Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

8

Static

static

1

Device/Har...er.exe

windows7-x64

8

Device/Har...er.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    143s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/07/2023, 06:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Device/HarddiskVolume3/Program Files (x86)/UltraViewer/Update/UVUpdater.exe

  • Size

    3.4MB

  • MD5

    58c7835275c287ffa6aab23500b61ecb

  • SHA1

    8d4ef999c7755423576bfcfd9092d4976f409c29

  • SHA256

    81fb1f2231fc1956351a3ad690ffad177b8174f52d51518bd5333e9ce24cb042

  • SHA512

    788a55c52b6b748e0f330c201a2cd65471265742b35f4672bf8183a338566212e8710bb6603501d6e76eeb7da263abb39bfaa0e1d1024b86212fb1a0d42d5394

  • SSDEEP

    98304:H5zZ80gsEX+LjH24iPFna6KbgxZiZc7Xmhcf9ViPS:Hf80gsl3WLs6EZI2GFcS

Score
8/10
discoveryevasionupx

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
    evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 23 IoCs
  • UPX packed file 11 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Discovers systems in the same network 1 TTPs 2 IoCs
    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Kills process with taskkill 64 IoCs
    evasion
  • Modifies data under HKEY_USERS 6 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume3\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:960
    • C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp
      "C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1452
      • C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp" /SL5="$40234,3135487,121344,C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1800
        • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe
          "C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3908
        • C:\Windows\SysWOW64\net.exe
          "net" stop UltraViewService
          4⤵
          • Discovers systems in the same network
          • Suspicious use of WriteProcessMemory
          PID:4856
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop UltraViewService
            5⤵
              PID:380
          • C:\Windows\SysWOW64\net.exe
            "net" stop UltraViewService
            4⤵
            • Discovers systems in the same network
            • Suspicious use of WriteProcessMemory
            PID:392
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop UltraViewService
              5⤵
                PID:1664
            • C:\Windows\SysWOW64\sc.exe
              "sc" delete UltraViewService
              4⤵
              • Launches sc.exe
              PID:2656
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1556
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3364
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4860
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1596
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:552
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2280
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2896
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5028
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2184
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4032
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3384
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3604
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3608
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:868
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3992
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1660
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3584
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3884
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1080
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4468
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4180
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4284
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1988
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3680
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:464
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2332
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1496
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3992
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2616
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4396
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:320
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2796
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3308
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3872
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:912
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1608
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4804
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:436
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2568
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3536
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:5056
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1276
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3192
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1192
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3856
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4708
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4236
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1860
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4272
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2988
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2696
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1320
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2568
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3536
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3752
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1276
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:4504
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3788
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3304
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4576
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1300
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1784
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              PID:216
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              PID:640
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              PID:3664
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
                PID:4836
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                PID:3484
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                • Kills process with taskkill
                PID:2428
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                  PID:2968
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:2700
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:3136
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:1268
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:2236
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:1644
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:4300
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:3404
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:1784
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                    PID:3932
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:3608
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                    • Kills process with taskkill
                    PID:3664
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                      PID:212
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                        PID:4648
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                          PID:2076
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:4372
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                            PID:404
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:1192
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:3736
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                            • Kills process with taskkill
                            PID:1856
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                              PID:64
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:4780
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:4412
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:2128
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:4380
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:1320
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:4064
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                              4⤵
                              • Loads dropped DLL
                              • Drops file in Program Files directory
                              • Modifies registry class
                              PID:3172
                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious behavior: AddClipboardFormatListener
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of SetWindowsHookEx
                              PID:3696
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
                              4⤵
                              • Loads dropped DLL
                              • Drops file in Program Files directory
                              PID:2520
                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:64
                              • C:\Windows\SysWOW64\sc.exe
                                sc failure "UltraViewService" reset= 0 actions= restart/60000
                                5⤵
                                • Launches sc.exe
                                PID:1720
                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
                              4⤵
                              • Executes dropped EXE
                              • Loads dropped DLL
                              • Suspicious use of SetWindowsHookEx
                              PID:4416
                      • C:\Windows\System32\svchost.exe
                        C:\Windows\System32\svchost.exe -k netsvcs -p
                        1⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Enumerates system info in registry
                        PID:4580
                      • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                        "C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
                        1⤵
                        • Executes dropped EXE
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1784
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                          2⤵
                          • Drops file in System32 directory
                          PID:2896
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                          2⤵
                            PID:744
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                            2⤵
                              PID:380

