Analysis

  • max time kernel
    85s
  • max time network
    85s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-06-2024 16:36

General

  • Target

    UltraViewer_setup_6.6_en.exe

  • Size

    3.2MB

  • MD5

    96d0e3328a5ca47056741fc4cfe70f45

  • SHA1

    656eaf078d2375e7b54a3ab950848320eba7bd40

  • SHA256

    0fa31dd2affdad98dbca7d8b7a9dc02c56093ff2ca06e6b03db7aa4cd4bf5260

  • SHA512

    6cf3a431d4c300b945bee4ce6fea72985d6ded02618f8ddbe66e9b6d0be89272db202dd2bb9fbfca360c476daed6485d146cc96c7924faa5339787e100580f63

  • SSDEEP

    98304:Q5zqs0pDMRE7Xy42GKw2tmRWhuwQPUFmD9ViPa:QqDli4Z/2tmUhuwSi2ca

Malware Config

Signatures

  • Stops running service(s) 4 TTPs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 34 IoCs
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in System32 directory 12 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Discovers systems in the same network 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 64 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6_en.exe
    "C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6_en.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5048
    • C:\Users\Admin\AppData\Local\Temp\is-QUTC3.tmp\UltraViewer_setup_6.6_en.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QUTC3.tmp\UltraViewer_setup_6.6_en.tmp" /SL5="$40210,2903087,121344,C:\Users\Admin\AppData\Local\Temp\UltraViewer_setup_6.6_en.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      PID:3796
      • C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\UVUninstallHelper.exe
        "C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\UVUninstallHelper.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2296
      • C:\Windows\SysWOW64\net.exe
        "net" stop UltraViewService
        3⤵
        • Discovers systems in the same network
        PID:3392
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop UltraViewService
          4⤵
            PID:2556
        • C:\Windows\SysWOW64\net.exe
          "net" stop UltraViewService
          3⤵
          • Discovers systems in the same network
          PID:1380
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop UltraViewService
            4⤵
              PID:5064
          • C:\Windows\SysWOW64\sc.exe
            "sc" delete UltraViewService
            3⤵
            • Launches sc.exe
            PID:2032
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1796
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4468
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4588
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3472
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:312
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4740
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Kills process with taskkill
            PID:4284
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3532
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1340
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4156
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1732
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4828
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1104
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4076
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:4460
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2816
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:448
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3584
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
            3⤵
            • Kills process with taskkill
            PID:3220
          • C:\Windows\SysWOW64\taskkill.exe
            "taskkill.exe" /f /im "UltraViewer_Service.exe"
            3⤵
              PID:1048
            • C:\Windows\SysWOW64\taskkill.exe
              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
              3⤵
                PID:2080
              • C:\Windows\SysWOW64\taskkill.exe
                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                3⤵
                  PID:4916
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  3⤵
                  • Kills process with taskkill
                  PID:3884
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                  3⤵
                  • Kills process with taskkill
                  PID:2392
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  3⤵
                  • Kills process with taskkill
                  PID:3352
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                  3⤵
                  • Kills process with taskkill
                  PID:3968
                • C:\Windows\SysWOW64\taskkill.exe
                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                  3⤵
                    PID:4228
                  • C:\Windows\SysWOW64\taskkill.exe
                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                    3⤵
                      PID:3160
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      3⤵
                      • Kills process with taskkill
                      PID:1940
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                      3⤵
                      • Kills process with taskkill
                      PID:3900
                    • C:\Windows\SysWOW64\taskkill.exe
                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                      3⤵
                        PID:688
                      • C:\Windows\SysWOW64\taskkill.exe
                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                        3⤵
                          PID:1652
                        • C:\Windows\SysWOW64\taskkill.exe
                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                          3⤵
                            PID:1380
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                            3⤵
                            • Kills process with taskkill
                            PID:2284
                          • C:\Windows\SysWOW64\taskkill.exe
                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                            3⤵
                              PID:2060
                            • C:\Windows\SysWOW64\taskkill.exe
                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                              3⤵
                                PID:1576
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                3⤵
                                • Kills process with taskkill
                                PID:3164
                              • C:\Windows\SysWOW64\taskkill.exe
                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                3⤵
                                  PID:2480
                                • C:\Windows\SysWOW64\taskkill.exe
                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                  3⤵
                                    PID:4040
                                  • C:\Windows\SysWOW64\taskkill.exe
                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                    3⤵
                                      PID:3736
                                    • C:\Windows\SysWOW64\taskkill.exe
                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                      3⤵
                                        PID:1432
                                      • C:\Windows\SysWOW64\taskkill.exe
                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                        3⤵
                                          PID:1944
                                        • C:\Windows\SysWOW64\taskkill.exe
                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                          3⤵
                                            PID:2520
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                            3⤵
                                            • Kills process with taskkill
                                            PID:2376
                                          • C:\Windows\SysWOW64\taskkill.exe
                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                            3⤵
                                              PID:4304
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                              3⤵
                                                PID:1048
                                              • C:\Windows\SysWOW64\taskkill.exe
                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                3⤵
                                                  PID:396
                                                • C:\Windows\SysWOW64\taskkill.exe
                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                  3⤵
                                                    PID:3348
                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                    3⤵
                                                      PID:4432
                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                      3⤵
                                                        PID:4872
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                        3⤵
                                                        • Kills process with taskkill
                                                        PID:3000
                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                        3⤵
                                                          PID:1632
                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                          3⤵
                                                            PID:1836
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                            3⤵
                                                              PID:2500
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                              3⤵
                                                              • Kills process with taskkill
                                                              PID:2044
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                              3⤵
                                                              • Kills process with taskkill
                                                              PID:3708
                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                              3⤵
                                                                PID:4660
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:2740
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                3⤵
                                                                • Kills process with taskkill
                                                                PID:220
                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                3⤵
                                                                  PID:1852
                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                  3⤵
                                                                    PID:376
                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                    3⤵
                                                                      PID:2432
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                      3⤵
                                                                      • Kills process with taskkill
                                                                      PID:216
                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                      3⤵
                                                                        PID:2476
                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                        3⤵
                                                                          PID:2716
                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                          3⤵
                                                                            PID:4200
                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                            3⤵
                                                                              PID:2376
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:4072
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:2172
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:2032
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                              3⤵
                                                                              • Kills process with taskkill
                                                                              PID:4588
                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                              3⤵
                                                                                PID:3060
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                3⤵
                                                                                • Kills process with taskkill
                                                                                PID:1852
                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                3⤵
