Overview

overview

8

Static

static

1

Device/Har...er.exe

windows7-x64

8

Device/Har...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-05-2023 07:23

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Device/HarddiskVolume3/Program Files (x86)/UltraViewer/Update/UVUpdater.exe

  • Size

    3.7MB

  • MD5

    5a25dc52d6248b6014d823a816dff477

  • SHA1

    082044061f252e2d90fd0d8689b2eb72cba434ce

  • SHA256

    8b2e4d77f99fe573244597dc8f1733656ee0ffb8ca6365d968af93f7f8943f56

  • SHA512

    5737d372b480f335355056bd245cb8d65b7f77ab4058607aade7f6eeab9c388a2ba7d962acceb6fc65ed67cb7165f13796eb0c0615acfb698acb1e073576fcb7

  • SSDEEP

    98304:I5zZ80gsEX+LjrKnRYgHFW2Ho7k7O5iN0BFCgvRRnf9ViPa:If80gsl3rKnTK5s0qg5Hca

Score
8/10
discoveryevasionupx

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
    evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 23 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Kills process with taskkill 64 IoCs
    evasion
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4584
    • C:\Users\Admin\AppData\Local\Temp\tmp796B.tmp
      "C:\Users\Admin\AppData\Local\Temp\tmp796B.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:5016
      • C:\Users\Admin\AppData\Local\Temp\is-S07ME.tmp\tmp796B.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-S07ME.tmp\tmp796B.tmp" /SL5="$50056,3448690,121344,C:\Users\Admin\AppData\Local\Temp\tmp796B.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1892
        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\UVUninstallHelper.exe
          "C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\UVUninstallHelper.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2216
        • C:\Windows\SysWOW64\net.exe
          "net" stop UltraViewService
          4⤵
          • Discovers systems in the same network
          • Suspicious use of WriteProcessMemory
          PID:4640
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop UltraViewService
            5⤵
              PID:912
          • C:\Windows\SysWOW64\net.exe
            "net" stop UltraViewService
            4⤵
            • Discovers systems in the same network
            • Suspicious use of WriteProcessMemory
            PID:1116
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop UltraViewService
              5⤵
                PID:1508
            • C:\Windows\SysWOW64\sc.exe
              "sc" delete UltraViewService
              4⤵
              • Launches sc.exe
              PID:3612
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3440
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2160
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1936
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5052
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1572
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:884
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1416
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1688
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:324
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
                PID:1768
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2632
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4148
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4260
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4472
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3296
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1464
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4668
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2692
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4040
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2160
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4968
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3204
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:528
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4160
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1448
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:372
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1780
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2032
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4224
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1524
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4760
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4332
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5108
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3352
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1460
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2692
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1148
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4812
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1396
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4144
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4756
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2316
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:1448
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2932
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4220
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1072
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4224
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:5072
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3504
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3528
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4428
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3428
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:1660
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3848
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:2404
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:5056
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:3940
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:4204
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:2068
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:208
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3952
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3356
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4324
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                PID:4148
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                  PID:4976
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:3032
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                    PID:2976
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:672
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:1316
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                      PID:2960
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                      • Kills process with taskkill
                      PID:4120
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                      • Kills process with taskkill
                      PID:4368
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                        PID:1148
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                          PID:3184
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:1396
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:1572
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                            PID:1076
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                              PID:264
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                                PID:2172
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                4⤵
                                  PID:1768
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  4⤵
                                    PID:4408
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4300
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:3724
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4436
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:1116
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4800
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                      PID:3240
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      4⤵
                                        PID:3500
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                        4⤵
                                        • Kills process with taskkill
                                        PID:3968
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                        4⤵
                                        • Kills process with taskkill
                                        PID:4304
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                        4⤵
                                        • Kills process with taskkill
                                        PID:2000
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                        4⤵
                                          PID:4128
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                          4⤵
                                            PID:5076
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                            4⤵
                                            • Kills process with taskkill
                                            PID:2512
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                            4⤵
                                            • Kills process with taskkill
                                            PID:212
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                            4⤵
                                            • Kills process with taskkill
                                            PID:5024
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                                            4⤵
                                            • Loads dropped DLL
                                            • Modifies registry class
                                            PID:4928
                                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                            "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                                            4⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious behavior: AddClipboardFormatListener
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3056
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
                                            4⤵
                                            • Loads dropped DLL
                                            • Drops file in Program Files directory
                                            PID:1152
                                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                            "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
                                            4⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3296
                                            • C:\Windows\SysWOW64\sc.exe
                                              sc failure "UltraViewService" reset= 0 actions= restart/60000
                                              5⤵
                                              • Launches sc.exe
                                              PID:1656
                                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                            "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
                                            4⤵
                                            • Executes dropped EXE
                                            • Loads dropped DLL
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3024
                                    • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                      "C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Drops file in Program Files directory
                                      • Modifies data under HKEY_USERS
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:2960
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                        2⤵
                                        • Drops file in System32 directory
                                        PID:4756
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                        2⤵
                                          PID:3652
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                          2⤵
                                            PID:1948

