0f58172f0a76a7dfa3de824ed3ff23eb7356209b8013fdd57ef9c4bad3fab82e

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24-07-2023 08:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Device/HarddiskVolume5/Program Files (x86)/UltraViewer/Update/UVUpdater.exe
Size

3.4MB
MD5

58c7835275c287ffa6aab23500b61ecb
SHA1

8d4ef999c7755423576bfcfd9092d4976f409c29
SHA256

81fb1f2231fc1956351a3ad690ffad177b8174f52d51518bd5333e9ce24cb042
SHA512

788a55c52b6b748e0f330c201a2cd65471265742b35f4672bf8183a338566212e8710bb6603501d6e76eeb7da263abb39bfaa0e1d1024b86212fb1a0d42d5394
SSDEEP

98304:H5zZ80gsEX+LjH24iPFna6KbgxZiZc7Xmhcf9ViPS:Hf80gsl3WLs6EZI2GFcS

Score

8^/10

discovery evasion upx

Malware Config

Signatures

Stops running service(s) 3 TTPs
evasion

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Executes dropped EXE 7 IoCs

pid	Process
2764	tmp8C43.tmp
2332	tmp8C43.tmp
1124	UVUninstallHelper.exe
2908	UltraViewer_Desktop.exe
3028	UltraViewer_Desktop.exe
2504	UltraViewer_Service.exe
776	UltraViewer_Desktop.exe

Loads dropped DLL 32 IoCs

pid	Process
1108	UVUpdater.exe
2764	tmp8C43.tmp
2332	tmp8C43.tmp
2332	tmp8C43.tmp
2332	tmp8C43.tmp
2148	regasm.exe
2148	regasm.exe
2148	regasm.exe
2148	regasm.exe
2148	regasm.exe
2148	regasm.exe
2332	tmp8C43.tmp
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2180	regasm.exe
2180	regasm.exe
2180	regasm.exe
2180	regasm.exe
2180	regasm.exe
2180	regasm.exe
2332	tmp8C43.tmp
2332	tmp8C43.tmp
3028	UltraViewer_Desktop.exe
3028	UltraViewer_Desktop.exe
3028	UltraViewer_Desktop.exe
776	UltraViewer_Desktop.exe
2504	UltraViewer_Service.exe
2504	UltraViewer_Service.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0007000000018b61-360.dat	upx
behavioral1/files/0x0007000000018b61-382.dat	upx
behavioral1/files/0x0007000000018b61-379.dat	upx
behavioral1/memory/2908-387-0x0000000000400000-0x0000000000817000-memory.dmp	upx
behavioral1/memory/2908-406-0x0000000000400000-0x0000000000817000-memory.dmp	upx
behavioral1/memory/2908-424-0x0000000000400000-0x0000000000817000-memory.dmp	upx
behavioral1/files/0x0007000000018b61-439.dat	upx
behavioral1/files/0x0007000000018b61-444.dat	upx
behavioral1/memory/3028-453-0x0000000000400000-0x0000000000817000-memory.dmp	upx
behavioral1/files/0x0007000000018b61-450.dat	upx
behavioral1/memory/3028-471-0x0000000000400000-0x0000000000817000-memory.dmp	upx
behavioral1/files/0x0007000000018b61-474.dat	upx
behavioral1/files/0x0007000000018b61-480.dat	upx
behavioral1/files/0x0007000000018b61-478.dat	upx
behavioral1/files/0x0007000000018b61-479.dat	upx
behavioral1/memory/776-503-0x0000000000400000-0x0000000000817000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0968A1E3A40D2582E7FD463BAEB59CD	UltraViewer_Service.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0968A1E3A40D2582E7FD463BAEB59CD	UltraViewer_Service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\UltraViewer\uva.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-1DIVB.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-F1D6C.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-8UDM3.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.tlb	regasm.exe
File opened for modification	C:\Program Files (x86)\UltraViewer\unins000.dat	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\uv_clib.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-IPOGF.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-L2AUG.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-74GNP.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-VNB8A.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-KE44C.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-MAPK8.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-8IB1V.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-2GCLU.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-6SF3S.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-800H2.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Update\is-7ONGE.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-NEF6R.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-M2BKA.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-91UR2.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-T4IF8.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-PI0V5.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\unins000.dat	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-6FMA4.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-VLN1F.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\RemoteControl20.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-MJODJ.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-SP3II.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-KUL69.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-R0VTF.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\js\is-P6N5F.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-NGJS6.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-CJ26J.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\uvh64.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-LF5P4.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-36H1K.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-86RB0.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-7OEN5.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-8VBET.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\uv_x64.exe	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-I421B.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt	UltraViewer_Service.exe
File created	C:\Program Files (x86)\UltraViewer\Language\is-C20TD.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-2MFL7.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-EOMIL.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-8DTUL.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-HJR2Q.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-VAN3T.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\NAudio.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-OIDEP.tmp	tmp8C43.tmp
File opened for modification	C:\Program Files (x86)\UltraViewer\uva64.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-M1FIF.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-D005N.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt	UltraViewer_Service.exe
File opened for modification	C:\Program Files (x86)\UltraViewer\msvbvm60.dll	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-UK30C.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\Language\is-JJIF8.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-3NMTM.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-QVJ3B.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-9S0U6.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\is-86Q7O.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\is-JHRAP.tmp	tmp8C43.tmp
File created	C:\Program Files (x86)\UltraViewer\images\emotions\is-5NTMO.tmp	tmp8C43.tmp