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                            Filesize

                            132KB

                            MD5

                            33bb06b97f8f188735f4aae5b413eef8

                            SHA1

                            e5c236f39d5b9d25b650cba7707df9149d3f4d16

                            SHA256

                            931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                            SHA512

                            abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                            Filesize

                            132KB

                            MD5

                            33bb06b97f8f188735f4aae5b413eef8

                            SHA1

                            e5c236f39d5b9d25b650cba7707df9149d3f4d16

                            SHA256

                            931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                            SHA512

                            abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                            Filesize

                            132KB

                            MD5

                            33bb06b97f8f188735f4aae5b413eef8

                            SHA1

                            e5c236f39d5b9d25b650cba7707df9149d3f4d16

                            SHA256

                            931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                            SHA512

                            abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                            Filesize

                            132KB

                            MD5

                            33bb06b97f8f188735f4aae5b413eef8

                            SHA1

                            e5c236f39d5b9d25b650cba7707df9149d3f4d16

                            SHA256

                            931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                            SHA512

                            abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll
                            Filesize

                            132KB

                            MD5

                            33bb06b97f8f188735f4aae5b413eef8

                            SHA1

                            e5c236f39d5b9d25b650cba7707df9149d3f4d16

                            SHA256

                            931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                            SHA512

                            abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\Language\English.txt
                            Filesize

                            14KB

                            MD5

                            b6a8ccdc51964e1551bef57b4a42a899

                            SHA1

                            52de4c2fc039af9a2f1295e8419123ba89ee5858

                            SHA256

                            c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a

                            SHA512

                            8d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini
                            Filesize

                            1KB

                            MD5

                            473b3896eae7ea66f61e9d0ffbe5b9b1

                            SHA1

                            d7ef69586317f7472ce400bc7bef75bfa4095592

                            SHA256

                            d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f

                            SHA512

                            981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\MSVBVM60.DLL
                            Filesize

                            1.3MB

                            MD5

                            5343a19c618bc515ceb1695586c6c137

                            SHA1

                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                            SHA256

                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                            SHA512

                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\NAudio.dll
                            Filesize

                            496KB

                            MD5

                            5da17fa97fce539c78e3018ee1c29cd0

                            SHA1

                            cff12edd4361fa5c310250ebaacbfc54274f00c8

                            SHA256

                            92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                            SHA512

                            1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\NAudio.dll
                            Filesize

                            496KB

                            MD5

                            5da17fa97fce539c78e3018ee1c29cd0

                            SHA1

                            cff12edd4361fa5c310250ebaacbfc54274f00c8

                            SHA256

                            92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                            SHA512

                            1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\NAudio.dll
                            Filesize

                            496KB

                            MD5

                            5da17fa97fce539c78e3018ee1c29cd0

                            SHA1

                            cff12edd4361fa5c310250ebaacbfc54274f00c8

                            SHA256

                            92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                            SHA512

                            1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\NAudio.dll
                            Filesize

                            496KB

                            MD5

                            5da17fa97fce539c78e3018ee1c29cd0

                            SHA1

                            cff12edd4361fa5c310250ebaacbfc54274f00c8

                            SHA256

                            92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                            SHA512

                            1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\NAudio.dll
                            Filesize

                            496KB

                            MD5

                            5da17fa97fce539c78e3018ee1c29cd0

                            SHA1

                            cff12edd4361fa5c310250ebaacbfc54274f00c8

                            SHA256

                            92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                            SHA512

                            1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.dll
                            Filesize

                            1.0MB

                            MD5

                            21e54454f1f753b926c6f2d9aa05b91e

                            SHA1

                            b3c2a91eae69fc0594946165c4a9062502850076

                            SHA256

                            21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                            SHA512

