Overview

overview

8

Static

static

1

Device/Har...er.exe

windows7-x64

8

Device/Har...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    50s
  • max time network
    87s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2023, 15:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Device/HarddiskVolume5/Program Files (x86)/UltraViewer/Update/UVUpdater.exe

  • Size

    3.4MB

  • MD5

    9f6011cda9bd22412484a0fc33e7ca8a

  • SHA1

    136b33e3e335d0c2901fb7b85fe26fc5e88445d5

  • SHA256

    8f4f9a43bbfbe3b842a5cdd7cbc621f0171bafda89e3b88310ec473e9a56eae0

  • SHA512

    3ade22ddd54506b510ec04300bc9fb4a8618a224806b3779e3e007fbfe33b5ce12ff741029d7ad17b0574ef980a39e519d48da964122bfffab1939dfe77b34f7

  • SSDEEP

    98304:E5zZ80gsEX+Ljsp0d8DgI4vacQx+wOWj9ViPm:Ef80gsl3s1gFvQ+oRcm

Score
8/10
evasionupx

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
    evasion
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 9 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Kills process with taskkill 64 IoCs
    evasion
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 7 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4244
    • C:\Users\Admin\AppData\Local\Temp\tmp9659.tmp
      "C:\Users\Admin\AppData\Local\Temp\tmp9659.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3956
      • C:\Users\Admin\AppData\Local\Temp\is-51EQ1.tmp\tmp9659.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-51EQ1.tmp\tmp9659.tmp" /SL5="$60062,3135717,121344,C:\Users\Admin\AppData\Local\Temp\tmp9659.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\UVUninstallHelper.exe
          "C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\UVUninstallHelper.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1476
        • C:\Windows\SysWOW64\net.exe
          "net" stop UltraViewService
          4⤵
          • Discovers systems in the same network
          • Suspicious use of WriteProcessMemory
          PID:1660
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop UltraViewService
            5⤵
              PID:3256
          • C:\Windows\SysWOW64\net.exe
            "net" stop UltraViewService
            4⤵
            • Discovers systems in the same network
            • Suspicious use of WriteProcessMemory
            PID:1976
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop UltraViewService
              5⤵
                PID:1412
            • C:\Windows\SysWOW64\sc.exe
              "sc" delete UltraViewService
              4⤵
              • Launches sc.exe
              PID:460
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2716
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1508
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5048
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2308
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:624
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3700
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2512
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2340
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1948
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2996
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3908
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3996
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4652
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4836
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4372
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4232
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3300
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:812
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3716
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3712
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4368
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3876
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4160
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2548
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3748
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2128
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3776
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2816
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4772
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3880
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1980
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:460
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1300
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1464
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2444
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1796
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2248
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:636
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2544
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4048
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3004
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2708
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3908
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4224
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2656
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4524
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1880
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2216
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2716
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2976
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2760
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2032
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3788
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3116
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5032
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4584
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2316
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4672
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1776
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1676
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2304
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1868
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
                PID:1072
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                PID:1748
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                PID:1960
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                  PID:2772
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:4348
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                    PID:1740
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:1796
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                      PID:1412
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                        PID:4156
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                        • Kills process with taskkill
                        PID:4100
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                        • Kills process with taskkill
                        PID:4736
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                        • Kills process with taskkill
                        PID:4160
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                          PID:4048
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:3004
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:368
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                            PID:5020
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:3972
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:3464
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:2260
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                              PID:1784
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                                PID:2972
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                4⤵
                                  PID:2716
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  4⤵
                                    PID:3716
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:2760
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:1744
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4316
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4384
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:636
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4280
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:4028
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                      PID:2184
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      4⤵
                                      • Kills process with taskkill
                                      PID:3808
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      4⤵
                                      • Kills process with taskkill
                                      PID:5044
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                                      4⤵
                                      • Loads dropped DLL
                                      • Modifies registry class
                                      PID:2272
                                    • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                      "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                                      4⤵
                                        PID:1856

                                Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Program Files (x86)\UltraViewer\Language\English.txt
                                        Filesize

