Is ultradmg.exe safe? Yes, no threats found.

Programs the file ran, with their command lines.

• ultradmg.exe"C:\Users\<USER>\Desktop\ultradmg.exe"
• ultradmg.tmp"C:\Users\<USER>\AppData\Local\Temp\is-0B6HO4JRL9.tmp\ultradmg.tmp" /SL5="$2A01A8,26463823,906240,C:\Users\<USER>\Desktop\ultradmg.exe"
• UltraDMG.exe"C:\Program Files (x86)\SYSGeeker UltraDMG\UltraDMG.exe"
• mobsync.exeC:\Windows\System32\mobsync.exe -Embedding
• ultradmg.exeC:\Users\<USER>\AppData\Local\Temp\is-4J5NU15B11.tmp\ultradmg.tmp /SL5=$80098,26463823,906240,C:\Users\<USER>\Downloads\ultradmg.exe
• ultradmg.exe"C:\Users\user\Desktop\ultradmg.exe"

1 host, listed as 1 domain. Links show the host and path only.

• Domainocsps.ssl.com

Files the file created, changed or deleted.

• WrittenC:\Users\<USER>\AppData\Local\Temp\is-0B6HO4JRL9.tmp\ultradmg.tmp
• WrittenC:\Users\<USER>\AppData\Local\Temp\is-OII27RPQF8.tmp\_isetup\_setup64.tmp
• WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
• WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db
• WrittenC:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db
• WrittenC:\Program Files (x86)\SYSGeeker UltraDMG\aria2c.exe

Settings the file changed, including ways to start again after a restart.

• SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000
• SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash
• SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C1B93B8A-0BFF-4D5D-9829-861B686B0667}_is1\Inno Setup: Setup Version
• SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C1B93B8A-0BFF-4D5D-9829-861B686B0667}_is1\Inno Setup: App Path
• SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C1B93B8A-0BFF-4D5D-9829-861B686B0667}_is1\InstallLocation
• SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{C1B93B8A-0BFF-4D5D-9829-861B686B0667}_is1\Inno Setup: Icon Group

Named locks a program uses so only one copy runs; malware families often reuse them.

• Local\SessionImmersiveColorMutex
• Global\OneSettingQueryMutex+compat+encapsulation
• Local\SyncServiceThread
• \Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511
• \Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
• \Sessions\1\BaseNamedObjects\Global\C::Users:user:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex

The analysis machine's own processes and connections, recorded in every run.

• VM processExplorer.EXEC:\Windows\Explorer.EXE
• VM processDllHost.exeC:\Windows\system32\DllHost.exe /Processid:{133EAC4F-5891-4D04-BADA-D84870380A80}
• VM processservices.exeC:\Windows\system32\services.exe
• VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
• VM processsvchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p
• VM processsvchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p