                            9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\RemoteControl.tlb
                            Filesize

                            236KB

                            MD5

                            6905ce31fccabd2c0b51bf910698ad83

                            SHA1

                            940ea6dbd498cb89423e58186222da2cc09fb45f

                            SHA256

                            670896b87a02b8cf9d715ad0c62ed04160ddc5fc075adc52cb2eb038f9ecd282

                            SHA512

                            6a31920226a5b774134ad7ff686b42f1965496efc6516e1dae4634b7c172243a35ba005dcb50e3c2d570a1e9228cc2fd11cc67679a0b79998ff67dbd71b0cbc4

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                            Filesize

                            979KB

                            MD5

                            6f63069253c1c0de8a6fa182de6d0a8c

                            SHA1

                            6308d0910529e0a4f0738547841d07a7e8f074fe

                            SHA256

                            b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                            SHA512

                            5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                            Filesize

                            979KB

                            MD5

                            6f63069253c1c0de8a6fa182de6d0a8c

                            SHA1

                            6308d0910529e0a4f0738547841d07a7e8f074fe

                            SHA256

                            b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                            SHA512

                            5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                            Filesize

                            979KB

                            MD5

                            6f63069253c1c0de8a6fa182de6d0a8c

                            SHA1

                            6308d0910529e0a4f0738547841d07a7e8f074fe

                            SHA256

                            b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                            SHA512

                            5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                            Filesize

                            979KB

                            MD5

                            6f63069253c1c0de8a6fa182de6d0a8c

                            SHA1

                            6308d0910529e0a4f0738547841d07a7e8f074fe

                            SHA256

                            b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                            SHA512

                            5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                            Filesize

                            979KB

                            MD5

                            6f63069253c1c0de8a6fa182de6d0a8c

                            SHA1

                            6308d0910529e0a4f0738547841d07a7e8f074fe

                            SHA256

                            b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                            SHA512

                            5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config
                            Filesize

                            310B

                            MD5

                            42b8d26600dcb85572ee43616f929d6a

                            SHA1

                            31a4c46641129ef59eb925621c1aa4f8401d776c

                            SHA256

                            99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

                            SHA512

                            d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                            Filesize

                            226KB

                            MD5

                            30c5f65655bbaeab0f1afd219c609050

                            SHA1

                            f0317b4e3b420fd2e00483f366a0c9d31d2a8457

                            SHA256

                            8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

                            SHA512

                            611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                            Filesize

                            226KB

                            MD5

                            30c5f65655bbaeab0f1afd219c609050

                            SHA1

                            f0317b4e3b420fd2e00483f366a0c9d31d2a8457

                            SHA256

                            8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

                            SHA512

                            611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe.config
                            Filesize

                            225B

                            MD5

                            679aca3e8125584e8704b2dfdfa20a0b

                            SHA1

                            bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                            SHA256

                            470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                            SHA512

                            8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                            Filesize

                            1.3MB

                            MD5

                            5343a19c618bc515ceb1695586c6c137

                            SHA1

                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                            SHA256

                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                            SHA512

                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                            Filesize

                            1.3MB

                            MD5

                            5343a19c618bc515ceb1695586c6c137

                            SHA1

                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                            SHA256

                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                            SHA512

                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                            Filesize

                            1.3MB

                            MD5

                            5343a19c618bc515ceb1695586c6c137

                            SHA1

                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                            SHA256

                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                            SHA512

                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\msvbvm60.dll
                            Filesize

                            1.3MB

                            MD5

                            5343a19c618bc515ceb1695586c6c137

                            SHA1

                            4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                            SHA256

                            2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                            SHA512

                            708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\uvh.dll
                            Filesize

                            124KB

                            MD5

                            8b3f15a335710c799eae2395fa6b322d

                            SHA1

                            81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                            SHA256

                            09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                            SHA512

                            c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                            Download Submit

                          • C:\Program Files (x86)\UltraViewer\uvh.dll
                            Filesize

                            124KB

                            MD5

                            8b3f15a335710c799eae2395fa6b322d

                            SHA1

                            81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                            SHA256