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3064	sc.exe
1068	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 2 IoCs

discovery

Remote System Discovery

T1018

pid	Process
2164	net.exe
2808	net.exe

Kills process with taskkill 64 IoCs

evasion

pid	Process
2904	taskkill.exe
2196	taskkill.exe
2952	taskkill.exe
2464	taskkill.exe
2368	taskkill.exe
1456	taskkill.exe
1416	taskkill.exe
2956	taskkill.exe
952	taskkill.exe
3064	taskkill.exe
1772	taskkill.exe
2024	taskkill.exe
2756	taskkill.exe
1628	taskkill.exe
2152	taskkill.exe
1736	taskkill.exe
2488	taskkill.exe
2108	taskkill.exe
2412	taskkill.exe
2484	taskkill.exe
2448	taskkill.exe
3012	taskkill.exe
1516	taskkill.exe
2324	taskkill.exe
1740	taskkill.exe
396	taskkill.exe
2052	taskkill.exe
2612	taskkill.exe
432	taskkill.exe
1600	taskkill.exe
2248	taskkill.exe
1580	taskkill.exe
1824	taskkill.exe
1668	taskkill.exe
2812	taskkill.exe
3012	taskkill.exe
1812	taskkill.exe
484	taskkill.exe
2340	taskkill.exe
2620	taskkill.exe
2740	taskkill.exe
2680	taskkill.exe
2900	taskkill.exe
3008	taskkill.exe
2028	taskkill.exe
1524	taskkill.exe
1672	taskkill.exe
636	taskkill.exe
2524	taskkill.exe
2688	taskkill.exe
432	taskkill.exe
1984	taskkill.exe
2684	taskkill.exe
1708	taskkill.exe
580	taskkill.exe
2720	taskkill.exe
808	taskkill.exe
1752	taskkill.exe
2280	taskkill.exe
2276	taskkill.exe
588	taskkill.exe
1948	taskkill.exe
1700	taskkill.exe
1832	taskkill.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	UltraViewer_Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	UltraViewer_Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	UltraViewer_Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	UltraViewer_Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	UltraViewer_Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	UltraViewer_Service.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{74E9E864-ED65-4721-A2A5-A526E21E8DA0}	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{64241102-ED1F-4C7B-9C89-0154DEC10283}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE4C47F6-270A-4326-8A50-44945B1CE53D}\TypeLib\Version = "1.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E9490A8D-2122-37B0-9F03-7331370868C2}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F6B6DA88-57D6-3088-AA2C-16C4E414F750}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16B664F6-B146-44A7-97FA-FB0EAD46802A}\InprocServer32\ = "C:\\Windows\\SysWow64\\mscoree.dll"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VListRect\CLSID\ = "{A22DB85C-01F0-4195-ADEA-3AEB76287B02}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2D7E50FF-DD5F-41C5-AA89-F176516E4439}\InprocServer32\ = "mscoree.dll"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{95125CC3-9020-469A-ABBA-A13552FC2227}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9FB76436-32BE-34B9-A597-95F976D0A917}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{81CD9B82-195B-3E8F-963C-2B896E60928E}\TypeLib\Version = "1.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5C61AF02-ACB0-3588-A612-C9864E9B61FA}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{30906764-2519-311F-8912-CBDE46ABBC2C}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77D3EC79-5618-3AA1-9C07-FBB008946C7D}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8390E592-F6CB-3AEF-B3F7-F01194DF0F9F}\TypeLib\Version = "1.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7D346869-3104-33CE-A4DD-267C11B16C22}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{E4E60540-170A-34F7-93D8-D4E56A26353F}\1.0.0.0\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{85C54413-2591-451A-B485-025CE2B9593F}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC83B1BB-5431-4613-8BA6-03568BF49111}\ = "RemoteControl.VContextMenu"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{452116E2-E64A-4EB5-988D-F11EC3B61D3F}\ = "_VRectangle"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7B669374-FA72-3081-BD98-89870D8D7618}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8DB17D55-22C2-3E30-870F-A04E54F1B4AB}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F774EA95-D9A5-316E-B411-B8822DF3EDE5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEA38B91-2B2E-318F-AAA4-449FAD36D692}\ = "_ClickEventHandler______15"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF7B1856-DAED-4296-96DB-94C798525565}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{74E9E864-ED65-4721-A2A5-A526E21E8DA0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F569B21E-C5B0-4AD2-80A0-B208B5D5C97B}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{62A7C086-6E75-4CE5-88B7-FFFFD229323D}\TypeLib\Version = "1.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2845DDC4-3AB7-425E-BCB7-7AB279C35F35}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D3FEC98-6682-3ADC-A5CA-9C7F38D0224B}\ = "_ReconnectedTimeOutEventHandler"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDC5AA3E-D7A6-4A3E-A7D2-A6DA5D7B560D}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{80D03754-CAF2-30A2-87CE-CF95148B4993}\TypeLib\ = "{F58D911B-3BCE-4ED7-9CA3-2F32BE5A915C}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{315D07B8-9F8F-3885-AB17-1C3D460CEE4E}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8F32897E-31F7-3D22-9821-B21205A85233}\ProgId	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7CFDD12-3563-4411-AAD5-FB1255391665}\InprocServer32\RuntimeVersion = "v4.0.30319"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A074C60F-D82F-4695-9E07-826FDAAF223E}\Version\ = "1.0"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{16B664F6-B146-44A7-97FA-FB0EAD46802A}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D7CFDD12-3563-4411-AAD5-FB1255391665}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AD8D00E3-BB51-4FE3-85A4-B191B1E0AFAC}\TypeLib\Version = "1.0"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66D294A1-137A-36A8-B70D-1F457E0F7E9D}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4DF77D89-3F3F-3FF6-890D-0EFCD96880D0}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4C2D3CD4-F2EB-4CB3-9CBD-09181267DD05}\InprocServer32\Class = "RemoteControl.clsStoredFrame+VRegion"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5C61AF02-ACB0-3588-A612-C9864E9B61FA}\TypeLib	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D49AC0EC-20E1-387F-9497-65CA60621995}\ = "_TextMouseClickEventHandler"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{867C3F99-D25B-3722-9807-380D2C204DC5}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3A56D79-088D-4B4C-AD52-3ABBA8D552C3}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C3A56D79-088D-4B4C-AD52-3ABBA8D552C3}\TypeLib	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AEAD75D8-A22D-4988-81CD-801183B81128}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8288FFE2-0D92-311E-B254-482D2C6C6D72}\ = "RemoteControl.VOnlineContactTreeView+NodeTag"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VTextbox\ = "RemoteControl.VTextbox"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7FC939D-118A-492D-997F-6CB79048C6CA}	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F4D4BB2-FA01-418B-B261-2CC14A6D7D4A}\ProxyStubClsid32	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F271EFB2-B5CC-4AEF-AADE-16693B26BA0B}\ProxyStubClsid32	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8EBA524-0098-31CD-9C50-7FE7774022FC}\InprocServer32\1.0.0.0\RuntimeVersion = "v4.0.30319"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4917D50F-EDA1-4B40-B74D-9B5E3AA5E624}\ = "_VStopWatch"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1E01A62C-82DC-3D2D-BDD2-CEE8B7F81BA7}\TypeLib	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B1AC4DDA-DCDD-3D4A-A346-7252B4701A8C}	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{90C4045D-A353-3C58-8DA9-10086BC5C771}\1.0.0.0\Assembly = "RemoteControl, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4AA6ABE-1A1A-41C4-A006-D175F931B657}\ProgId	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\RemoteControl.VUDPClient\CLSID\ = "{16B664F6-B146-44A7-97FA-FB0EAD46802A}"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{59ADBF5F-AA15-4A92-9A10-ED8EA4F578EA}\InprocServer32\ThreadingModel = "Both"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B651B886-4CB0-4A9A-983E-58DA7E4FFBB6}\InprocServer32\Class = "RemoteControl.VHTMLAgilityPack"	regasm.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6154ABF6-0EE9-4DD7-A9D3-ECF4B069B8B8}\ = "RemoteControl.VCallBackTimer"	regasm.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DD07158E-6BAF-4CCE-8485-62F5549C7822}	regasm.exe

