autorun and distribution

Modifies the following registry keys

[<HKCU>\Software\Classes\ummy\shell\open\command] '' = '%LOCALAPPDATA%\ummy_light\Ummy Light.exe "%1"'
[<HKCU>\Software\Classes\mkv\shell\open\command] '' = '%LOCALAPPDATA%\ummy_light\Ummy Light.exe "%1"'
[<HKCU>\Software\Classes\mp4\shell\open\command] '' = '%LOCALAPPDATA%\ummy_light\Ummy Light.exe "%1"'
[<HKCU>\Software\Classes\avi\shell\open\command] '' = '%LOCALAPPDATA%\ummy_light\Ummy Light.exe "%1"'
[<HKCU>\Software\Classes\m4v\shell\open\command] '' = '%LOCALAPPDATA%\ummy_light\Ummy Light.exe "%1"'
[<HKCU>\Software\Classes\ummy\shell\open\command] '' = '"%LOCALAPPDATA%\ummy_light\Ummy Light.exe" "%1"'
[<HKCU>\Software\Classes\ummy\shell\open\command] '' = ''

Modifies file system

Creates the following files

%TEMP%\nsl5448.tmp\system.dll
%APPDATA%\ummy light\local storage\leveldb\manifest-000001
%APPDATA%\ummy light\local storage\leveldb\000001.dbtmp
%APPDATA%\ummy light\partitions\ui\code cache\js\index-dir\temp-index
%APPDATA%\ummy light\partitions\ui\code cache\wasm\index-dir\temp-index
%APPDATA%\ummy light\partitions\yt\code cache\js\index-dir\temp-index
%APPDATA%\ummy light\code cache\js\index-dir\temp-index
%APPDATA%\ummy light\code cache\wasm\index-dir\temp-index
%APPDATA%\ummy light\partitions\yt\code cache\wasm\index-dir\temp-index
%APPDATA%\ummy light\partitions\ui\cache\index
%APPDATA%\ummy light\partitions\ui\cache\data_0
%APPDATA%\ummy light\partitions\ui\cache\data_1
%APPDATA%\ummy light\partitions\ui\cache\data_2
%APPDATA%\ummy light\partitions\ui\cache\data_3
%APPDATA%\ummy light\cache\index
%APPDATA%\ummy light\cache\data_0
%APPDATA%\ummy light\cache\data_1
%APPDATA%\ummy light\cache\data_2
%APPDATA%\ummy light\local storage\leveldb\log
%LOCALAPPDATA%\ummy_light\swiftshader\libegl.dll
%APPDATA%\ummy light\partitions\yt\local storage\leveldb\000001.dbtmp
%APPDATA%\ummy light\partitions\yt\local storage\leveldb\log
%LOCALAPPDATA%\ummy_light\ummy light.exe
%LOCALAPPDATA%\ummy_light\vk_swiftshader.dll
%LOCALAPPDATA%\ummy_light\vulkan-1.dll
%LOCALAPPDATA%\ummy_light-updater\package.7z
%LOCALAPPDATA%\ummy_light\uninstall ummy light.exe
%APPDATA%\microsoft\windows\start menu\programs\ummy light.lnk
%TEMP%\nsl5448.tmp\winshell.dll
%HOMEPATH%\desktop\ummy light.lnk
%APPDATA%\ummy light\partitions\ui\local storage\leveldb\log
%APPDATA%\ummy light\partitions\ui\local storage\leveldb\manifest-000001
%APPDATA%\ummy light\code cache\js\index
%APPDATA%\ummy light\code cache\wasm\index
%APPDATA%\ummy light\partitions\ui\code cache\js\index
%APPDATA%\ummy light\partitions\ui\local storage\leveldb\000001.dbtmp
%APPDATA%\ummy light\partitions\ui\code cache\wasm\index
%APPDATA%\ummy light\partitions\yt\code cache\js\index
%APPDATA%\ummy light\partitions\yt\code cache\wasm\index
%APPDATA%\ummy light\partitions\yt\local storage\leveldb\manifest-000001
%LOCALAPPDATA%\ummy_light\swiftshader\libglesv2.dll
%APPDATA%\ummy light\cache\data_3