                                                                                  PID:1104
                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                  3⤵
                                                                                    PID:4416
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:2504
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:4940
                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                    3⤵
                                                                                      PID:4044
                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                      3⤵
                                                                                        PID:1240
                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                        3⤵
                                                                                          PID:4148
                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                          3⤵
                                                                                            PID:2068
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:960
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:4576
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                            3⤵
                                                                                            • Kills process with taskkill
                                                                                            PID:3504
                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                            3⤵
                                                                                              PID:4916
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                              3⤵
                                                                                              • Kills process with taskkill
                                                                                              PID:540
                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                              3⤵
                                                                                                PID:3060
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                3⤵
                                                                                                • Kills process with taskkill
                                                                                                PID:3736
                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                3⤵
                                                                                                  PID:3000
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                  3⤵
                                                                                                  • Kills process with taskkill
                                                                                                  PID:4416
                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                  3⤵
                                                                                                    PID:428
                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                    3⤵
                                                                                                      PID:216
                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                      3⤵
                                                                                                        PID:1580
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                        3⤵
                                                                                                        • Kills process with taskkill
                                                                                                        PID:1660
                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                        3⤵
                                                                                                          PID:4596
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                          3⤵
                                                                                                          • Kills process with taskkill
                                                                                                          PID:4224
                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                          3⤵
                                                                                                            PID:4000
                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                            3⤵
                                                                                                              PID:2748
                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                              3⤵
                                                                                                                PID:2192
                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                3⤵
                                                                                                                  PID:4572
                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                  3⤵
                                                                                                                    PID:4432
                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                    3⤵
                                                                                                                      PID:3884
                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                      3⤵
                                                                                                                        PID:3768
                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                        3⤵
                                                                                                                          PID:3500
                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                          3⤵
                                                                                                                            PID:4828
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                            3⤵
                                                                                                                            • Kills process with taskkill
                                                                                                                            PID:1432
                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                            3⤵
                                                                                                                              PID:4412
                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                              3⤵
                                                                                                                                PID:3588
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                3⤵
                                                                                                                                • Kills process with taskkill
                                                                                                                                PID:4648
                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                3⤵
                                                                                                                                  PID:3220
                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:4984
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:5072
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:4000
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Kills process with taskkill
                                                                                                                                    PID:4848
                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                    3⤵
                                                                                                                                      PID:3140
                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                      3⤵
                                                                                                                                        PID:4640
                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                        3⤵
                                                                                                                                          PID:1220
                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:1772
                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                          3⤵
                                                                                                                                          • Kills process with taskkill
                                                                                                                                          PID:2688
                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                          3⤵
                                                                                                                                            PID:4156
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                            3⤵
                                                                                                                                            • Kills process with taskkill
                                                                                                                                            PID:3412
                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                            3⤵
                                                                                                                                              PID:4728
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                              3⤵
                                                                                                                                              • Kills process with taskkill
                                                                                                                                              PID:216
                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                              3⤵
                                                                                                                                                PID:3160
                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                3⤵
                                                                                                                                                  PID:3688
                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:5016
                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4224
                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:4808
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                        3⤵
                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                        PID:4660
                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3348
                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                          3⤵
                                                                                                                                                            PID:4408
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                            3⤵
                                                                                                                                                            • Kills process with taskkill
                                                                                                                                                            PID:4024
                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:4872
                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                              3⤵
                                                                                                                                                                PID:2392
                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:2688
                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:4156
                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:3412
                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4728
                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:216
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Kills process with taskkill