Modifies system certificate store 2 TTPs 6 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	UVUpdater.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa24b0000000100000044000000420032004600410046003700360039003200460044003900460046004200440036003400450044004500330031003700450034003200330033003400420041005f0000002000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	UVUpdater.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	UVUpdater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	UVUpdater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	UVUpdater.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	UVUpdater.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2908	UltraViewer_Desktop.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1108	UVUpdater.exe
1108	UVUpdater.exe
1124	UVUninstallHelper.exe
2332	tmp8C43.tmp
2332	tmp8C43.tmp
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2504	UltraViewer_Service.exe
1108	UVUpdater.exe
1108	UVUpdater.exe
1108	UVUpdater.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1108	UVUpdater.exe
Token: SeDebugPrivilege	1124	UVUninstallHelper.exe
Token: SeDebugPrivilege	628	taskkill.exe
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeDebugPrivilege	1984	taskkill.exe
Token: SeDebugPrivilege	2340	taskkill.exe
Token: SeDebugPrivilege	2488	taskkill.exe
Token: SeDebugPrivilege	1748	taskkill.exe
Token: SeDebugPrivilege	2108	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	1824	taskkill.exe
Token: SeDebugPrivilege	1304	taskkill.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeDebugPrivilege	1752	taskkill.exe
Token: SeDebugPrivilege	2420	taskkill.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: SeDebugPrivilege	1636	taskkill.exe
Token: SeDebugPrivilege	2612	taskkill.exe
Token: SeDebugPrivilege	1416	taskkill.exe
Token: SeDebugPrivilege	2616	taskkill.exe
Token: SeDebugPrivilege	2956	taskkill.exe
Token: SeDebugPrivilege	2904	taskkill.exe
Token: SeDebugPrivilege	3008	taskkill.exe
Token: SeDebugPrivilege	2712	taskkill.exe
Token: SeDebugPrivilege	2028	taskkill.exe
Token: SeDebugPrivilege	432	taskkill.exe
Token: SeDebugPrivilege	2024	taskkill.exe
Token: SeDebugPrivilege	2288	taskkill.exe
Token: SeDebugPrivilege	2164	taskkill.exe
Token: SeDebugPrivilege	2812	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	1516	taskkill.exe
Token: SeDebugPrivilege	1948	taskkill.exe
Token: SeDebugPrivilege	2196	taskkill.exe
Token: SeDebugPrivilege	696	taskkill.exe
Token: SeDebugPrivilege	2324	taskkill.exe
Token: SeDebugPrivilege	1628	taskkill.exe
Token: SeDebugPrivilege	2684	taskkill.exe
Token: SeDebugPrivilege	1800	taskkill.exe
Token: SeDebugPrivilege	1740	taskkill.exe
Token: SeDebugPrivilege	2280	taskkill.exe
Token: SeDebugPrivilege	636	taskkill.exe
Token: SeDebugPrivilege	2152	taskkill.exe
Token: SeDebugPrivilege	1580	taskkill.exe
Token: SeDebugPrivilege	2524	taskkill.exe
Token: SeDebugPrivilege	2952	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe
Token: SeDebugPrivilege	2900	taskkill.exe
Token: SeDebugPrivilege	2756	taskkill.exe
Token: SeDebugPrivilege	2272	taskkill.exe
Token: SeDebugPrivilege	2464	taskkill.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	308	taskkill.exe
Token: SeDebugPrivilege	1708	taskkill.exe
Token: SeDebugPrivilege	2448	taskkill.exe
Token: SeDebugPrivilege	1524	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	1772	taskkill.exe
Token: SeDebugPrivilege	580	taskkill.exe
Token: SeDebugPrivilege	396	taskkill.exe
Token: SeDebugPrivilege	1652	taskkill.exe
Token: SeDebugPrivilege	484	taskkill.exe
Token: SeDebugPrivilege	960	taskkill.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2332	tmp8C43.tmp