%APPDATA%\ummy light\partitions\ui\gpucache\index
%APPDATA%\ummy light\partitions\yt\2eaed543-c04f-48d3-9099-7b2c36393968.tmp
%APPDATA%\ummy light\cache\f_000001
%APPDATA%\ummy light\partitions\yt\cache\f_000001
%APPDATA%\ummy light\en-us-9-0.bdic
%APPDATA%\ummy light\dictionaries\en-us-9-0.bdic
%APPDATA%\ummy light\partitions\ui\cache\f_000001
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\log
%LOCALAPPDATA%\ummy_light\locales\ro.pak
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\manifest-000001
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000003.log
%APPDATA%\ummy light\quotamanager-journal
%APPDATA%\ummy light\quotamanager
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000004.log
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000005.ldb
%APPDATA%\ummy light\up_options.json
%APPDATA%\ummy light\partitions\ui\e55b928f-534a-41d4-bd4d-89360de7f424.tmp
%APPDATA%\ummy light\gpucache\data_2
%APPDATA%\ummy light\gpucache\data_3
%APPDATA%\ummy light\partitions\yt\cache\data_0
%APPDATA%\ummy light\partitions\yt\cache\index
%APPDATA%\ummy light\gpucache\index
%APPDATA%\ummy light\partitions\yt\cache\data_2
%APPDATA%\ummy light\partitions\yt\cache\data_3
%APPDATA%\ummy light\partitions\ui\gpucache\data_0
%APPDATA%\ummy light\partitions\ui\gpucache\data_1
%APPDATA%\ummy light\partitions\ui\gpucache\data_2
%APPDATA%\ummy light\partitions\ui\gpucache\data_3
%APPDATA%\ummy light\cookies-journal
%APPDATA%\ummy light\cookies
%APPDATA%\ummy light\config.json
%APPDATA%\ummy light\logs\ummy-2022-07-13.log
%APPDATA%\ummy light\partitions\ui\c089e3d7-4320-4dc6-995c-eec9bb5da53c.tmp
%APPDATA%\ummy light\bb593910-0090-4976-aab0-146ad91fd596.tmp
%APPDATA%\ummy light\partitions\yt\26712a9c-e056-4a3d-a1a8-4910740f3539.tmp
%APPDATA%\ummy light\f5f0def5-4333-49e8-9d55-ec0d62a16b53.tmp
%APPDATA%\ummy light\partitions\ui\4f9efdb5-dfa9-469a-93cd-f4552281ac55.tmp
%APPDATA%\ummy light\gpucache\data_0
%APPDATA%\ummy light\partitions\yt\cache\data_1
%APPDATA%\ummy light\gpucache\data_1
%LOCALAPPDATA%\ummy_light\resources\elevate.exe
%LOCALAPPDATA%\ummy_light\resources\bin_ia32\youtube-dl.exe
%LOCALAPPDATA%\ummy_light\resources\bin_ia32\ffprobe.exe
%LOCALAPPDATA%\ummy_light\locales\en-gb.pak
%LOCALAPPDATA%\ummy_light\locales\en-us.pak
%LOCALAPPDATA%\ummy_light\locales\es-419.pak
%LOCALAPPDATA%\ummy_light\locales\es.pak
%LOCALAPPDATA%\ummy_light\locales\et.pak
%LOCALAPPDATA%\ummy_light\locales\fa.pak
%LOCALAPPDATA%\ummy_light\locales\fi.pak
%LOCALAPPDATA%\ummy_light\locales\fil.pak
%LOCALAPPDATA%\ummy_light\locales\fr.pak
%LOCALAPPDATA%\ummy_light\locales\gu.pak
%LOCALAPPDATA%\ummy_light\locales\he.pak
%LOCALAPPDATA%\ummy_light\locales\hi.pak
%LOCALAPPDATA%\ummy_light\locales\hr.pak
%LOCALAPPDATA%\ummy_light\locales\hu.pak
%LOCALAPPDATA%\ummy_light\locales\id.pak
%LOCALAPPDATA%\ummy_light\locales\it.pak
%LOCALAPPDATA%\ummy_light\locales\de.pak
%LOCALAPPDATA%\ummy_light\locales\ja.pak
%LOCALAPPDATA%\ummy_light\locales\da.pak