                                        14KB

                                        MD5

                                        b6a8ccdc51964e1551bef57b4a42a899

                                        SHA1

                                        52de4c2fc039af9a2f1295e8419123ba89ee5858

                                        SHA256

                                        c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a

                                        SHA512

                                        8d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini
                                        Filesize

                                        1KB

                                        MD5

                                        473b3896eae7ea66f61e9d0ffbe5b9b1

                                        SHA1

                                        d7ef69586317f7472ce400bc7bef75bfa4095592

                                        SHA256

                                        d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f

                                        SHA512

                                        981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\MSVBVM60.DLL
                                        Filesize

                                        1.3MB

                                        MD5

                                        5343a19c618bc515ceb1695586c6c137

                                        SHA1

                                        4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                        SHA256

                                        2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                        SHA512

                                        708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                        Filesize

                                        496KB

                                        MD5

                                        5da17fa97fce539c78e3018ee1c29cd0

                                        SHA1

                                        cff12edd4361fa5c310250ebaacbfc54274f00c8

                                        SHA256

                                        92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                        SHA512

                                        1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                        Filesize

                                        496KB

                                        MD5

                                        5da17fa97fce539c78e3018ee1c29cd0

                                        SHA1

                                        cff12edd4361fa5c310250ebaacbfc54274f00c8

                                        SHA256

                                        92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                        SHA512

                                        1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\NAudio.dll
                                        Filesize

                                        496KB

                                        MD5

                                        5da17fa97fce539c78e3018ee1c29cd0

                                        SHA1

                                        cff12edd4361fa5c310250ebaacbfc54274f00c8

                                        SHA256

                                        92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                        SHA512

                                        1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                                        Filesize

                                        1.0MB

                                        MD5

                                        8b0a95c5fdd5fe1c7e44d3881d743a15

                                        SHA1

                                        24aed0d76560523117cc398774639bc40497412a

                                        SHA256

                                        ef76e684b52be8dc8d75bc3d965679151aa241f3115be746e519d95380d9daa1

                                        SHA512

                                        8a07498ce3dd95f477cd7d9db0e43ea485ef4f473afbc23d54f0f747e92bae663c29272000bdf3f0252642050ab58960188f589862beb0fbe667b20eb18f3541

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\RemoteControl.tlb
                                        Filesize

                                        236KB

                                        MD5

                                        6905ce31fccabd2c0b51bf910698ad83

                                        SHA1

                                        940ea6dbd498cb89423e58186222da2cc09fb45f

                                        SHA256

                                        670896b87a02b8cf9d715ad0c62ed04160ddc5fc075adc52cb2eb038f9ecd282

                                        SHA512

                                        6a31920226a5b774134ad7ff686b42f1965496efc6516e1dae4634b7c172243a35ba005dcb50e3c2d570a1e9228cc2fd11cc67679a0b79998ff67dbd71b0cbc4

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                        Filesize

                                        980KB

                                        MD5

                                        f667dddcbff846d6463fe5b99c3a3c1d

                                        SHA1

                                        ea23cb8d610234c1502daacfd159bfc56c1f290f

                                        SHA256

                                        e8aba8e6511bda3048bebac4608ec15119f7d8c1470239f9164b0f6114d44a60

                                        SHA512

                                        369bf71faf3192757e45f313aa12ab820a301087d35324eed3f9970dd54c91d9dbe5a70262408cbb072a0f1dff4eb6b80ace2764534d84499d8868ef3ab48e53

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                        Filesize

                                        980KB

                                        MD5

                                        f667dddcbff846d6463fe5b99c3a3c1d

                                        SHA1

                                        ea23cb8d610234c1502daacfd159bfc56c1f290f

                                        SHA256

                                        e8aba8e6511bda3048bebac4608ec15119f7d8c1470239f9164b0f6114d44a60

                                        SHA512

                                        369bf71faf3192757e45f313aa12ab820a301087d35324eed3f9970dd54c91d9dbe5a70262408cbb072a0f1dff4eb6b80ace2764534d84499d8868ef3ab48e53