                                                                                                                                                                          PID:3160
                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:5100
                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:5016
                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Kills process with taskkill
                                                                                                                                                                              PID:4224
                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1348
                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:4660
                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:3348
                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4916
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:444
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                      • Kills process with taskkill
                                                                                                                                                                                      PID:4028
                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:2900
                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:4824
                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:3548
                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2676
                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:4412
                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2716
                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:2660
                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:3392
                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:692
                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1804
                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4712
                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1852
                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:820
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:3480
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1760
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:624
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:1944
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:3192
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                  PID:2500
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:752
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:4372
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                    PID:1288
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:824
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:5008
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:8
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:2320
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:3208
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                              "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:3412
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                • Kills process with taskkill
                                                                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1580
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                  • Kills process with taskkill
                                                                                                                                                                                                                                                  PID:3220
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                  "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:4224
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:4388
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:4368
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Kills process with taskkill
                                                                                                                                                                                                                                                    PID:3348
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                    "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1364
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                      "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1220
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                        • Kills process with taskkill
                                                                                                                                                                                                                                                        PID:4028
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                        "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:4964
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                          "taskkill.exe" /f /im "UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:3320
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                                                                                                                                                                                                                            "taskkill.exe" /f /im "UltraViewer_Service.exe"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:3412
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl.dll" /tlb
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:1064
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" validate
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:3220
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe" "C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll" /tlb
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Modifies registry class
                                                                                                                                                                                                                                                              PID:2132
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" install
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:1508
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\sc.exe
                                                                                                                                                                                                                                                                sc failure "UltraViewService" reset= 0 actions= restart/60000
                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                • Launches sc.exe
                                                                                                                                                                                                                                                                PID:2392
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe" regasm40
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:756
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • Loads dropped DLL
                                                                                                                                                                                                                                                              • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                              PID:4368
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                          PID:1820
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff99247ab58,0x7ff99247ab68,0x7ff99247ab78
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1568
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:2
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4796
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:8
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2208
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:8
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1896
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3700
                                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:4436
                                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3580 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:8
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:756
                                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:8
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:4640
                                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4636 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:400
                                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4944 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:4416
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3108 --field-trial-handle=1836,i,4653598945891401440,7605232190898478497,131072 /prefetch:1
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2640
                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:3940
                                                                                                                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\system32\cmd.exe"
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:3584
                                                                                                                                                                                                                                                                                      • C:\Windows\system32\ipconfig.exe
                                                                                                                                                                                                                                                                                        ipconfig
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Gathers network information
                                                                                                                                                                                                                                                                                        PID:1896
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\mspaint.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\RepairResume.jpeg" /ForceBootstrapPaint3D
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:2036
                                                                                                                                                                                                                                                                                    • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                                                                                      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                                                                                      PID:3972
                                                                                                                                                                                                                                                                                    • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                      PID:1348
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe"
                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Writes to the Master Boot Record (MBR)
                                                                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                      PID:464
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                                                                                                        PID:3676
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:4992
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files (x86)\UltraViewer\RemoteControl40.dll" /tlb /codebase
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:448
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe
                                                                                                                                                                                                                                                                                            UltraViewer_Desktop.exe -pid:4368 -debughwnd:-1
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                            PID:116
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\UltraViewer\uv_x64.exe
                                                                                                                                                                                                                                                                                            uv_x64.exe hook 4368 131760
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            PID:3300

