Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    20/07/2023, 16:15

General

  • Target

    Device/HarddiskVolume5/Program Files (x86)/UltraViewer/Update/UVUpdater.exe

  • Size

    3.4MB

  • MD5

    58c7835275c287ffa6aab23500b61ecb

  • SHA1

    8d4ef999c7755423576bfcfd9092d4976f409c29

  • SHA256

    81fb1f2231fc1956351a3ad690ffad177b8174f52d51518bd5333e9ce24cb042

  • SHA512

    788a55c52b6b748e0f330c201a2cd65471265742b35f4672bf8183a338566212e8710bb6603501d6e76eeb7da263abb39bfaa0e1d1024b86212fb1a0d42d5394

  • SSDEEP

    98304:H5zZ80gsEX+LjH24iPFna6KbgxZiZc7Xmhcf9ViPS:Hf80gsl3WLs6EZI2GFcS

Score
8/10

Malware Config

Signatures

  • Stops running service(s) 3 TTPs
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 32 IoCs
  • UPX packed file 16 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Kills process with taskkill 64 IoCs
  • Modifies data under HKEY_USERS 47 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"
    1⤵
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2376
    • C:\Users\Admin\AppData\Local\Temp\tmp925B.tmp
      "C:\Users\Admin\AppData\Local\Temp\tmp925B.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2764
      • C:\Users\Admin\AppData\Local\Temp\is-ESL7F.tmp\tmp925B.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-ESL7F.tmp\tmp925B.tmp" /SL5="$201E8,3135487,121344,C:\Users\Admin\AppData\Local\Temp\tmp925B.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2772
        • C:\Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe
          "C:\Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:268
        • C:\Windows\SysWOW64\net.exe
          "net" stop UltraViewService
          4⤵
          • Discovers systems in the same network
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop UltraViewService
            5⤵
              PID:3056
          • C:\Windows\SysWOW64\net.exe
            "net" stop UltraViewService
            4⤵
            • Discovers systems in the same network
            • Suspicious use of WriteProcessMemory
            PID:2120
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop UltraViewService
              5⤵
                PID:2008
            • C:\Windows\SysWOW64\sc.exe
              "sc" delete UltraViewService
              4⤵
              • Launches sc.exe
              PID:2156
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2696
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1300
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2940
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1940
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:296
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2064
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1620
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2276
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1744
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:388
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1944
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1788
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2472
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2576
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3060
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1752
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1696
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:584
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2836
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:632
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1200
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:292
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:852
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2344
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:984
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1496
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1828
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2024
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2896
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1736
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1684
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2316
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1932
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2364
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1148
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2520
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1660
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1356
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1664
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:240
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1532
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:1772
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2208
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:528
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1592
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:568
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2984
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3040
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3004
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2720
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2628
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2108
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1816
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1676
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2052
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2604
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1996
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3024
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1064
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:2336
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2072
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2552
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              4⤵
                PID:2076
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                4⤵
                  PID:928
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:1356
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:1944
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                  • Kills process with taskkill
                  PID:2168
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  4⤵
                    PID:1532
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                    4⤵
                      PID:1672
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                      • Kills process with taskkill
                      PID:976
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                      • Kills process with taskkill
                      PID:2148
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                      • Kills process with taskkill
                      PID:2332
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      4⤵
                        PID:584
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                        4⤵
                          PID:2916
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:2028
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                          • Kills process with taskkill
                          PID:2724
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          4⤵
                            PID:2572
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            4⤵
                              PID:3032
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                              • Kills process with taskkill
                              PID:772
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                              4⤵
                                PID:2692
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                4⤵
                                • Kills process with taskkill
                                PID:2008
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                4⤵
                                  PID:2392
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  4⤵
                                    PID:2936
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:2696
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:3008
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:1796
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                    • Kills process with taskkill
                                    PID:2260
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                    4⤵
                                      PID:2320
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      4⤵
                                      • Kills process with taskkill
                                      PID:1384
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      4⤵
                                        PID:1368
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                        4⤵
                                          PID:1680
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                          4⤵
                                            PID:900
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                            4⤵
                                              PID:2508
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                              4⤵
                                                PID:2668
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                4⤵
                                                • Kills process with taskkill
                                                PID:2564
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                                                4⤵
                                                • Loads dropped DLL
                                                • Modifies registry class
                                                PID:1760
                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious behavior: AddClipboardFormatListener
                                                • Suspicious behavior: EnumeratesProcesses
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2856
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
                                                4⤵
                                                • Loads dropped DLL
                                                • Drops file in Program Files directory
                                                PID:1964
                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Modifies registry class
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2380
                                                • C:\Windows\SysWOW64\sc.exe
                                                  sc failure "UltraViewService" reset= 0 actions= restart/60000
                                                  5⤵
                                                  • Launches sc.exe
                                                  PID:1332
                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
                                                4⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • Suspicious use of SetWindowsHookEx
                                                PID:2276
                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                          "C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          • Drops file in System32 directory
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2284
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                            2⤵
                                              PID:1580
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                              2⤵
                                                PID:1664
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                2⤵
                                                  PID:2668