%LOCALAPPDATA%\ummy_light\locales\ca.pak
%TEMP%\nsl5448.tmp\stdutils.dll
%TEMP%\nsl5448.tmp\nsexec.dll
%TEMP%\nsl5448.tmp\spiderbanner.dll
%TEMP%\nsl5448.tmp\nsprocess.dll
%TEMP%\nsl5448.tmp\inetc.dll
%LOCALAPPDATA%\ummy_light\uninstallericon.ico
%TEMP%\nsl5448.tmp\package.7z
%TEMP%\nsl5448.tmp\nsis7z.dll
%LOCALAPPDATA%\ummy_light\chrome_100_percent.pak
%LOCALAPPDATA%\ummy_light\chrome_200_percent.pak
%LOCALAPPDATA%\ummy_light\icudtl.dat
%LOCALAPPDATA%\ummy_light\license.electron.txt
%LOCALAPPDATA%\ummy_light\licenses.chromium.html
%LOCALAPPDATA%\ummy_light\locales\am.pak
%LOCALAPPDATA%\ummy_light\locales\ar.pak
%LOCALAPPDATA%\ummy_light\locales\bg.pak
%LOCALAPPDATA%\ummy_light\locales\bn.pak
%LOCALAPPDATA%\ummy_light\locales\cs.pak
%LOCALAPPDATA%\ummy_light\locales\kn.pak
%LOCALAPPDATA%\ummy_light\locales\el.pak
%LOCALAPPDATA%\ummy_light\locales\ko.pak
%LOCALAPPDATA%\ummy_light\locales\zh-cn.pak
%LOCALAPPDATA%\ummy_light\resources.pak
%LOCALAPPDATA%\ummy_light\resources\app-update.yml
%LOCALAPPDATA%\ummy_light\resources\app.asar
%LOCALAPPDATA%\ummy_light\resources\app.asar.unpacked\bundle\6111917f3a5c9c62e67df5a0d0e9136e.ico
%LOCALAPPDATA%\ummy_light\resources\app.asar.unpacked\bundle\7f8b663e6218621b36b1867f8f2ff543.ico
%LOCALAPPDATA%\ummy_light\resources\app.asar.unpacked\bundle\af46f86f65f624cfee407eac19d946db.ico
%LOCALAPPDATA%\ummy_light\resources\app.asar.unpacked\bundle\c0edcf9115ff85441b19ff0e2f387c2d.ico
%LOCALAPPDATA%\ummy_light\snapshot_blob.bin
%LOCALAPPDATA%\ummy_light\v8_context_snapshot.bin
%LOCALAPPDATA%\ummy_light\vk_swiftshader_icd.json
%LOCALAPPDATA%\ummy_light\d3dcompiler_47.dll
%LOCALAPPDATA%\ummy_light\ffmpeg.dll
%LOCALAPPDATA%\ummy_light\libegl.dll
%LOCALAPPDATA%\ummy_light\libglesv2.dll
%LOCALAPPDATA%\ummy_light\resources\bin_ia32\ffmpeg.exe
%LOCALAPPDATA%\ummy_light\locales\vi.pak
%LOCALAPPDATA%\ummy_light\locales\tr.pak
%LOCALAPPDATA%\ummy_light\locales\zh-tw.pak
%LOCALAPPDATA%\ummy_light\locales\uk.pak
%LOCALAPPDATA%\ummy_light\locales\th.pak
%LOCALAPPDATA%\ummy_light\locales\lt.pak
%LOCALAPPDATA%\ummy_light\locales\ml.pak
%LOCALAPPDATA%\ummy_light\locales\mr.pak
%LOCALAPPDATA%\ummy_light\locales\ms.pak
%LOCALAPPDATA%\ummy_light\locales\nb.pak
%LOCALAPPDATA%\ummy_light\locales\nl.pak
%LOCALAPPDATA%\ummy_light\locales\pl.pak
%LOCALAPPDATA%\ummy_light\locales\pt-br.pak
%APPDATA%\ummy light\4c255eb0-11c0-4059-ab30-8ae5f391f493.tmp
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp
%LOCALAPPDATA%\ummy_light\locales\pt-pt.pak
%LOCALAPPDATA%\ummy_light\locales\sk.pak
%LOCALAPPDATA%\ummy_light\locales\sl.pak
%LOCALAPPDATA%\ummy_light\locales\sr.pak
%LOCALAPPDATA%\ummy_light\locales\sv.pak
%LOCALAPPDATA%\ummy_light\locales\sw.pak
%LOCALAPPDATA%\ummy_light\locales\ta.pak
%LOCALAPPDATA%\ummy_light\locales\te.pak
%LOCALAPPDATA%\ummy_light\locales\lv.pak
%LOCALAPPDATA%\ummy_light\locales\ru.pak
%APPDATA%\ummy light\partitions\yt\737cbb8f-01c0-43f4-81b5-c217c3742689.tmp