                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\HtmlAgilityPack.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          130KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          00dc215cee6be49802295ad6802da661

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          8a04d6be54ea950986469e951f64641f54e0b080

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          78750e7bd53ed088d8365fc2e69b74883a813b0ea0d461873ad61fd8059dbd31

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          b82a020fd0d5ffe480389f3472fba4a5695bd045493eabfd5de3cc628ed19ba731eca8266e7a8594235ef93453b196b9a914b2376c0d9709d3e63718894c0785

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\Language.ini

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          2B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          9cfefed8fb9497baa5cd519d7d2bb5d7

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          094b0fe0e302854af1311afab85b5203ba457a3b

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          dbd3a49d0d906b4ed9216b73330d2fb080ef2f758c12f3885068222e5e17151c

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          41dd75307a2e7c49caf53fff15aada688275ef4d7950bedf028612b73f343ed45cf51fe1d4d27f58ed12e93e0fd0ae7f69428db169211554d1b380c91aa5cd01

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\Language\English.txt

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          14KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          f1aec4996c20919cf409233381a7f2cc

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          a42ca00c2fdf629b59bf28cbdb4a4f8dd8a379c2

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          33ef5c04e6abe19e5f56f28c8f71b323606c803625ae238340231f6e36a2ef82

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          cdd564cb07a528839133ca64aacadbfab212d150974ece5b9d11cc928f0a75070032434782824d486b894bcfd362d27ea7f9c6c1ed96e1152aa3a0ffa7266c3f

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\Language\LanguageList.ini

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          ac089148d930e0380d34164d2b16eb2b

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          961a0615d0e3491cdbb4d226092bfef4b5be4ce0

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          30b1a2e3b1f3d5c25b617438d9c24c492f292c6059a8de02ff5e0666e4d9a3f6

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          977c5bf445ae5a3c696c5af6ba97fd3963291f88cd946f2ce8d35f70ff16764fa3c5e1eafa6b14e5beac75da1d77bea6f99bd2164e36c037dfd44ee0244908e8

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\NAudio.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          496KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          5da17fa97fce539c78e3018ee1c29cd0

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          cff12edd4361fa5c310250ebaacbfc54274f00c8

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          92254cb54bbdd875f6950c2afbfe17c001bbf7dccd43d43eafdb7d9bfec35afe

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          1f402ebe99cf95c55e9b524b91c9002a68f04f7f7d7a29e189c2226ad88e76bf18047b201c75de805b4dcde9830d765d705946b045937aa40d3e2e5465e5dcc5

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          4e6629225fb913a103de0bc3f42e51b4

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          63239d6b2fee80aeb2595656f11d2669475ea53f

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          2dabe96727b0bdd1c83d08d06df0f77971f729af88af18e039814c6a7538b705

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          41c73c49d5d76e0e2150a9d4393608fd4df99f77f3baf389c6f8d4cc23451de39f05bc058d821936cc1512eec68d574ac843a31e4609c8417b5f2e81bbb403c6

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\RemoteControl.tlb

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          255KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          eeae895cae230a0df9e6e56aa40fd8a2

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          eca9c588e2b22a950073023d434901ebb3648825

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          0912b7e1e2585f79f9f4a74d0145106a853ec38f9b4ccbafcdee335c8653445a

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          09d0810f0986a8cc9d4a7aaa2d9ea3a92dde278480a5bb38720fc13e22148622ce56043b86b1069c986d111c0763179652795d3e651ec1e66f0d12429a63b61c