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                        Filesize

                                        980KB

                                        MD5

                                        f667dddcbff846d6463fe5b99c3a3c1d

                                        SHA1

                                        ea23cb8d610234c1502daacfd159bfc56c1f290f

                                        SHA256

                                        e8aba8e6511bda3048bebac4608ec15119f7d8c1470239f9164b0f6114d44a60

                                        SHA512

                                        369bf71faf3192757e45f313aa12ab820a301087d35324eed3f9970dd54c91d9dbe5a70262408cbb072a0f1dff4eb6b80ace2764534d84499d8868ef3ab48e53

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config
                                        Filesize

                                        310B

                                        MD5

                                        42b8d26600dcb85572ee43616f929d6a

                                        SHA1

                                        31a4c46641129ef59eb925621c1aa4f8401d776c

                                        SHA256

                                        99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

                                        SHA512

                                        d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                        Filesize

                                        1.3MB

                                        MD5

                                        5343a19c618bc515ceb1695586c6c137

                                        SHA1

                                        4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                        SHA256

                                        2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                        SHA512

                                        708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                                        Filesize

                                        1.3MB

                                        MD5

                                        5343a19c618bc515ceb1695586c6c137

                                        SHA1

                                        4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                        SHA256

                                        2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                        SHA512

                                        708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\uvh.dll
                                        Filesize

                                        124KB

                                        MD5

                                        8b3f15a335710c799eae2395fa6b322d

                                        SHA1

                                        81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                        SHA256

                                        09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                        SHA512

                                        c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                        Download Submit

                                      • C:\Program Files (x86)\UltraViewer\uvh.dll
                                        Filesize

                                        124KB

                                        MD5

                                        8b3f15a335710c799eae2395fa6b322d

                                        SHA1

                                        81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                        SHA256

                                        09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                        SHA512

                                        c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-51EQ1.tmp\tmp9659.tmp
                                        Filesize

                                        1.1MB

                                        MD5

                                        e845838d99d29c4bba4ad35ee996dea3

                                        SHA1

                                        34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                        SHA256

                                        b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                        SHA512

                                        fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-51EQ1.tmp\tmp9659.tmp
                                        Filesize

                                        1.1MB

                                        MD5

                                        e845838d99d29c4bba4ad35ee996dea3

                                        SHA1

                                        34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                        SHA256

                                        b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                        SHA512

                                        fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\UVUninstallHelper.exe
                                        Filesize

                                        43KB

                                        MD5

                                        ececb301656f5f8c6a46a8abf8d928fe

                                        SHA1

                                        9bdf8a054c71d34837262ab306db92d3ee70db3b

                                        SHA256

                                        801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                        SHA512

                                        314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\UVUninstallHelper.exe
                                        Filesize

                                        43KB

                                        MD5

                                        ececb301656f5f8c6a46a8abf8d928fe

                                        SHA1

                                        9bdf8a054c71d34837262ab306db92d3ee70db3b

                                        SHA256

                                        801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                        SHA512

                                        314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\UVUninstallHelper.exe.config
                                        Filesize

                                        225B

                                        MD5

                                        679aca3e8125584e8704b2dfdfa20a0b

                                        SHA1

                                        bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                        SHA256

                                        470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                        SHA512

                                        8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\idp.dll
                                        Filesize

                                        232KB

                                        MD5

                                        55c310c0319260d798757557ab3bf636

                                        SHA1

                                        0892eb7ed31d8bb20a56c6835990749011a2d8de

                                        SHA256

                                        54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                                        SHA512

                                        e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\isxdl.dll
                                        Filesize

                                        121KB

                                        MD5

                                        48ad1a1c893ce7bf456277a0a085ed01

                                        SHA1

                                        803997ef17eedf50969115c529a2bf8de585dc91

                                        SHA256

                                        b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                        SHA512

                                        7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\is-BPUH7.tmp\isxdl.dll
                                        Filesize