Deletes the following files

%TEMP%\nsl5448.tmp\inetc.dll
%TEMP%\nsl5448.tmp\nsexec.dll
%TEMP%\nsl5448.tmp\nsis7z.dll
%TEMP%\nsl5448.tmp\nsprocess.dll
%TEMP%\nsl5448.tmp\spiderbanner.dll
%TEMP%\nsl5448.tmp\stdutils.dll
%TEMP%\nsl5448.tmp\system.dll
%TEMP%\nsl5448.tmp\winshell.dll
%APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000003.log
%APPDATA%\ummy light\partitions\ui\network persistent state~rffcbb7.tmp
%APPDATA%\ummy light\network persistent state~rffcf21.tmp
%APPDATA%\ummy light\partitions\yt\network persistent state~rffcf7e.tmp
%APPDATA%\ummy light\preferences~rf1071f4.tmp

Moves the following files

from %TEMP%\nsl5448.tmp\package.7z to %LOCALAPPDATA%\ummy_light-updater\package.7z
from %APPDATA%\ummy light\network persistent state to %APPDATA%\ummy light\network persistent state~rffcf21.tmp
from %APPDATA%\ummy light\partitions\ui\network persistent state to %APPDATA%\ummy light\partitions\ui\network persistent state~rffcbb7.tmp
from %APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\000001.dbtmp to %APPDATA%\ummy light\indexeddb\file__0.indexeddb.leveldb\current
from %APPDATA%\ummy light\partitions\yt\2eaed543-c04f-48d3-9099-7b2c36393968.tmp to %APPDATA%\ummy light\partitions\yt\network persistent state
from %APPDATA%\ummy light\partitions\ui\4f9efdb5-dfa9-469a-93cd-f4552281ac55.tmp to %APPDATA%\ummy light\partitions\ui\network persistent state
from %APPDATA%\ummy light\f5f0def5-4333-49e8-9d55-ec0d62a16b53.tmp to %APPDATA%\ummy light\network persistent state
from %APPDATA%\ummy light\partitions\yt\26712a9c-e056-4a3d-a1a8-4910740f3539.tmp to %APPDATA%\ummy light\partitions\yt\preferences
from %APPDATA%\ummy light\bb593910-0090-4976-aab0-146ad91fd596.tmp to %APPDATA%\ummy light\preferences
from %APPDATA%\ummy light\partitions\yt\network persistent state to %APPDATA%\ummy light\partitions\yt\network persistent state~rffcf7e.tmp
from %APPDATA%\ummy light\partitions\ui\c089e3d7-4320-4dc6-995c-eec9bb5da53c.tmp to %APPDATA%\ummy light\partitions\ui\preferences
from %APPDATA%\ummy light\code cache\wasm\index-dir\temp-index to %APPDATA%\ummy light\code cache\wasm\index-dir\the-real-index
from %APPDATA%\ummy light\code cache\js\index-dir\temp-index to %APPDATA%\ummy light\code cache\js\index-dir\the-real-index
from %APPDATA%\ummy light\partitions\yt\code cache\js\index-dir\temp-index to %APPDATA%\ummy light\partitions\yt\code cache\js\index-dir\the-real-index
from %APPDATA%\ummy light\partitions\ui\code cache\wasm\index-dir\temp-index to %APPDATA%\ummy light\partitions\ui\code cache\wasm\index-dir\the-real-index
from %APPDATA%\ummy light\partitions\ui\code cache\js\index-dir\temp-index to %APPDATA%\ummy light\partitions\ui\code cache\js\index-dir\the-real-index
from %APPDATA%\ummy light\local storage\leveldb\000001.dbtmp to %APPDATA%\ummy light\local storage\leveldb\current
from %APPDATA%\ummy light\partitions\yt\local storage\leveldb\000001.dbtmp to %APPDATA%\ummy light\partitions\yt\local storage\leveldb\current
from %APPDATA%\ummy light\partitions\ui\local storage\leveldb\000001.dbtmp to %APPDATA%\ummy light\partitions\ui\local storage\leveldb\current
from %APPDATA%\ummy light\partitions\yt\code cache\wasm\index-dir\temp-index to %APPDATA%\ummy light\partitions\yt\code cache\wasm\index-dir\the-real-index
from %APPDATA%\ummy light\preferences to %APPDATA%\ummy light\preferences~rf1071f4.tmp