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                          Filesize

                                          132KB

                                          MD5

                                          33bb06b97f8f188735f4aae5b413eef8

                                          SHA1

                                          e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                          SHA256

                                          931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                          SHA512

                                          abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                          Filesize

                                          132KB

                                          MD5

                                          33bb06b97f8f188735f4aae5b413eef8

                                          SHA1

                                          e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                          SHA256

                                          931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                          SHA512

                                          abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                          Filesize

                                          132KB

                                          MD5

                                          33bb06b97f8f188735f4aae5b413eef8

                                          SHA1

                                          e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                          SHA256

                                          931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                          SHA512

                                          abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                          Filesize

                                          132KB

                                          MD5

                                          33bb06b97f8f188735f4aae5b413eef8

                                          SHA1

                                          e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                          SHA256

                                          931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                          SHA512

                                          abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                                          Filesize

                                          132KB

                                          MD5

                                          33bb06b97f8f188735f4aae5b413eef8

                                          SHA1

                                          e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                          SHA256

                                          931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                          SHA512

                                          abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\Language\English.txt
                                          Filesize

                                          14KB

                                          MD5

                                          b6a8ccdc51964e1551bef57b4a42a899

                                          SHA1

                                          52de4c2fc039af9a2f1295e8419123ba89ee5858

                                          SHA256

                                          c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a

                                          SHA512

                                          8d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini
                                          Filesize

                                          1KB

                                          MD5

                                          473b3896eae7ea66f61e9d0ffbe5b9b1

                                          SHA1

                                          d7ef69586317f7472ce400bc7bef75bfa4095592

                                          SHA256

                                          d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f

                                          SHA512

                                          981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\MSVBVM60.DLL
                                          Filesize

                                          1.3MB

                                          MD5

                                          5343a19c618bc515ceb1695586c6c137

                                          SHA1

                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                          SHA256

                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                          SHA512

                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                          Filesize

                                          496KB

                                          MD5

                                          5da17fa97fce539c78e3018ee1c29cd0

                                          SHA1

                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                          SHA256

                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                          SHA512

                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                          Filesize

                                          496KB

                                          MD5

                                          5da17fa97fce539c78e3018ee1c29cd0

                                          SHA1

                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                          SHA256

                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                          SHA512

                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                          Filesize

                                          496KB

                                          MD5

                                          5da17fa97fce539c78e3018ee1c29cd0

                                          SHA1

                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                          SHA256

                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                          SHA512

                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                          Filesize

                                          496KB

                                          MD5

                                          5da17fa97fce539c78e3018ee1c29cd0

                                          SHA1

                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                          SHA256

                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                          SHA512

                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                          Filesize

                                          496KB

                                          MD5

                                          5da17fa97fce539c78e3018ee1c29cd0

                                          SHA1

                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                          SHA256

                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                          SHA512

                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                          Filesize