                                        121KB

                                        MD5

                                        48ad1a1c893ce7bf456277a0a085ed01

                                        SHA1

                                        803997ef17eedf50969115c529a2bf8de585dc91

                                        SHA256

                                        b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                        SHA512

                                        7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\tmp9659.tmp
                                        Filesize

                                        3.4MB

                                        MD5

                                        d57b027724dd6245caa59445629eac66

                                        SHA1

                                        e3c30a6ae00e194add89640dfd660273cda305b9

                                        SHA256

                                        34207eec931e949b65424ac12c68340c3124e7a826b449fae610438457506800

                                        SHA512

                                        83f133831126e7e63f3cb33331ac16cd5b833fee1ae886cfd7a410306f83b7b850d4d1090cb37530243181a81a13fe9699864ffe32635bbc438cdb4a4ce77fe3

                                        Download Submit

                                      • C:\Users\Admin\AppData\Local\Temp\tmp9659.tmp
                                        Filesize

                                        3.4MB

                                        MD5

                                        d57b027724dd6245caa59445629eac66

                                        SHA1

                                        e3c30a6ae00e194add89640dfd660273cda305b9

                                        SHA256

                                        34207eec931e949b65424ac12c68340c3124e7a826b449fae610438457506800

                                        SHA512

                                        83f133831126e7e63f3cb33331ac16cd5b833fee1ae886cfd7a410306f83b7b850d4d1090cb37530243181a81a13fe9699864ffe32635bbc438cdb4a4ce77fe3

                                        Download Submit

                                      • memory/1856-425-0x0000000005870000-0x0000000005880000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/1856-424-0x0000000005870000-0x0000000005880000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/1856-421-0x0000000005B40000-0x000000000606C000-memory.dmp

                                        Filesize

                                        5.2MB

                                        Download

                                      • memory/1856-418-0x0000000005870000-0x0000000005880000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/1856-410-0x0000000000400000-0x0000000000816000-memory.dmp

                                        Filesize

                                        4.1MB

                                        Download

                                      • memory/2272-396-0x0000000005EC0000-0x0000000005F5C000-memory.dmp

                                        Filesize

                                        624KB

                                        Download

                                      • memory/2272-397-0x0000000005990000-0x00000000059A0000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/2272-401-0x0000000006C50000-0x0000000006CD2000-memory.dmp

                                        Filesize

                                        520KB

                                        Download

                                      • memory/2272-386-0x0000000000F30000-0x0000000000F42000-memory.dmp

                                        Filesize

                                        72KB

                                        Download

                                      • memory/2272-391-0x000000007EF80000-0x000000007EF90000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/2272-394-0x0000000006330000-0x00000000068D4000-memory.dmp

                                        Filesize

                                        5.6MB

                                        Download

                                      • memory/2272-395-0x0000000005D80000-0x0000000005E12000-memory.dmp

                                        Filesize

                                        584KB

                                        Download

                                      • memory/2272-390-0x0000000005C60000-0x0000000005D72000-memory.dmp

                                        Filesize

                                        1.1MB

                                        Download

                                      • memory/2824-232-0x0000000000400000-0x000000000052D000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/2824-170-0x0000000003310000-0x0000000003332000-memory.dmp

                                        Filesize

                                        136KB

                                        Download

                                      • memory/2824-417-0x0000000000400000-0x000000000052D000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/2824-177-0x0000000000720000-0x0000000000721000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/2824-297-0x0000000000400000-0x000000000052D000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/2824-355-0x0000000000400000-0x000000000052D000-memory.dmp

                                        Filesize

                                        1.2MB

                                        Download

                                      • memory/3956-231-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/3956-153-0x0000000000400000-0x0000000000428000-memory.dmp

                                        Filesize

                                        160KB

                                        Download

                                      • memory/4244-233-0x0000000001520000-0x0000000001530000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4244-157-0x0000000001520000-0x0000000001530000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4244-155-0x0000000001520000-0x0000000001530000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4244-133-0x0000000001520000-0x0000000001530000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4244-204-0x0000000001520000-0x0000000001530000-memory.dmp

                                        Filesize

                                        64KB

                                        Download