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
2908	UltraViewer_Desktop.exe
3028	UltraViewer_Desktop.exe
776	UltraViewer_Desktop.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 1108 wrote to memory of 2764	1108	UVUpdater.exe	28
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2764 wrote to memory of 2332	2764	tmp8C43.tmp	29
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 1124	2332	tmp8C43.tmp	30
PID 2332 wrote to memory of 2164	2332	tmp8C43.tmp	31
PID 2332 wrote to memory of 2164	2332	tmp8C43.tmp	31
PID 2332 wrote to memory of 2164	2332	tmp8C43.tmp	31
PID 2332 wrote to memory of 2164	2332	tmp8C43.tmp	31
PID 2164 wrote to memory of 2076	2164	net.exe	33
PID 2164 wrote to memory of 2076	2164	net.exe	33
PID 2164 wrote to memory of 2076	2164	net.exe	33
PID 2164 wrote to memory of 2076	2164	net.exe	33
PID 2332 wrote to memory of 2808	2332	tmp8C43.tmp	34
PID 2332 wrote to memory of 2808	2332	tmp8C43.tmp	34
PID 2332 wrote to memory of 2808	2332	tmp8C43.tmp	34
PID 2332 wrote to memory of 2808	2332	tmp8C43.tmp	34
PID 2808 wrote to memory of 532	2808	net.exe	36
PID 2808 wrote to memory of 532	2808	net.exe	36
PID 2808 wrote to memory of 532	2808	net.exe	36
PID 2808 wrote to memory of 532	2808	net.exe	36
PID 2332 wrote to memory of 3064	2332	tmp8C43.tmp	37
PID 2332 wrote to memory of 3064	2332	tmp8C43.tmp	37
PID 2332 wrote to memory of 3064	2332	tmp8C43.tmp	37
PID 2332 wrote to memory of 3064	2332	tmp8C43.tmp	37
PID 2332 wrote to memory of 628	2332	tmp8C43.tmp	39
PID 2332 wrote to memory of 628	2332	tmp8C43.tmp	39
PID 2332 wrote to memory of 628	2332	tmp8C43.tmp	39
PID 2332 wrote to memory of 628	2332	tmp8C43.tmp	39
PID 2332 wrote to memory of 3000	2332	tmp8C43.tmp	42
PID 2332 wrote to memory of 3000	2332	tmp8C43.tmp	42
PID 2332 wrote to memory of 3000	2332	tmp8C43.tmp	42
PID 2332 wrote to memory of 3000	2332	tmp8C43.tmp	42
PID 2332 wrote to memory of 1984	2332	tmp8C43.tmp	44
PID 2332 wrote to memory of 1984	2332	tmp8C43.tmp	44
PID 2332 wrote to memory of 1984	2332	tmp8C43.tmp	44
PID 2332 wrote to memory of 1984	2332	tmp8C43.tmp	44
PID 2332 wrote to memory of 2340	2332	tmp8C43.tmp	46
PID 2332 wrote to memory of 2340	2332	tmp8C43.tmp	46
PID 2332 wrote to memory of 2340	2332	tmp8C43.tmp	46
PID 2332 wrote to memory of 2340	2332	tmp8C43.tmp	46
PID 2332 wrote to memory of 2488	2332	tmp8C43.tmp	48
PID 2332 wrote to memory of 2488	2332	tmp8C43.tmp	48
PID 2332 wrote to memory of 2488	2332	tmp8C43.tmp	48
PID 2332 wrote to memory of 2488	2332	tmp8C43.tmp	48
PID 2332 wrote to memory of 1748	2332	tmp8C43.tmp	50
PID 2332 wrote to memory of 1748	2332	tmp8C43.tmp	50
PID 2332 wrote to memory of 1748	2332	tmp8C43.tmp	50