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Desktop.exe.config

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          310B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          42b8d26600dcb85572ee43616f929d6a

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          31a4c46641129ef59eb925621c1aa4f8401d776c

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          99f95d44f1e42cf485132e722679f9d0c6f6cd5f560ce76dfd98abf8558377bc

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          d485b45f06de66ff31b8db6706868ac3d3f89b3980bffaa05b539f0ad2b2373e72fd1aab4cfb8cf0dca7d52b43df195336f53cc9cfe99a9d87143c02a5470eae

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\UltraViewer_Service.exe

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          235KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          dc87d34efd1406e84d8f4559749f062f

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          2999d519d6b305d3db6ee8601e1879b8d9d9681a

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          10ff43f2d4a991c83caefce1c4442fa95258d0d93f168dde339f52322aa371e9

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          9420a088bbcd8746ed734c4986f0153b8db606caabc190b3a2005e3087ae0135a832c310ccd5712e1fd77b9661f2efa6b509c72008e0d9a422480c871cb7f2be

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\is-PSSQ7.tmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1012KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          54f25d41d8a7896b10aad1de0fdc5551

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          618803beffa5e001009884f9797f2f12a091608f

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          786230e60306a1cbc9f0ad3c5b41add3b151b3cfa5d24ae8027910a4f65187eb

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          271dc150f91d8a0fb12e39e6c70b988573b269df02900d77b1e880bdf62fb393ffb44af0085e6571249f88a591d6a1a6e481fc9243262c9d8c6a1d5907982831

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\msvbvm60.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.3MB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          5343a19c618bc515ceb1695586c6c137

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          4dedae8cbde066f31c8e6b52c0baa3f8b1117742

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          2246b4feae199408ea66d4a90c1589026f4a5800ce5a28e583b94506a8a73dce

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          708d8a252a167fa94e3e1a49e2630d07613ff75a9a3e779a0c1fcbec44aa853a68c401f31a2b84152f46a05f7d93f4e5e502afc7a60236a22ac58dea73fa5606

                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\UltraViewer\uvh.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          124KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          8b3f15a335710c799eae2395fa6b322d

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          81b9f58fe2c61e26e758690f59fa4de4bc8b462b

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          09ab11cb97673838faf91b8d06ed9ff7ad460d7791715ee983b83004984a452c

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          c0dd2302d5d00d8c1f7b21972a12d0ce8bfda07603e8cb3006e6df696458d15e3b8e7eeefa712195e3337ddda6de0f683d66963dde5484172517c6338e48dda9

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          811B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          2fff0e3fa81f188548ecda561dfd1f94

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          86f727e17ad57985b66660cd9e17bde1c0bb5689

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          03f45f2caf4297595431ea59528da1a8aa69f830003d25f58811c03143c871f1

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          1aa6cf26344239ff209c2bbceebf8419365a8e7be72ca233cbfbaf2e5a66b5b002272a65d9c90a1c6e1262d5420b5cdd48072731edb0fc3ac383e3375dfa9829

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          2B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          7KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          f2bbc7a43ec267f83a8a59a25961851e

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          5fb2bd658e2a657c142aca060ffbe88de938580c

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          8c0aa34ddd177d3ed29b49df18d9f011ddcbeae5ec5b30c30287175a88183f23

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          0a4804530d1b6cd99ad1c0684fd1465c490962765571f49c932b211c48689bdb92732e7c104daffd5545c2c3af5a6c2f4514efa523256221a72106b0da14588c

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          257KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          1291b349c723366b6609eb666be511d6

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          ade1984c9a6f30db495ca37dc8d797575f92069e

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          de254acc80af597f7d93bcb3d36900f76d920b4e027d4f6ab08f34829d25fb24

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          666d4c4d1f2ed7f7bcf81ddb070361b99d9e880cb0d527858d70f0783da4fc854a0522f5736ae5dbeb79448333d324ce3625bed90d0ae9bb100cfda4dfcdbd7d

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          257KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          818b16ef39c633736652925861aeb428

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          5468c1fd3f0aa3baa198310d08b5f29e9bd6c7e8

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          05058ac95a35854973a65ddf68a6601f7ecf74bb2055a0662b3b3dd50b402f44