                            09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                            SHA512

                            c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UltraViewer_Desktop.exe.log
                            Filesize

                            1KB

                            MD5

                            bf9fccd82a74ae0fe94fe7f265ac9bca

                            SHA1

                            701036824a82ddaba67b37f545eb42e8ddf996fd

                            SHA256

                            10fb5250e5422aba27206a81c71b72b98a1d2e250a2c112c0ffb8a9f28230144

                            SHA512

                            fdc4a7a0e839056f1d00a3242c25791fad96679e3d5f33da57d5b4acb84bf8d143bdc592714eeb35be1d231c9bea3cf00412b082d2a9c81f1340717a0852394e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regasm.exe.log
                            Filesize

                            507B

                            MD5

                            76ffb2f33cb32ade8fc862a67599e9d8

                            SHA1

                            920cc4ab75b36d2f9f6e979b74db568973c49130

                            SHA256

                            f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

                            SHA512

                            f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp
                            Filesize

                            1.1MB

                            MD5

                            e845838d99d29c4bba4ad35ee996dea3

                            SHA1

                            34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                            SHA256

                            b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                            SHA512

                            fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-86A7A.tmp\tmpAC7C.tmp
                            Filesize

                            1.1MB

                            MD5

                            e845838d99d29c4bba4ad35ee996dea3

                            SHA1

                            34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                            SHA256

                            b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                            SHA512

                            fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe
                            Filesize

                            43KB

                            MD5

                            ececb301656f5f8c6a46a8abf8d928fe

                            SHA1

                            9bdf8a054c71d34837262ab306db92d3ee70db3b

                            SHA256

                            801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                            SHA512

                            314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe
                            Filesize

                            43KB

                            MD5

                            ececb301656f5f8c6a46a8abf8d928fe

                            SHA1

                            9bdf8a054c71d34837262ab306db92d3ee70db3b

                            SHA256

                            801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                            SHA512

                            314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\UVUninstallHelper.exe.config
                            Filesize

                            225B

                            MD5

                            679aca3e8125584e8704b2dfdfa20a0b

                            SHA1

                            bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                            SHA256

                            470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                            SHA512

                            8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\idp.dll
                            Filesize

                            232KB

                            MD5

                            55c310c0319260d798757557ab3bf636

                            SHA1

                            0892eb7ed31d8bb20a56c6835990749011a2d8de

                            SHA256

                            54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                            SHA512

                            e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\isxdl.dll
                            Filesize

                            121KB

                            MD5

                            48ad1a1c893ce7bf456277a0a085ed01

                            SHA1

                            803997ef17eedf50969115c529a2bf8de585dc91

                            SHA256

                            b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                            SHA512

                            7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-IPECV.tmp\isxdl.dll
                            Filesize

                            121KB

                            MD5

                            48ad1a1c893ce7bf456277a0a085ed01

                            SHA1

                            803997ef17eedf50969115c529a2bf8de585dc91

                            SHA256

                            b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                            SHA512

                            7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp
                            Filesize

                            3.4MB

                            MD5

                            a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

                            SHA1

                            0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

                            SHA256

                            a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

                            SHA512

                            b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\tmpAC7C.tmp
                            Filesize

                            3.4MB

                            MD5

                            a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

                            SHA1

                            0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

                            SHA256

                            a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

                            SHA512

                            b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\wsuBE3F.tmp
                            Filesize

                            14KB

                            MD5

                            c01eaa0bdcd7c30a42bbb35a9acbf574

                            SHA1

                            0aee3e1b873e41d040f1991819d0027b6cc68f54

                            SHA256

                            32297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40

                            SHA512

                            d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7

                            Download Submit

                          • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log
                            Filesize

                            42B

                            MD5

                            84cfdb4b995b1dbf543b26b86c863adc

                            SHA1

                            d2f47764908bf30036cf8248b9ff5541e2711fa2

                            SHA256

                            d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

                            SHA512

                            485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

                            Download Submit

                          • C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\InstallAgent\Checkpoints\9NCBCSZSJRSB.dat
                            Filesize