                                          1.0MB

                                          MD5

                                          ea0aea9ab8e38a0d848754c120e8c3f6

                                          SHA1

                                          63091e0db17c98a26168bc391a455f308c9a17c8

                                          SHA256

                                          b0e214988e3c3ced0bca3773db884a83ed3262e3ecc0bb20df5b0b2ef9394116

                                          SHA512

                                          3c10d2181465e6ff188f9b60913030ef7b98ce58147a725d9b59211afc559b2aff5aa4c7c8f8781a4b99f5c3b020f6c810974f77c03c7e2a05b9bc548cd83fee

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.tlb
                                          Filesize

                                          236KB

                                          MD5

                                          6905ce31fccabd2c0b51bf910698ad83

                                          SHA1

                                          940ea6dbd498cb89423e58186222da2cc09fb45f

                                          SHA256

                                          670896b87a02b8cf9d715ad0c62ed04160ddc5fc075adc52cb2eb038f9ecd282

                                          SHA512

                                          6a31920226a5b774134ad7ff686b42f1965496efc6516e1dae4634b7c172243a35ba005dcb50e3c2d570a1e9228cc2fd11cc67679a0b79998ff67dbd71b0cbc4

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                          Filesize

                                          979KB

                                          MD5

                                          907f91ee555e942ce3d8707c8a4b27cf

                                          SHA1

                                          2ee2cc5fe00ad83ff0f75cfb8c3f2f7a52998960

                                          SHA256

                                          0975e20fe4f79031a9c01099bb81387a18068e2ccfa1e428030a17ce19169690

                                          SHA512

                                          600d79e580927cc0c762b44a029141c904dd9264845f56e13f6e43acd6b5c397efb2b5882666143d294872c6ee0b506bd6a943591af12febada5b3c414b00481

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                          Filesize

                                          979KB

                                          MD5

                                          907f91ee555e942ce3d8707c8a4b27cf

                                          SHA1

                                          2ee2cc5fe00ad83ff0f75cfb8c3f2f7a52998960

                                          SHA256

                                          0975e20fe4f79031a9c01099bb81387a18068e2ccfa1e428030a17ce19169690

                                          SHA512

                                          600d79e580927cc0c762b44a029141c904dd9264845f56e13f6e43acd6b5c397efb2b5882666143d294872c6ee0b506bd6a943591af12febada5b3c414b00481

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                          Filesize

                                          979KB

                                          MD5

                                          907f91ee555e942ce3d8707c8a4b27cf

                                          SHA1

                                          2ee2cc5fe00ad83ff0f75cfb8c3f2f7a52998960

                                          SHA256

                                          0975e20fe4f79031a9c01099bb81387a18068e2ccfa1e428030a17ce19169690

                                          SHA512

                                          600d79e580927cc0c762b44a029141c904dd9264845f56e13f6e43acd6b5c397efb2b5882666143d294872c6ee0b506bd6a943591af12febada5b3c414b00481

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                          Filesize

                                          979KB

                                          MD5

                                          907f91ee555e942ce3d8707c8a4b27cf

                                          SHA1

                                          2ee2cc5fe00ad83ff0f75cfb8c3f2f7a52998960

                                          SHA256

                                          0975e20fe4f79031a9c01099bb81387a18068e2ccfa1e428030a17ce19169690

                                          SHA512

                                          600d79e580927cc0c762b44a029141c904dd9264845f56e13f6e43acd6b5c397efb2b5882666143d294872c6ee0b506bd6a943591af12febada5b3c414b00481

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                          Filesize

                                          979KB

                                          MD5

                                          907f91ee555e942ce3d8707c8a4b27cf

                                          SHA1

                                          2ee2cc5fe00ad83ff0f75cfb8c3f2f7a52998960

                                          SHA256

                                          0975e20fe4f79031a9c01099bb81387a18068e2ccfa1e428030a17ce19169690

                                          SHA512

                                          600d79e580927cc0c762b44a029141c904dd9264845f56e13f6e43acd6b5c397efb2b5882666143d294872c6ee0b506bd6a943591af12febada5b3c414b00481