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          ace1ec0959b9bb3c82379cef5e51c873c4e716d7ea141fcbe8240b58dfdffc12f884bf86f7c3acca85caa4aeb43c231dcf6d45867e601f08261b33021eeb8469

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          257KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          b04fe0abc6f39da9ce35d3cd9800d1df

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          0dd1cb61a2d138178afc858c0811cf3575b23de6

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          ff26111dde334756242117e5e1fa68ddbff32f1fc27153d1814303df694faf1e

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          02ff92faa63aa446631fd97537d2d523203426ebccbd2fdafbd88bf50c70354df01489b5085cb13be187901d4e571be524db7badcd327e4e47432bced18dc39b

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          264KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          f50f89a0a91564d0b8a211f8921aa7de

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\UltraViewer_Desktop.exe.log

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          81cc3ddcb2974a02db7a3cd4955a2a9a

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          b9c9d796a84cf9e6d14582c9bbe5713dc129a5d0

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          b660cfa1d78e3d585e184c23a2cdd37749a2e1a8f37797fc96d9bc119036e023

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          1b61546278e7457f1afe5850d6c62f34212d9030b4e86469f9ac51bb37761f883812c917b0575e08aa8855733cc79256b8ae8c9c0664b0d29a9cb0938cdfa3a6

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\regasm.exe.log

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          507B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          76ffb2f33cb32ade8fc862a67599e9d8

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          920cc4ab75b36d2f9f6e979b74db568973c49130

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          f1a3724670e3379318ec9c73f6f39058cab0ab013ba3cd90c047c3d701362310

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          f33502c2e1bb30c05359bfc6819ca934642a1e01874e3060349127d792694d56ad22fccd6c9477b8ee50d66db35785779324273f509576b48b7f85577e001b4e

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\UVUninstallHelper.exe

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          43KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          ececb301656f5f8c6a46a8abf8d928fe

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          9bdf8a054c71d34837262ab306db92d3ee70db3b

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          801bbe7a174ca09bb029aedf54c3073d96c033fa01dcd68f4240983d2ad7cb6b

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          314178d1b1ab4391d327b9f687fe5cd066a5dc9ecb75528a7572ade31f4630af618717eaf5dd75a436182d77a999fc67fafea3a60ad2a8f03111542ba1c813f6

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\UVUninstallHelper.exe.config

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          225B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          679aca3e8125584e8704b2dfdfa20a0b

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          bab48dc1c46f6d8b2c38cf47d9435ae9f8bf295e

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          470ce4147bff777ebefc7ccc9e2d1bc5df203b727134fc90b0134bf3cdc7add4

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          8441e36e9091dae33350083b1824bc154f969c4fa86c5984c45e0bd59536933e48773ff4bfb4297e543cb270149025dca82c6bdfad2ca1639f4df58f8abcae6e

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\idp.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          232KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          55c310c0319260d798757557ab3bf636

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          0892eb7ed31d8bb20a56c6835990749011a2d8de

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QU0VJ.tmp\isxdl.dll

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          121KB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          48ad1a1c893ce7bf456277a0a085ed01

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          803997ef17eedf50969115c529a2bf8de585dc91

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4

                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\is-QUTC3.tmp\UltraViewer_setup_6.6_en.tmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          e845838d99d29c4bba4ad35ee996dea3

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          34a9f433ce1e3339e07d75f0a74efd676b1d7cca

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          b727418174ad4f929ad9206e4df51865def55c0d2874bda487cbae6f2946938d

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          fba499d125eec733535d6b5d93fa43e628e526e7bc3b1aab7e848a80ac373cb09db9cb6777567c51877267001d3dc308b2edae1ac51e109c2936bd3c20928f1d

                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          42B

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          84cfdb4b995b1dbf543b26b86c863adc

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          d2f47764908bf30036cf8248b9ff5541e2711fa2

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          d8988d672d6915b46946b28c06ad8066c50041f6152a91d37ffa5cf129cc146b

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          485f0ed45e13f00a93762cbf15b4b8f996553baa021152fae5aba051e3736bcd3ca8f4328f0e6d9e3e1f910c96c4a9ae055331123ee08e3c2ce3a99ac2e177ce