Substitutes the following files

%APPDATA%\ummy light\partitions\ui\network persistent state
%APPDATA%\ummy light\network persistent state
%APPDATA%\ummy light\partitions\yt\network persistent state

Network activity

Connects to

'go#####analytics.com':80
'de####p.televzr.com':80
'cd###elevzr.com':80
're####ctor.gvt1.com':443
'go#####analytics.com':443
'sf###lper.com':443

TCP

HTTP GET requests

http://de####p.televzr.com/download/updater/latest/ummy_light.nsis.7z
http://cd###elevzr.com/ummy/light/ummy_light-1.9.82-ia32.nsis.7z
http://de####p.televzr.com/api/geo

HTTP POST requests

http://www.go#####analytics.com/collect

Other

're####ctor.gvt1.com':443
'r1######pivhx-n8vl.gvt1.com':443
'go#####analytics.com':443
'sf###lper.com':443

UDP

DNS ASK go#####analytics.com
DNS ASK de####p.televzr.com
DNS ASK cd###elevzr.com
DNS ASK re####ctor.gvt1.com
DNS ASK r1######pivhx-n8vl.gvt1.com
DNS ASK sf###lper.com
'r1######pivhx-n8vl.gvt1.com':443
'go#####analytics.com':443

Miscellaneous

Searches for the following windows

ClassName: '#32770' WindowName: ''
ClassName: 'Chrome_MessageWindow' WindowName: '%APPDATA%\Ummy Light'

Creates and executes the following

'%LOCALAPPDATA%\ummy_light\ummy light.exe'
'%LOCALAPPDATA%\ummy_light\resources\bin_ia32\youtube-dl.exe' --update
'%LOCALAPPDATA%\ummy_light\ummy light.exe' --type=gpu-process --field-trial-handle=1056,619786717842799409,162874356463466074,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,SameSiteByDefaultCookies...
'%LOCALAPPDATA%\ummy_light\ummy light.exe' --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,619786717842799409,162874356463466074,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,Hardw...
'%LOCALAPPDATA%\ummy_light\ummy light.exe' --type=renderer --user-data-dir="%APPDATA%\Ummy Light" --standard-schemes=app --secure-schemes=app --bypasscsp-schemes --cors-schemes=fs --fetch-schemes=app,fs --service-worker-schemes --stream...
'%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"' (with hidden window)
'%LOCALAPPDATA%\ummy_light\resources\bin_ia32\youtube-dl.exe' --update' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v ummy /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v ummy /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v ummy /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v ummy /t REG_SZ /d "" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open /ve /t REG_SZ /d "Open with Ummy" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\ummy_light\Ummy Light.exe\" \"%1\"" /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open\command /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY "HKCU\SOFTWARE\Ummy Light" /v vid' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Ummy /v userid' (with hidden window)
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f' (with hidden window)
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve' (with hidden window)

Executes the following

'%WINDIR%\syswow64\cmd.exe' /C more < "<Full path to file>:Zone.Identifier"
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /v ummy /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.m4v\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /v ummy /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.avi\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /v ummy /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mp4\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\\UserChoice /v ProgId
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /v ummy /t REG_SZ /d "" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open /ve /t REG_SZ /d "Open with Ummy" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open\command /ve /t REG_SZ /d "\"%LOCALAPPDATA%\ummy_light\Ummy Light.exe\" \"%1\"" /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy\shell\open\command /f
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\ummy /f
'%WINDIR%\syswow64\reg.exe' QUERY "HKCU\SOFTWARE\Ummy Light" /v vid
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\SOFTWARE\Ummy /v userid
'%WINDIR%\syswow64\reg.exe' ADD HKCU\Software\Classes\.mkv\OpenWithProgids /f
'%WINDIR%\syswow64\reg.exe' QUERY HKCU\Software\Classes\ /ve

Technologies

Terminology

Training and education

Myths

Technical Information

Curing recommendations

Free trial