                            29KB

                            MD5

                            4ecb75060ef4f1409b4f72e5494c2ad9

                            SHA1

                            5fcc2f7b92bfc6e247d3c292c7d1993f51b3e16c

                            SHA256

                            5c6ab2b417156ef0c010f69c203e85818dcbef0dc69e70b0731fc0082f0e69aa

                            SHA512

                            d0c3ee1c93f48a8ebd34bc2ce1e4eb93c7d67867bfa8bc011c79a5feffcf082baf24e0676d1ce21ba40829e5f326e44886716bbe00817b50f3734dd94aba3a81

                            Download Submit

                          • memory/64-500-0x0000000002540000-0x0000000002550000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/64-487-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download

                          • memory/64-492-0x0000000005A70000-0x0000000005A92000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/64-501-0x0000000002540000-0x0000000002550000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/64-503-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download

                          • memory/960-135-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/960-252-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/960-255-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/960-133-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/960-148-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/960-149-0x00000000011F0000-0x0000000001200000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1452-251-0x0000000000400000-0x0000000000428000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/1452-152-0x0000000000400000-0x0000000000428000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/1452-529-0x0000000000400000-0x0000000000428000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/1784-515-0x00000000012C0000-0x00000000012D0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1784-533-0x00000000012C0000-0x00000000012D0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1784-532-0x00000000012C0000-0x00000000012D0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/1800-260-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/1800-375-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/1800-485-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/1800-319-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/1800-261-0x00000000006E0000-0x00000000006E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1800-170-0x00000000006E0000-0x00000000006E1000-memory.dmp

                            Filesize

                            4KB

                            Download

                          • memory/1800-435-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/1800-167-0x00000000031F0000-0x0000000003212000-memory.dmp

                            Filesize

                            136KB

                            Download

                          • memory/1800-528-0x0000000000400000-0x000000000052D000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/2520-475-0x0000000004F30000-0x0000000004F58000-memory.dmp

                            Filesize

                            160KB

                            Download

                          • memory/3172-421-0x00000000054C0000-0x00000000055D2000-memory.dmp

                            Filesize

                            1.1MB

                            Download

                          • memory/3172-428-0x00000000050B0000-0x00000000050C0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3172-424-0x0000000005B90000-0x0000000006134000-memory.dmp

                            Filesize

                            5.6MB

                            Download

                          • memory/3172-425-0x000000007F420000-0x000000007F430000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3172-426-0x00000000055E0000-0x0000000005672000-memory.dmp

                            Filesize

                            584KB

                            Download

                          • memory/3172-432-0x00000000064B0000-0x0000000006532000-memory.dmp

                            Filesize

                            520KB

                            Download

                          • memory/3172-427-0x0000000005720000-0x00000000057BC000-memory.dmp

                            Filesize

                            624KB

                            Download

                          • memory/3172-417-0x0000000000790000-0x00000000007A2000-memory.dmp

                            Filesize

                            72KB

                            Download

                          • memory/3696-461-0x0000000007A40000-0x0000000007B40000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/3696-453-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-463-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-462-0x0000000007A40000-0x0000000007B40000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/3696-467-0x0000000007A40000-0x0000000007B40000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/3696-460-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-458-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-457-0x0000000006960000-0x000000000696A000-memory.dmp

                            Filesize

                            40KB

                            Download

                          • memory/3696-454-0x0000000005BF0000-0x000000000611C000-memory.dmp

                            Filesize

                            5.2MB

                            Download

                          • memory/3696-464-0x0000000007A40000-0x0000000007B40000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/3696-448-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download

                          • memory/3696-452-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-451-0x0000000005A90000-0x0000000005AA0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/3696-470-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download

                          • memory/3696-468-0x0000000007A40000-0x0000000007B40000-memory.dmp

                            Filesize

                            1024KB

                            Download

                          • memory/3908-177-0x00000000019A0000-0x00000000019B0000-memory.dmp

                            Filesize

                            64KB

                            Download

                          • memory/4416-524-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download

                          • memory/4416-512-0x0000000000400000-0x0000000000817000-memory.dmp

                            Filesize

                            4.1MB

                            Download