C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe
"C:\Users\Admin\AppData\Local\Temp\Device\HarddiskVolume5\Program Files (x86)\UltraViewer\Update\UVUpdater.exe"
1⤵
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\AppData\Local\Temp\tmp8C43.tmp
  "C:\Users\Admin\AppData\Local\Temp\tmp8C43.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Users\Admin\AppData\Local\Temp\is-FFDQ1.tmp\tmp8C43.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-FFDQ1.tmp\tmp8C43.tmp" /SL5="$50174,3135487,121344,C:\Users\Admin\AppData\Local\Temp\tmp8C43.tmp" /SP- /donotlangovr=1 /verysilent /noicons /NORESTART /CloseApplications=no /netframework=""
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe
      "C:\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1124
  - - C:\Windows\SysWOW64\net.exe
      "net" stop UltraViewService
      4⤵
      Discovers systems in the same network
      Suspicious use of WriteProcessMemory
      PID:2164
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UltraViewService
        5⤵
        
        PID:2076
  - - C:\Windows\SysWOW64\net.exe
      "net" stop UltraViewService
      4⤵
      Discovers systems in the same network
      Suspicious use of WriteProcessMemory
      PID:2808
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UltraViewService
        5⤵
        
        PID:532
  - - C:\Windows\SysWOW64\sc.exe
      "sc" delete UltraViewService
      4⤵
      Launches sc.exe
      PID:3064
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:628
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3000
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1984
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2340
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2488
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1748
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2108
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2620
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1824
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1304
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1668
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1752
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2420
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2248
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1636
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2612
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1416
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2616
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2956
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2904
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3008
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2712
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2028
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2288
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2164
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2812
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3012
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1516
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:696
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2324
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1628
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2684
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1800
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1740
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2280
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:636
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2152
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1580
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2524
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2100
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2952
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1812
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2900
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2756
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2272
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2464
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1180
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:308
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1708
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2448
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1524
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3064
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3012
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:1772
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:580
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:396
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1652
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:484
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:960
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1832
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2368
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2412
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2688
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1736
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1600
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2052
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1672
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2932
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2720
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2740
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:808
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2600
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2548
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:432
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2024
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2484
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1456
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:1720
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:1700
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:1092
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2276
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:588
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:2680
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:1468
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:968
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:112
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:920
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      Kills process with taskkill
      PID:952
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:1616
  - - C:\Windows\SysWOW64\taskkill.exe
      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
      4⤵
      PID:2336
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:2148
  - - C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
      "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:2908
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
      4⤵
      Loads dropped DLL
      Drops file in Program Files directory
      PID:2180
  - - C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
      "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:3028
    - - C:\Windows\SysWOW64\sc.exe
        
        sc failure "UltraViewService" reset= 0 actions= restart/60000
        5⤵
        Launches sc.exe
        
        PID:1068
  - - C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
      "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      PID:776

C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
"C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
  2⤵
  PID:2376
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
  2⤵
  PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
  2⤵
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
C:\Program Files (x86)\UltraViewer\Language\English.txt