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config
                                          Filesize

                                          310B

                                          MD5

                                          42b8d26600dcb85572ee43616f929d6a

                                          SHA1

                                          31a4c46641129ef59eb925621c1aa4f8401d776c

                                          SHA256

                                          99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

                                          SHA512

                                          d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                          Filesize

                                          225KB

                                          MD5

                                          dc92fa144927ee1cbe5d9be16f2000cc

                                          SHA1

                                          e8990de7e95263729bda2d853002e27ede9db6db

                                          SHA256

                                          d70b5c967207c67828197c285a0b89ed0ceb2b67103b1b7a10d95dc6b4c238c3

                                          SHA512

                                          359283fbcd06897c064a4dd945656520ab20ce5b82eac435d1b80f491cf3589054637bfd428a94f64ef45059bbb8d52254ffac6aaabd29372d6465282b6f6203

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                          Filesize

                                          225KB

                                          MD5

                                          dc92fa144927ee1cbe5d9be16f2000cc

                                          SHA1

                                          e8990de7e95263729bda2d853002e27ede9db6db

                                          SHA256

                                          d70b5c967207c67828197c285a0b89ed0ceb2b67103b1b7a10d95dc6b4c238c3

                                          SHA512

                                          359283fbcd06897c064a4dd945656520ab20ce5b82eac435d1b80f491cf3589054637bfd428a94f64ef45059bbb8d52254ffac6aaabd29372d6465282b6f6203

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe.config
                                          Filesize

                                          225B

                                          MD5

                                          679aca3e8125584e8704b2dfdfa20a0b

                                          SHA1

                                          bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                          SHA256

                                          470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                          SHA512

                                          8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                          Filesize

                                          1.3MB

                                          MD5

                                          5343a19c618bc515ceb1695586c6c137

                                          SHA1

                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                          SHA256

                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                          SHA512

                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                          Filesize

                                          1.3MB

                                          MD5

                                          5343a19c618bc515ceb1695586c6c137

                                          SHA1

                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                          SHA256

                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                          SHA512

                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                          Filesize

                                          1.3MB

                                          MD5

                                          5343a19c618bc515ceb1695586c6c137

                                          SHA1

                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                          SHA256

                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                          SHA512

                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                          Filesize

                                          1.3MB

                                          MD5

                                          5343a19c618bc515ceb1695586c6c137

                                          SHA1

                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                          SHA256

                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                          SHA512

                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\uvh.dll
                                          Filesize

                                          124KB

                                          MD5

                                          8b3f15a335710c799eae2395fa6b322d

                                          SHA1

                                          81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                          SHA256

                                          09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                          SHA512

                                          c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                          Download Submit

                                        • C:\Program Files (x86)\UltraViewer\uvh.dll
                                          Filesize

                                          124KB

                                          MD5

                                          8b3f15a335710c799eae2395fa6b322d

                                          SHA1

                                          81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                          SHA256

                                          09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                          SHA512

                                          c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UltraViewer_Desktop.exe.log
                                          Filesize

                                          1KB

                                          MD5

                                          bf9fccd82a74ae0fe94fe7f265ac9bca

                                          SHA1

                                          701036824a82ddaba67b37f545eb42e8ddf996fd

                                          SHA256

                                          10fb5250e5422aba27206a81c71b72b98a1d2e250a2c112c0ffb8a9f28230144

                                          SHA512

                                          fdc4a7a0e839056f1d00a3242c25791fad96679e3d5f33da57d5b4acb84bf8d143bdc592714eeb35be1d231c9bea3cf00412b082d2a9c81f1340717a0852394e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regasm.exe.log
                                          Filesize

                                          507B

                                          MD5

                                          76ffb2f33cb32ade8fc862a67599e9d8

                                          SHA1

                                          920cc4ab75b36d2f9f6e979b74db568973c49130

                                          SHA256

                                          f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

                                          SHA512

                                          f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\UVUninstallHelper.exe
                                          Filesize