                                              Network

                                              MITRE ATT&CK Enterprise v15

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • C:\Program Files (x86)\UltraViewer\Language\English.txt

                                                Filesize

                                                14KB

                                                MD5

                                                b6a8ccdc51964e1551bef57b4a42a899

                                                SHA1

                                                52de4c2fc039af9a2f1295e8419123ba89ee5858

                                                SHA256

                                                c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a

                                                SHA512

                                                8d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6

                                              • C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini

                                                Filesize

                                                1KB

                                                MD5

                                                473b3896eae7ea66f61e9d0ffbe5b9b1

                                                SHA1

                                                d7ef69586317f7472ce400bc7bef75bfa4095592

                                                SHA256

                                                d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f

                                                SHA512

                                                981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66

                                              • C:\Program Files (x86)\UltraViewer\MSVBVM60.DLL

                                                Filesize

                                                1.3MB

                                                MD5

                                                5343a19c618bc515ceb1695586c6c137

                                                SHA1

                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                SHA256

                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                SHA512

                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                              • C:\Program Files (x86)\UltraViewer\NAudio.dll

                                                Filesize

                                                496KB

                                                MD5

                                                5da17fa97fce539c78e3018ee1c29cd0

                                                SHA1

                                                cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                SHA256

                                                92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                SHA512

                                                1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                              • C:\Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • C:\Program Files (x86)\UltraViewer\RemoteControl.tlb

                                                Filesize

                                                236KB

                                                MD5

                                                b143c3325ebe228144ab14858ad4ccd6

                                                SHA1

                                                8291a8af7b05b8ca111b546da6de1383a9b5965c

                                                SHA256

                                                023dc7f119c850c7170e502198efc6b883bc69c72249b536c3827159b84e9044

                                                SHA512

                                                0c1bb83dcde848b24accbc8d6541ab2e10e814f83b6eb000f83c4ae8ad78a93ff237ebf681df5ab5bbc9450a672eec3ee801cd7b9b67d30fbb6e62a3ba0409ba

                                              • C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt

                                                Filesize

                                                486B

                                                MD5

                                                f0cc026efc69c05867711caa9f614508

                                                SHA1

                                                6a3774e8dacfaf8fbefa3653aa5265ce9f9f2ad1

                                                SHA256

                                                14bdcffeffa7fe9bcf27641fd6a8502c9c294e08e1b970c93158ab00572879ab

                                                SHA512

                                                dcfd7e27239fddf11b5f0dba37d34e0e27e975f81e0137509418f7478684bec6215cd96f36ba6e7c4fca12cadadc5317d4b869fff4da4fd1f959c4d57f7de587

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config

                                                Filesize

                                                310B

                                                MD5

                                                42b8d26600dcb85572ee43616f929d6a

                                                SHA1

                                                31a4c46641129ef59eb925621c1aa4f8401d776c

                                                SHA256

                                                99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

                                                SHA512

                                                d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe

                                                Filesize

                                                226KB

                                                MD5

                                                30c5f65655bbaeab0f1afd219c609050

                                                SHA1

                                                f0317b4e3b420fd2e00483f366a0c9d31d2a8457

                                                SHA256

                                                8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

                                                SHA512

                                                611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe

                                                Filesize

                                                226KB

                                                MD5

                                                30c5f65655bbaeab0f1afd219c609050

                                                SHA1

                                                f0317b4e3b420fd2e00483f366a0c9d31d2a8457

                                                SHA256

                                                8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

                                                SHA512

                                                611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

                                              • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe.config

                                                Filesize

                                                225B

                                                MD5

                                                679aca3e8125584e8704b2dfdfa20a0b

                                                SHA1

                                                bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                                SHA256