Filesize
14KB

MD5
b6a8ccdc51964e1551bef57b4a42a899

SHA1
52de4c2fc039af9a2f1295e8419123ba89ee5858

SHA256
c615da39ed0990bbad49686307872b18084b51bc8e401bd47a36509c66d2cc0a

SHA512
8d1e92a56373f79d850789152c9758a1f36a71bb9ee68982d50ea92537c3ce2f30ff9cfb707040f4c7dd3eb459082cfc849e511823bc4c210a88aa6db011dda6

Download Submit
C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini

Filesize
1KB

MD5
473b3896eae7ea66f61e9d0ffbe5b9b1

SHA1
d7ef69586317f7472ce400bc7bef75bfa4095592

SHA256
d3ee6fc3b7418afa19292eb7f6b872cae8ec04290b9ee1bd4cea8d8e88aec52f

SHA512
981ae52e4206bf04b345642ae87c88889e83d0c47e7251755d179d00fd35117e670205dab9d15042e26bc53dc18112206a5a650120928a52916bfadbc3a1fb66

Download Submit
C:\Program Files (x86)\UltraViewer\MSVBVM60.DLL

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Program Files (x86)\UltraViewer\NAudio.dll

Filesize
496KB

MD5
5da17fa97fce539c78e3018ee1c29cd0

SHA1
cff12edd4361fa5c310250ebaacbfc54274f00c8

SHA256
92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

SHA512
1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

Download Submit
C:\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
C:\Program Files (x86)\UltraViewer\RemoteControl.tlb

Filesize
236KB

MD5
b143c3325ebe228144ab14858ad4ccd6

SHA1
8291a8af7b05b8ca111b546da6de1383a9b5965c

SHA256
023dc7f119c850c7170e502198efc6b883bc69c72249b536c3827159b84e9044

SHA512
0c1bb83dcde848b24accbc8d6541ab2e10e814f83b6eb000f83c4ae8ad78a93ff237ebf681df5ab5bbc9450a672eec3ee801cd7b9b67d30fbb6e62a3ba0409ba

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewerService_log.txt

Filesize
486B

MD5
88ab8ac753efc2959ad9a305ad628834

SHA1
97ea1e3b0e87445086906a8f780e07e5945b775b

SHA256
ecfc634c3a63f3919bcb2935f2c32b37df70cceeb9b6d53ab984d066bdf6ff51

SHA512
a0083c957584d9965fc70a161bd7915282b127d64703a9f3725a823af9dd1285b86db32aa66ce084095364a2c010d12cf919b70805e5f2c8827b20611495b8c5

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config

Filesize
310B

MD5
42b8d26600dcb85572ee43616f929d6a

SHA1
31a4c46641129ef59eb925621c1aa4f8401d776c

SHA256
99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

SHA512
d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe

Filesize
226KB

MD5
30c5f65655bbaeab0f1afd219c609050

SHA1
f0317b4e3b420fd2e00483f366a0c9d31d2a8457

SHA256
8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

SHA512
611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe

Filesize
226KB

MD5
30c5f65655bbaeab0f1afd219c609050

SHA1
f0317b4e3b420fd2e00483f366a0c9d31d2a8457

SHA256
8befcbabbd44c300c9d6652cd94c8a0bee9a005cb63532a4974b6c882af968a7

SHA512
611e0c2b29cc60148478fd81fb1947adb1ed81adf58391cf188c685cc0d35d94b3c4b9b88cfb7170fa12332d55f3964fe8fcef7abe83bb0ed950aa698bcb338a

Download Submit
C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe.config

Filesize
225B

MD5
679aca3e8125584e8704b2dfdfa20a0b

SHA1
bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

SHA256
470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

SHA512
8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

Download Submit
C:\Program Files (x86)\UltraViewer\is-8UDM3.tmp

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
C:\Program Files (x86)\UltraViewer\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
C:\Program Files (x86)\UltraViewer\uvh.dll

Filesize
124KB

MD5
8b3f15a335710c799eae2395fa6b322d

SHA1
81b9f58fe2c61e26e758690f59fa4de4bc8b462b

SHA256
09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

SHA512
c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab82F7.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar8348.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FFDQ1.tmp\tmp8C43.tmp

Filesize
1.1MB

MD5
e845838d99d29c4bba4ad35ee996dea3

SHA1
34a9f433ce1e3339e07d75f0a74efd676b1d7cca

SHA256
b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

SHA512
fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-FFDQ1.tmp\tmp8C43.tmp

