» ucp.exe
Overview
Analysis
File Details
Behaviors (1)

ucp.exe

Ultra Core Protector

The application ucp.exe by Ultra Core Protector has been detected as a potentially unwanted program by 8 anti-malware scanners. It runs as a scheduled task under the Windows Task Scheduler.

File name:

ucp.exe

Publisher:

Ultra Core Protector (signed and verified)

Product:

Ultra Core Protector

Version:

7.4

MD5:

dd6f2f2f2a093b8d8e6d59f9f88dc833

SHA-1:

34f31225164448993dd05af36641618b7a10de69

SHA-256:

cdddcf0547abdd4690facc6644475788cb610e5c825b654c0db9dd6ca48c0274

Scanner detections:

8 / 68

Status:

Potentially unwanted

Analysis date:

6/25/2025 4:57:20 AM UTC (today)

Scan engine

Detection

Engine version

AVG

Win32/Heur

2016.0.3018

Baidu Antivirus

Hacktool.Win32.GameThief

4.0.3.15813

Bkav FE

HW32.Packed

1.3.0.4959

Comodo Security

Virus.Win32.Virut.CE

20093

IKARUS anti.virus

Virus.Win32.Heur

t3scan.1.8.3.0

Reason Heuristics

PUP.UltraCoreProtector (M)

15.8.24.17

Trend Micro House Call

TROJ_GEN.F47V1105

7.2.225

Vba32 AntiVirus

BScope.Trojan.Diple

3.12.22.2

File size:

596.7 KB (610,984 bytes)

Product version:

7.4.1.0

Original file name:

ucp.exe

File type:

Executable application (Win32 EXE)

Language:

English (United States)

Common path:

C:\Program Files\longhorn\counter-strike 1.6 lh 2012\cs-2012\ucp.exe

Digital Signature

Signed by:

Ultra Core Protector

Authority:

Ultra Core Protector

Valid from:

11/11/2011 8:47:28 AM

Valid to:

12/31/2039 8:59:59 PM

Subject:

CN=Endi, OU=http://ucp-anticheat.org, E=support@ucp-anticheat.org, O=Ultra Core Protector, C=RU

Issuer:

CN=Endi, OU=http://ucp-anticheat.org, E=support@ucp-anticheat.org, O=Ultra Core Protector, C=RU

Serial number:

B779B3E24427C0A7407A7E3B4EEFEC21

File PE Metadata

Compilation timestamp:

1/8/2012 10:27:07 AM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

5.12

CTPH (ssdeep):

12288:ZzA6dxDS3AMHqm1WlUTe/mWQT2uAV6wBOAFMOi3IWX+KVOBwa79Cc:xHS3lx1Wl8JPTZAUt2Ida7J

Entry address:

0x343DA38

Entry point:

9C, 60, 60, E8, 3C, 56, F7, FF, 38, E0, 0F, BB, C3, 66, 81, CF, 92, BF, 66, D3, CA, 29, C0, 60, 66, 0F, CB, 66, F7, D2, FF, 34, 24, 8B, 54, 24, 24, 66, 0F, BE, DA, 8B, 5C, 24, 28, 8D, 34, DD, 70, E8, 57, AA, 66, 87, FE, 8D, 64, 24, 2C, 0F, 8F, 3C, 9E, F7, FF, F7, D7, 5F, E8, 87, 55, F7, FF, E4, 50, 0A, 40, 94, 01, 0B, 45, 53, AE, A9, 49, 17, 51, 2B, 65, E7, 95, F7, 81, EF, B5, DB, 01, E5, 6A, B0, 82, 23, 6A, 18, 23, BB, BB, 67, 90, D9, F4, D5, 74, 1F, C5, F7, B1, F7, 31, 63, B9, 53, 83, E6, 20, 0C, DE, D6... 
[+]

Entropy:

7.9754 (probably packed)

Code size:

224 KB (229,376 bytes)

Scheduled Task

Task name:

{9E1E7C29-B928-49E9-ABD0-A9DDF2714B5F}

Trigger:

Registration (Runs on registration)

Remove ucp.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.