                                                470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                                SHA512

                                                8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                              • C:\Program Files (x86)\UltraViewer\is-PMAFQ.tmp

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • C:\Program Files (x86)\UltraViewer\msvbvm60.dll

                                                Filesize

                                                1.3MB

                                                MD5

                                                5343a19c618bc515ceb1695586c6c137

                                                SHA1

                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                SHA256

                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                SHA512

                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                              • C:\Program Files (x86)\UltraViewer\uvh.dll

                                                Filesize

                                                124KB

                                                MD5

                                                8b3f15a335710c799eae2395fa6b322d

                                                SHA1

                                                81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                                SHA256

                                                09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                                SHA512

                                                c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                              • C:\Users\Admin\AppData\Local\Temp\Cab894E.tmp

                                                Filesize

                                                62KB

                                                MD5

                                                3ac860860707baaf32469fa7cc7c0192

                                                SHA1

                                                c33c2acdaba0e6fa41fd2f00f186804722477639

                                                SHA256

                                                d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

                                                SHA512

                                                d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

                                              • C:\Users\Admin\AppData\Local\Temp\Tar89BE.tmp

                                                Filesize

                                                164KB

                                                MD5

                                                4ff65ad929cd9a367680e0e5b1c08166

                                                SHA1

                                                c0af0d4396bd1f15c45f39d3b849ba444233b3a2

                                                SHA256

                                                c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

                                                SHA512

                                                f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

                                              • C:\Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe

                                                Filesize

                                                43KB

                                                MD5

                                                ececb301656f5f8c6a46a8abf8d928fe

                                                SHA1

                                                9bdf8a054c71d34837262ab306db92d3ee70db3b

                                                SHA256

                                                801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                                SHA512

                                                314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                              • C:\Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe

                                                Filesize

                                                43KB

                                                MD5

                                                ececb301656f5f8c6a46a8abf8d928fe

                                                SHA1

                                                9bdf8a054c71d34837262ab306db92d3ee70db3b

                                                SHA256

                                                801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                                SHA512

                                                314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                              • C:\Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe.config

                                                Filesize

                                                225B

                                                MD5

                                                679aca3e8125584e8704b2dfdfa20a0b

                                                SHA1

                                                bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                                SHA256

                                                470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                                SHA512

                                                8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                              • C:\Users\Admin\AppData\Local\Temp\is-ESL7F.tmp\tmp925B.tmp

                                                Filesize

                                                1.1MB

                                                MD5

                                                e845838d99d29c4bba4ad35ee996dea3

                                                SHA1

                                                34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                                SHA256

                                                b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                                SHA512

                                                fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                              • C:\Users\Admin\AppData\Local\Temp\is-ESL7F.tmp\tmp925B.tmp

                                                Filesize

                                                1.1MB

                                                MD5

                                                e845838d99d29c4bba4ad35ee996dea3

                                                SHA1

                                                34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                                SHA256

                                                b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                                SHA512

                                                fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                              • C:\Users\Admin\AppData\Local\Temp\tmp925B.tmp

                                                Filesize

                                                3.4MB

                                                MD5

                                                a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

                                                SHA1

                                                0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

                                                SHA256

                                                a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

                                                SHA512

                                                b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

                                              • C:\Users\Admin\AppData\Local\Temp\tmp925B.tmp

                                                Filesize

                                                3.4MB

                                                MD5

                                                a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

                                                SHA1

                                                0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

                                                SHA256

                                                a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

                                                SHA512

                                                b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                Filesize

                                                132KB

                                                MD5

                                                33bb06b97f8f188735f4aae5b413eef8

                                                SHA1

                                                e5c236f39d5b9d25b650cba7707df9149d3f4d16

                                                SHA256

                                                931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

                                                SHA512

                                                abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

                                              • \Program Files (x86)\UltraViewer\NAudio.dll

                                                Filesize

                                                496KB

                                                MD5

                                                5da17fa97fce539c78e3018ee1c29cd0

                                                SHA1

                                                cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                SHA256

                                                92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                SHA512

                                                1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                              • \Program Files (x86)\UltraViewer\NAudio.dll

                                                Filesize

                                                496KB

                                                MD5

                                                5da17fa97fce539c78e3018ee1c29cd0

                                                SHA1

                                                cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                SHA256

                                                92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                SHA512

                                                1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                              • \Program Files (x86)\UltraViewer\NAudio.dll