Filesize
1.1MB

MD5
e845838d99d29c4bba4ad35ee996dea3

SHA1
34a9f433ce1e3339e07d75f0a74efd676b1d7cca

SHA256
b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

SHA512
fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe

Filesize
43KB

MD5
ececb301656f5f8c6a46a8abf8d928fe

SHA1
9bdf8a054c71d34837262ab306db92d3ee70db3b

SHA256
801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

SHA512
314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe

Filesize
43KB

MD5
ececb301656f5f8c6a46a8abf8d928fe

SHA1
9bdf8a054c71d34837262ab306db92d3ee70db3b

SHA256
801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

SHA512
314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe.config

Filesize
225B

MD5
679aca3e8125584e8704b2dfdfa20a0b

SHA1
bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

SHA256
470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

SHA512
8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8C43.tmp

Filesize
3.4MB

MD5
a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

SHA1
0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

SHA256
a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

SHA512
b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8C43.tmp

Filesize
3.4MB

MD5
a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

SHA1
0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

SHA256
a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

SHA512
b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

Filesize
132KB

MD5
33bb06b97f8f188735f4aae5b413eef8

SHA1
e5c236f39d5b9d25b650cba7707df9149d3f4d16

SHA256
931f124016a15c30b3cf698534249b727eeed2b2de89236dd4c806e515668bc2

SHA512
abb484dcc03edbd7a1994affee0a11d38e13bb9ea171c3254982df5485272b3128a3594c05f8a9c1f9a8149578829dfee1decd0fdcb7f896de9b71e324f0ed4c

Download Submit
\Program Files (x86)\UltraViewer\NAudio.dll

Filesize
496KB

MD5
5da17fa97fce539c78e3018ee1c29cd0

SHA1
cff12edd4361fa5c310250ebaacbfc54274f00c8

SHA256
92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

SHA512
1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

Download Submit
\Program Files (x86)\UltraViewer\NAudio.dll

Filesize
496KB

MD5
5da17fa97fce539c78e3018ee1c29cd0

SHA1
cff12edd4361fa5c310250ebaacbfc54274f00c8

SHA256
92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

SHA512
1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

Download Submit
\Program Files (x86)\UltraViewer\NAudio.dll

Filesize
496KB

MD5
5da17fa97fce539c78e3018ee1c29cd0

SHA1
cff12edd4361fa5c310250ebaacbfc54274f00c8

SHA256
92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

SHA512
1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

Download Submit
\Program Files (x86)\UltraViewer\NAudio.dll

Filesize
496KB

MD5
5da17fa97fce539c78e3018ee1c29cd0

SHA1
cff12edd4361fa5c310250ebaacbfc54274f00c8

SHA256
92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

SHA512
1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\RemoteControl.dll

Filesize
1.0MB

MD5
21e54454f1f753b926c6f2d9aa05b91e

SHA1
b3c2a91eae69fc0594946165c4a9062502850076

SHA256
21c45aab3e953351e51cf4ce8dcf88ff68a6a97c224f66d07b5e1f1dfb296ff9

SHA512
9bb3528f0ed5595e6ea1314a91be09a252ade292ae29168126dcca38bbb734e636e0b7d3d89c208996389b4bc71e601bc983c65e943382b4909619dad3a66bd8

Download Submit
\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe

Filesize
979KB

MD5
6f63069253c1c0de8a6fa182de6d0a8c

SHA1
6308d0910529e0a4f0738547841d07a7e8f074fe

SHA256
b55a95b223c2a6d1d5467546f34cc4d9e386c34ae3ad5852530ad7c0db8f35a7

SHA512
5856bf822535fcb380ab17d95d3517c2d9a3a7edbd90d69e03df7aee5823d9636d401eeef1398e8fdb77ad608c06c116d5d871f89ed4d6cae89abb8bcecd2c61

Download Submit
\Program Files (x86)\UltraViewer\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Program Files (x86)\UltraViewer\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Program Files (x86)\UltraViewer\msvbvm60.dll

Filesize
1.3MB

MD5
5343a19c618bc515ceb1695586c6c137

SHA1
4dedae8cbde066f31c8e6b52c0baa3f8b1117742

SHA256
2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

SHA512
708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

Download Submit
\Program Files (x86)\UltraViewer\uvh.dll

Filesize
124KB

MD5
8b3f15a335710c799eae2395fa6b322d

SHA1
81b9f58fe2c61e26e758690f59fa4de4bc8b462b

SHA256
09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

SHA512
c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

Download Submit
\Users\Admin\AppData\Local\Temp\is-FFDQ1.tmp\tmp8C43.tmp

Filesize
1.1MB

MD5
e845838d99d29c4bba4ad35ee996dea3

SHA1
34a9f433ce1e3339e07d75f0a74efd676b1d7cca

SHA256
b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

SHA512
fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

Download Submit
\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\UVUninstallHelper.exe

Filesize
43KB

MD5
ececb301656f5f8c6a46a8abf8d928fe

SHA1
9bdf8a054c71d34837262ab306db92d3ee70db3b

SHA256
801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

SHA512
314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

Download Submit
\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
\Users\Admin\AppData\Local\Temp\is-KVENH.tmp\isxdl.dll