                                          43KB

                                          MD5

                                          ececb301656f5f8c6a46a8abf8d928fe

                                          SHA1

                                          9bdf8a054c71d34837262ab306db92d3ee70db3b

                                          SHA256

                                          801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                          SHA512

                                          314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\UVUninstallHelper.exe
                                          Filesize

                                          43KB

                                          MD5

                                          ececb301656f5f8c6a46a8abf8d928fe

                                          SHA1

                                          9bdf8a054c71d34837262ab306db92d3ee70db3b

                                          SHA256

                                          801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                          SHA512

                                          314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\UVUninstallHelper.exe.config
                                          Filesize

                                          225B

                                          MD5

                                          679aca3e8125584e8704b2dfdfa20a0b

                                          SHA1

                                          bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                          SHA256

                                          470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                          SHA512

                                          8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\idp.dll
                                          Filesize

                                          232KB

                                          MD5

                                          55c310c0319260d798757557ab3bf636

                                          SHA1

                                          0892eb7ed31d8bb20a56c6835990749011a2d8de

                                          SHA256

                                          54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                                          SHA512

                                          e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\isxdl.dll
                                          Filesize

                                          121KB

                                          MD5

                                          48ad1a1c893ce7bf456277a0a085ed01

                                          SHA1

                                          803997ef17eedf50969115c529a2bf8de585dc91

                                          SHA256

                                          b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                          SHA512

                                          7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-F1QR4.tmp\isxdl.dll
                                          Filesize

                                          121KB

                                          MD5

                                          48ad1a1c893ce7bf456277a0a085ed01

                                          SHA1

                                          803997ef17eedf50969115c529a2bf8de585dc91

                                          SHA256

                                          b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                          SHA512

                                          7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-S07ME.tmp\tmp796B.tmp
                                          Filesize

                                          1.1MB

                                          MD5

                                          e845838d99d29c4bba4ad35ee996dea3

                                          SHA1

                                          34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                          SHA256

                                          b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                          SHA512

                                          fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\is-S07ME.tmp\tmp796B.tmp
                                          Filesize

                                          1.1MB

                                          MD5

                                          e845838d99d29c4bba4ad35ee996dea3

                                          SHA1

                                          34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                          SHA256

                                          b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                          SHA512

                                          fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmp796B.tmp
                                          Filesize

                                          3.7MB

                                          MD5

                                          138f52ffae8eb9bce23715a1a60e1efa

                                          SHA1

                                          fe72e7744547952fb2415df01ab85e1f310690e2

                                          SHA256

                                          656f7e6b2dd166034e8dd3c81379054b57c01d73fb035dbbbfa3fe1d510a75fb

                                          SHA512

                                          5db896207c7c54630508647f5cfd764e4f23939450acc9e9c0b3a6d5e1251e7b2166d7c0f66de028153769755c64029d917b9fe306d732ea9fdaa94946b04b1c

                                          Download Submit

                                        • C:\Users\Admin\AppData\Local\Temp\tmp796B.tmp
                                          Filesize

                                          3.7MB

                                          MD5

                                          138f52ffae8eb9bce23715a1a60e1efa

                                          SHA1

                                          fe72e7744547952fb2415df01ab85e1f310690e2

                                          SHA256

                                          656f7e6b2dd166034e8dd3c81379054b57c01d73fb035dbbbfa3fe1d510a75fb

                                          SHA512

                                          5db896207c7c54630508647f5cfd764e4f23939450acc9e9c0b3a6d5e1251e7b2166d7c0f66de028153769755c64029d917b9fe306d732ea9fdaa94946b04b1c

                                          Download Submit

                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                                          Filesize

                                          42B

                                          MD5

                                          84cfdb4b995b1dbf543b26b86c863adc

                                          SHA1

                                          d2f47764908bf30036cf8248b9ff5541e2711fa2

                                          SHA256

                                          d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

                                          SHA512

                                          485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

                                          Download Submit

                                        • memory/1152-461-0x0000000005270000-0x0000000005298000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/1892-299-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1892-167-0x0000000003B20000-0x0000000003B42000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/1892-425-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1892-236-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1892-514-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1892-176-0x0000000000610000-0x0000000000611000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/1892-470-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/1892-361-0x0000000000400000-0x000000000052D000-memory.dmp