                                                Filesize

                                                496KB

                                                MD5

                                                5da17fa97fce539c78e3018ee1c29cd0

                                                SHA1

                                                cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                SHA256

                                                92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                SHA512

                                                1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                              • \Program Files (x86)\UltraViewer\NAudio.dll

                                                Filesize

                                                496KB

                                                MD5

                                                5da17fa97fce539c78e3018ee1c29cd0

                                                SHA1

                                                cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                SHA256

                                                92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                SHA512

                                                1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\RemoteControl.dll

                                                Filesize

                                                1.0MB

                                                MD5

                                                21e54454f1f753b926c6f2d9aa05b91e

                                                SHA1

                                                b3c2a91eae69fc0594946165c4a9062502850076

                                                SHA256

                                                21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

                                                SHA512

                                                9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

                                              • \Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • \Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • \Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • \Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • \Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

                                                Filesize

                                                979KB

                                                MD5

                                                6f63069253c1c0de8a6fa182de6d0a8c

                                                SHA1

                                                6308d0910529e0a4f0738547841d07a7e8f074fe

                                                SHA256

                                                b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

                                                SHA512

                                                5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

                                              • \Program Files (x86)\UltraViewer\msvbvm60.dll

                                                Filesize

                                                1.3MB

                                                MD5

                                                5343a19c618bc515ceb1695586c6c137

                                                SHA1

                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                SHA256

                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                SHA512

                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                              • \Program Files (x86)\UltraViewer\msvbvm60.dll

                                                Filesize

                                                1.3MB

                                                MD5

                                                5343a19c618bc515ceb1695586c6c137

                                                SHA1

                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                SHA256

                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                SHA512

                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                              • \Program Files (x86)\UltraViewer\msvbvm60.dll

                                                Filesize

                                                1.3MB

                                                MD5

                                                5343a19c618bc515ceb1695586c6c137

                                                SHA1

                                                4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                SHA256

                                                2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                SHA512

                                                708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                              • \Program Files (x86)\UltraViewer\uvh.dll

                                                Filesize

                                                124KB

                                                MD5

                                                8b3f15a335710c799eae2395fa6b322d

                                                SHA1

                                                81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                                SHA256

                                                09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                                SHA512

                                                c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                              • \Users\Admin\AppData\Local\Temp\is-D8036.tmp\UVUninstallHelper.exe

                                                Filesize

                                                43KB

                                                MD5

                                                ececb301656f5f8c6a46a8abf8d928fe

                                                SHA1

                                                9bdf8a054c71d34837262ab306db92d3ee70db3b

                                                SHA256

                                                801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                                SHA512

                                                314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                              • \Users\Admin\AppData\Local\Temp\is-D8036.tmp\idp.dll

                                                Filesize

                                                232KB

                                                MD5

                                                55c310c0319260d798757557ab3bf636

                                                SHA1

                                                0892eb7ed31d8bb20a56c6835990749011a2d8de

                                                SHA256

                                                54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                                                SHA512

                                                e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                                              • \Users\Admin\AppData\Local\Temp\is-D8036.tmp\isxdl.dll

                                                Filesize

                                                121KB

                                                MD5

                                                48ad1a1c893ce7bf456277a0a085ed01

                                                SHA1

                                                803997ef17eedf50969115c529a2bf8de585dc91

                                                SHA256

                                                b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                                SHA512

                                                7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                              • \Users\Admin\AppData\Local\Temp\is-ESL7F.tmp\tmp925B.tmp

                                                Filesize

                                                1.1MB

                                                MD5

                                                e845838d99d29c4bba4ad35ee996dea3

                                                SHA1

                                                34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                                SHA256

                                                b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                                SHA512

                                                fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                              • \Users\Admin\AppData\Local\Temp\tmp925B.tmp

                                                Filesize

                                                3.4MB

                                                MD5

                                                a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

                                                SHA1

                                                0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

                                                SHA256

                                                a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

                                                SHA512

                                                b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

                                              • memory/268-143-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/268-146-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/268-145-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/268-144-0x0000000000D00000-0x0000000000D40000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/1760-359-0x0000000004EC0000-0x0000000004FD2000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1760-352-0x0000000001390000-0x00000000013A2000-memory.dmp