Filesize
121KB

MD5
48ad1a1c893ce7bf456277a0a085ed01

SHA1
803997ef17eedf50969115c529a2bf8de585dc91

SHA256
b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

SHA512
7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

Download Submit
\Users\Admin\AppData\Local\Temp\tmp8C43.tmp

Filesize
3.4MB

MD5
a3d0a2d3e5c40d7bd76c3e6a8bc4b18b

SHA1
0a2dd8004ab193daf98a02b7a3a74fbf3170c5f8

SHA256
a8acfe85f53d7f17f2c8c32e9aadd3b97c6e8f194f0a956c72255bea0e244e90

SHA512
b7f0635ac029cf42e65be2954d9fce8451bedb8cd3046bc552d48c37bd966d605866dc2261293e1cbfcff316cdb760c2e633fac5f48d26862bf4bb393de93064

Download Submit
memory/776-503-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/1108-148-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1108-151-0x0000000000190000-0x00000000001D0000-memory.dmp

Filesize
256KB

Download
memory/1108-149-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1108-510-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1108-56-0x0000000000190000-0x00000000001D0000-memory.dmp

Filesize
256KB

Download
memory/1108-55-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1108-54-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-147-0x00000000005B0000-0x00000000005F0000-memory.dmp

Filesize
256KB

Download
memory/1124-146-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-145-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/1124-150-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/2148-363-0x0000000000D50000-0x0000000000D62000-memory.dmp

Filesize
72KB

Download
memory/2148-377-0x00000000052B0000-0x0000000005332000-memory.dmp

Filesize
520KB

Download
memory/2148-367-0x0000000004D50000-0x0000000004E62000-memory.dmp

Filesize
1.1MB

Download
memory/2148-370-0x0000000004D50000-0x0000000004E62000-memory.dmp

Filesize
1.1MB

Download
memory/2148-372-0x0000000004F70000-0x0000000004FF6000-memory.dmp

Filesize
536KB

Download
memory/2180-427-0x0000000000010000-0x0000000000022000-memory.dmp

Filesize
72KB

Download
memory/2180-431-0x0000000000A10000-0x0000000000A38000-memory.dmp

Filesize
160KB

Download
memory/2180-434-0x0000000000A10000-0x0000000000A38000-memory.dmp

Filesize
160KB

Download
memory/2284-491-0x0000000000E10000-0x0000000000E22000-memory.dmp

Filesize
72KB

Download
memory/2332-501-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-507-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-447-0x0000000003F20000-0x0000000003F30000-memory.dmp

Filesize
64KB

Download
memory/2332-127-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2332-385-0x0000000003CA0000-0x00000000040B7000-memory.dmp

Filesize
4.1MB

Download
memory/2332-442-0x0000000003F20000-0x0000000003F30000-memory.dmp

Filesize
64KB

Download
memory/2332-134-0x0000000002E00000-0x0000000002E22000-memory.dmp

Filesize
136KB

Download
memory/2332-426-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-373-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-304-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-405-0x0000000003CA0000-0x00000000040B7000-memory.dmp

Filesize
4.1MB

Download
memory/2332-210-0x0000000000400000-0x000000000052D000-memory.dmp

Filesize
1.2MB

Download
memory/2332-490-0x0000000003F20000-0x0000000003F30000-memory.dmp

Filesize
64KB

Download
memory/2332-201-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2376-488-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/2504-487-0x00000000053F0000-0x0000000005807000-memory.dmp

Filesize
4.1MB

Download
memory/2504-464-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/2504-486-0x00000000053F0000-0x0000000005807000-memory.dmp

Filesize
4.1MB

Download
memory/2504-465-0x0000000073CA0000-0x000000007424B000-memory.dmp

Filesize
5.7MB

Download
memory/2764-508-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-191-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2764-118-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/2908-406-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/2908-418-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-425-0x0000000070210000-0x00000000708FE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-424-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/2908-387-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/2908-393-0x0000000005190000-0x00000000052A2000-memory.dmp

Filesize
1.1MB

Download
memory/2908-423-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-394-0x0000000070210000-0x00000000708FE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-395-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-422-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-421-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-420-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-419-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-402-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-397-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-401-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-416-0x0000000006B20000-0x0000000006BA2000-memory.dmp

Filesize
520KB

Download
memory/2908-412-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-413-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-411-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-410-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-409-0x0000000070210000-0x00000000708FE000-memory.dmp

Filesize
6.9MB

Download
memory/2908-408-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-407-0x0000000005770000-0x00000000057B0000-memory.dmp

Filesize
256KB

Download
memory/2908-403-0x0000000006790000-0x0000000006890000-memory.dmp

Filesize
1024KB

Download
memory/3028-460-0x0000000005680000-0x00000000056C0000-memory.dmp

Filesize
256KB

Download
memory/3028-472-0x0000000070050000-0x000000007073E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-471-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/3028-453-0x0000000000400000-0x0000000000817000-memory.dmp

Filesize
4.1MB

Download
memory/3028-459-0x0000000005680000-0x00000000056C0000-memory.dmp

Filesize
256KB

Download
memory/3028-458-0x0000000070050000-0x000000007073E000-memory.dmp

Filesize
6.9MB

Download
memory/3028-457-0x0000000005080000-0x0000000005192000-memory.dmp

Filesize
1.1MB

Download