                                          Filesize

                                          1.2MB

                                          Download

                                        • memory/2216-177-0x00000000005F0000-0x0000000000600000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2960-487-0x0000000001500000-0x0000000001510000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2960-493-0x0000000001500000-0x0000000001510000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2960-518-0x0000000001500000-0x0000000001510000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/2960-519-0x0000000001500000-0x0000000001510000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3024-506-0x0000000000400000-0x0000000000816000-memory.dmp

                                          Filesize

                                          4.1MB

                                          Download

                                        • memory/3024-510-0x0000000000400000-0x0000000000816000-memory.dmp

                                          Filesize

                                          4.1MB

                                          Download

                                        • memory/3056-453-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-437-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3056-448-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-447-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3056-452-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-429-0x0000000000400000-0x0000000000816000-memory.dmp

                                          Filesize

                                          4.1MB

                                          Download

                                        • memory/3056-455-0x0000000000400000-0x0000000000816000-memory.dmp

                                          Filesize

                                          4.1MB

                                          Download

                                        • memory/3056-446-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-433-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3056-445-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-444-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3056-436-0x0000000005B00000-0x000000000602C000-memory.dmp

                                          Filesize

                                          5.2MB

                                          Download

                                        • memory/3056-442-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3056-449-0x0000000008E50000-0x0000000008F50000-memory.dmp

                                          Filesize

                                          1024KB

                                          Download

                                        • memory/3056-441-0x0000000006910000-0x000000000691A000-memory.dmp

                                          Filesize

                                          40KB

                                          Download

                                        • memory/3056-438-0x0000000005810000-0x0000000005820000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3296-494-0x0000000000400000-0x0000000000816000-memory.dmp

                                          Filesize

                                          4.1MB

                                          Download

                                        • memory/3296-485-0x0000000003050000-0x0000000003060000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3296-486-0x0000000003050000-0x0000000003060000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/3296-476-0x0000000005C90000-0x0000000005CB2000-memory.dmp

                                          Filesize

                                          136KB

                                          Download

                                        • memory/4436-364-0x000000007578C000-0x000000007578D000-memory.dmp

                                          Filesize

                                          4KB

                                          Download

                                        • memory/4584-133-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4584-237-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4584-228-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4584-154-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4584-147-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4584-209-0x0000000001B90000-0x0000000001BA0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4928-408-0x0000000006080000-0x0000000006624000-memory.dmp

                                          Filesize

                                          5.6MB

                                          Download

                                        • memory/4928-405-0x00000000059B0000-0x0000000005AC2000-memory.dmp

                                          Filesize

                                          1.1MB

                                          Download

                                        • memory/4928-401-0x0000000000C80000-0x0000000000C92000-memory.dmp

                                          Filesize

                                          72KB

                                          Download

                                        • memory/4928-409-0x000000007EFE0000-0x000000007EFF0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/4928-410-0x0000000005AD0000-0x0000000005B62000-memory.dmp

                                          Filesize

                                          584KB

                                          Download

                                        • memory/4928-416-0x00000000069A0000-0x0000000006A22000-memory.dmp

                                          Filesize

                                          520KB

                                          Download

                                        • memory/4928-411-0x0000000005C10000-0x0000000005CAC000-memory.dmp

                                          Filesize

                                          624KB

                                          Download

                                        • memory/4928-412-0x00000000054C0000-0x00000000054D0000-memory.dmp

                                          Filesize

                                          64KB

                                          Download

                                        • memory/5016-151-0x0000000000400000-0x0000000000428000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/5016-235-0x0000000000400000-0x0000000000428000-memory.dmp

                                          Filesize

                                          160KB

                                          Download

                                        • memory/5016-515-0x0000000000400000-0x0000000000428000-memory.dmp

                                          Filesize

                                          160KB

                                          Download