                                                Filesize

                                                72KB

                                              • memory/1760-365-0x00000000050E0000-0x0000000005162000-memory.dmp

                                                Filesize

                                                520KB

                                              • memory/1760-356-0x0000000004EC0000-0x0000000004FD2000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/1760-360-0x0000000001240000-0x00000000012C6000-memory.dmp

                                                Filesize

                                                536KB

                                              • memory/1964-414-0x00000000008B0000-0x00000000008D8000-memory.dmp

                                                Filesize

                                                160KB

                                              • memory/1964-417-0x00000000008B0000-0x00000000008D8000-memory.dmp

                                                Filesize

                                                160KB

                                              • memory/2276-461-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2276-485-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2284-495-0x0000000005140000-0x0000000005557000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2284-494-0x0000000000130000-0x0000000000170000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2284-446-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2284-449-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2284-493-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2284-447-0x0000000000130000-0x0000000000170000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2284-474-0x0000000005140000-0x0000000005557000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2284-471-0x0000000005140000-0x0000000005557000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2376-157-0x00000000024B0000-0x00000000024F0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2376-53-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2376-492-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2376-147-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2376-55-0x00000000024B0000-0x00000000024F0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2376-54-0x0000000074600000-0x0000000074BAB000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/2380-440-0x00000000050C0000-0x00000000051D2000-memory.dmp

                                                Filesize

                                                1.1MB

                                              • memory/2380-456-0x0000000070600000-0x0000000070CEE000-memory.dmp

                                                Filesize

                                                6.9MB

                                              • memory/2380-455-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2380-442-0x0000000005680000-0x00000000056C0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2380-441-0x0000000070600000-0x0000000070CEE000-memory.dmp

                                                Filesize

                                                6.9MB

                                              • memory/2764-116-0x0000000000400000-0x0000000000428000-memory.dmp

                                                Filesize

                                                160KB

                                              • memory/2764-188-0x0000000000400000-0x0000000000428000-memory.dmp

                                                Filesize

                                                160KB

                                              • memory/2764-490-0x0000000000400000-0x0000000000428000-memory.dmp

                                                Filesize

                                                160KB

                                              • memory/2772-445-0x0000000000400000-0x000000000052D000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/2772-200-0x0000000000240000-0x0000000000241000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/2772-489-0x0000000000400000-0x000000000052D000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/2772-374-0x0000000003D60000-0x0000000004177000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2772-424-0x0000000002F90000-0x0000000002FA0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2772-473-0x0000000002F90000-0x0000000002FA0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2772-297-0x0000000000400000-0x000000000052D000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/2772-367-0x0000000000400000-0x000000000052D000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/2772-209-0x0000000000400000-0x000000000052D000-memory.dmp

                                                Filesize

                                                1.2MB

                                              • memory/2772-132-0x0000000000670000-0x0000000000692000-memory.dmp

                                                Filesize

                                                136KB

                                              • memory/2772-124-0x0000000000240000-0x0000000000241000-memory.dmp

                                                Filesize

                                                4KB

                                              • memory/2772-457-0x0000000002F90000-0x0000000002FA0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2772-430-0x0000000002F90000-0x0000000002FA0000-memory.dmp

                                                Filesize

                                                64KB

                                              • memory/2772-395-0x0000000003D60000-0x0000000004177000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2856-405-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-406-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-393-0x00000000065F0000-0x00000000066F0000-memory.dmp

                                                Filesize

                                                1024KB

                                              • memory/2856-396-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2856-409-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2856-391-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-397-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-375-0x0000000000400000-0x0000000000817000-memory.dmp

                                                Filesize

                                                4.1MB

                                              • memory/2856-404-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-398-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-387-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-392-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-407-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-399-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-402-0x0000000007830000-0x00000000078B2000-memory.dmp

                                                Filesize

                                                520KB

                                              • memory/2856-385-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-403-0x00000000707C0000-0x0000000070EAE000-memory.dmp

                                                Filesize

                                                6.9MB

                                              • memory/2856-408-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-410-0x00000000707C0000-0x0000000070EAE000-memory.dmp

                                                Filesize

                                                6.9MB

                                              • memory/2856-384-0x0000000005660000-0x00000000056A0000-memory.dmp

                                                Filesize

                                                256KB

                                              • memory/2856-383-0x00000000707C0000-0x0000000070EAE000-memory.dmp

                                                Filesize

                                                6.9MB

                                              • memory/2856-382-0x00000000051A0000-0x00000000052B2000-memory.dmp

                                                Filesize

                                                1.1MB