                                                                                                                                                                                                                                                                                        • \??\pipe\crashpad_1820_IZKTEHVUTTUWLZLI

                                                                                                                                                                                                                                                                                          MD5

                                                                                                                                                                                                                                                                                          d41d8cd98f00b204e9800998ecf8427e

                                                                                                                                                                                                                                                                                          SHA1

                                                                                                                                                                                                                                                                                          da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                                                                                                                                                                                                                          SHA256

                                                                                                                                                                                                                                                                                          e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                                                                                                                                                                                                                          SHA512

                                                                                                                                                                                                                                                                                          cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                                                                                                                                                                                                                                        • memory/116-512-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/756-491-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/1064-419-0x00000000060C0000-0x0000000006142000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          520KB

                                                                                                                                                                                                                                                                                        • memory/1064-409-0x0000000004FB0000-0x00000000050D6000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.1MB

                                                                                                                                                                                                                                                                                        • memory/1064-415-0x0000000005180000-0x0000000005206000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          536KB

                                                                                                                                                                                                                                                                                        • memory/1064-414-0x0000000005220000-0x00000000052BC000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          624KB

                                                                                                                                                                                                                                                                                        • memory/1064-413-0x00000000050E0000-0x0000000005172000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          584KB

                                                                                                                                                                                                                                                                                        • memory/1064-412-0x0000000005690000-0x0000000005C34000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          5.6MB

                                                                                                                                                                                                                                                                                        • memory/1064-405-0x0000000000380000-0x0000000000392000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          72KB

                                                                                                                                                                                                                                                                                        • memory/1508-467-0x00000000033B0000-0x00000000033D2000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                        • memory/1508-477-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/1508-461-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/2132-452-0x0000000004C10000-0x0000000004C36000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          152KB

                                                                                                                                                                                                                                                                                        • memory/2296-77-0x0000000073C00000-0x00000000741B1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          5.7MB

                                                                                                                                                                                                                                                                                        • memory/2296-75-0x0000000073C02000-0x0000000073C03000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/2296-81-0x0000000073C00000-0x00000000741B1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          5.7MB

                                                                                                                                                                                                                                                                                        • memory/2296-76-0x0000000073C00000-0x00000000741B1000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          5.7MB

                                                                                                                                                                                                                                                                                        • memory/3220-438-0x0000000006F90000-0x00000000074BC000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          5.2MB

                                                                                                                                                                                                                                                                                        • memory/3220-441-0x0000000007C90000-0x0000000007C9A000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          40KB

                                                                                                                                                                                                                                                                                        • memory/3220-447-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/3220-428-0x0000000000400000-0x000000000084C000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4.3MB

                                                                                                                                                                                                                                                                                        • memory/3796-333-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-493-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-504-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-16-0x0000000003380000-0x00000000033A2000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          136KB

                                                                                                                                                                                                                                                                                        • memory/3796-281-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-83-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-231-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-6-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-445-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-52-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3796-181-0x0000000000400000-0x000000000052D000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          1.2MB

                                                                                                                                                                                                                                                                                        • memory/3972-366-0x00000235183C0000-0x00000235183D0000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                        • memory/3972-377-0x0000023521090000-0x0000023521091000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-380-0x0000023521130000-0x0000023521131000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-383-0x0000023521130000-0x0000023521131000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-373-0x0000023521010000-0x0000023521011000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-375-0x0000023521090000-0x0000023521091000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-379-0x0000023521120000-0x0000023521121000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/3972-362-0x0000023518380000-0x0000023518390000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          64KB

                                                                                                                                                                                                                                                                                        • memory/3972-378-0x0000023521120000-0x0000023521121000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          4KB

                                                                                                                                                                                                                                                                                        • memory/4368-523-0x000000000D680000-0x000000000DE26000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          7.6MB

                                                                                                                                                                                                                                                                                        • memory/5048-51-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          160KB

                                                                                                                                                                                                                                                                                        • memory/5048-505-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          160KB

                                                                                                                                                                                                                                                                                        • memory/5048-2-0x0000000000401000-0x0000000000412000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          68KB

                                                                                                                                                                                                                                                                                        • memory/5048-0-0x0000000000400000-0x0000000000428000-memory.dmp

                                                                                                                                                                                                                                                                                          Filesize

                                                                                                                                                                                                                                                                                          160KB