URL:

https://www.iobit.com/en/advanceduninstaller.php#

Full analysis: https://app.any.run/tasks/a86e9116-8c7e-4cd5-affb-aadd950a5596
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 12, 2024, 12:12:28
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

DABF1E56C38390E192F0BACF8D59EC29

SHA1:

E5C1DD36C07DEB014F4BE66FD51D8E8B012EF602

SHA256:

2598B523AA5F269A734B405CE8499ED6B5336A21D1613ABC5521DEA0E89C3A34

SSDEEP:

3:N8DSLgz1EoYTXLns:2OLghPYTXLs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iobituninstaller.exe (PID: 1768)
      • iobituninstaller.exe (PID: 1656)
      • iobituninstaller.tmp (PID: 2900)
      • iobituninstaller.exe (PID: 2576)
      • iushrun.exe (PID: 2112)
      • iobituninstaller.tmp (PID: 3680)
      • CrRestore.exe (PID: 1780)
      • AutoUpdate.exe (PID: 2268)
      • unins000.exe (PID: 908)
      • iush.exe (PID: 3572)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iush.exe (PID: 3984)
      • IObitUninstaler.exe (PID: 2424)
      • iush.exe (PID: 3572)

    • Steals credentials from Web Browsers

      • IObitUninstaler.exe (PID: 2424)

    • Actions looks like stealing of personal data

      • IObitUninstaler.exe (PID: 2424)
      • PPUninstaller.exe (PID: 560)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iobituninstaller.exe (PID: 1656)
      • iobituninstaller.exe (PID: 2576)
      • iushrun.exe (PID: 2112)
      • iobituninstaller.tmp (PID: 3680)
      • CrRestore.exe (PID: 1780)
      • iobituninstaller.exe (PID: 1768)
      • iobituninstaller.tmp (PID: 2900)
      • AutoUpdate.exe (PID: 2268)
      • unins000.exe (PID: 908)
      • iush.exe (PID: 3572)

    • Reads security settings of Internet Explorer

      • iobituninstaller.tmp (PID: 2900)
      • iobituninstaller.tmp (PID: 3680)
      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • Setup.exe (PID: 1308)
      • IObitUninstaler.exe (PID: 2424)
      • AUpdate.exe (PID: 1652)
      • _iu14D2N.tmp (PID: 2764)
      • iush.exe (PID: 2824)
      • _iu14D2N.tmp (PID: 3364)
      • iush.exe (PID: 3572)

    • Reads the Internet Settings

      • iobituninstaller.tmp (PID: 2900)
      • iobituninstaller.tmp (PID: 3680)
      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • Setup.exe (PID: 1308)
      • IObitUninstaler.exe (PID: 2424)
      • AUpdate.exe (PID: 1652)
      • _iu14D2N.tmp (PID: 2764)
      • iush.exe (PID: 2824)
      • _iu14D2N.tmp (PID: 3364)
      • iush.exe (PID: 3572)

    • Reads the Windows owner or organization settings

      • iobituninstaller.tmp (PID: 3680)
      • iobituninstaller.tmp (PID: 2900)
      • _iu14D2N.tmp (PID: 2764)
      • _iu14D2N.tmp (PID: 3364)

    • Searches for installed software

      • iobituninstaller.tmp (PID: 3680)
      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • CrRestore.exe (PID: 1780)
      • IObitUninstaler.exe (PID: 2424)
      • iush.exe (PID: 3128)
      • AutoUpdate.exe (PID: 2268)
      • _iu14D2N.tmp (PID: 2764)
      • _iu14D2N.tmp (PID: 3364)
      • iush.exe (PID: 2824)
      • iush.exe (PID: 3572)
      • PPUninstaller.exe (PID: 560)

    • Process drops SQLite DLL files

      • iobituninstaller.tmp (PID: 3680)

    • Drops a system driver (possible attempt to evade defenses)

      • iobituninstaller.tmp (PID: 3680)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2772)
      • regsvr32.exe (PID: 2040)
      • regsvr32.exe (PID: 2192)

    • Executes as Windows Service

      • IUService.exe (PID: 844)

    • Creates a software uninstall entry

      • iush.exe (PID: 3984)

    • Reads the date of Windows installation

      • iush.exe (PID: 3984)
      • IObitUninstaler.exe (PID: 2424)
      • PPUninstaller.exe (PID: 560)
      • iush.exe (PID: 3572)
      • _iu14D2N.tmp (PID: 3364)

    • Starts CMD.EXE for commands execution

      • IObitUninstaler.exe (PID: 2424)

    • Starts itself from another location

      • unins000.exe (PID: 908)
      • unins000.exe (PID: 3636)

    • Starts application with an unusual extension

      • unins000.exe (PID: 908)
      • unins000.exe (PID: 3636)

    • Non-standard symbols in registry

      • iush.exe (PID: 3572)

    • The process verifies whether the antivirus software is installed

      • IObitUninstaler.exe (PID: 2424)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 1384)

    • Checks supported languages

      • iobituninstaller.tmp (PID: 2900)
      • iobituninstaller.exe (PID: 1656)
      • Setup.exe (PID: 1308)
      • iobituninstaller.exe (PID: 2576)
      • iobituninstaller.tmp (PID: 3680)
      • iushrun.exe (PID: 2112)
      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • IUService.exe (PID: 844)
      • CrRestore.exe (PID: 1780)
      • UninstallPromote.exe (PID: 2052)
      • IObitUninstaler.exe (PID: 2424)
      • iobituninstaller.tmp (PID: 2372)
      • iobituninstaller.exe (PID: 1768)
      • iush.exe (PID: 3128)
      • AUpdate.exe (PID: 1652)
      • AutoUpdate.exe (PID: 2268)
      • unins000.exe (PID: 908)
      • _iu14D2N.tmp (PID: 2764)
      • iush.exe (PID: 2824)
      • unins000.exe (PID: 3636)
      • _iu14D2N.tmp (PID: 3364)
      • UninstallPromote.exe (PID: 3752)
      • iush.exe (PID: 3572)
      • PPUninstaller.exe (PID: 560)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 1384)

    • The process uses the downloaded file

      • iexplore.exe (PID: 1384)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3916)
      • iexplore.exe (PID: 1384)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 1384)
      • iexplore.exe (PID: 3916)

    • Create files in a temporary directory

      • iobituninstaller.exe (PID: 1656)
      • iobituninstaller.tmp (PID: 2900)
      • Setup.exe (PID: 1308)
      • iobituninstaller.exe (PID: 2576)
      • iobituninstaller.tmp (PID: 3680)
      • iushrun.exe (PID: 2112)
      • iobituninstaller.exe (PID: 1768)
      • IObitUninstaler.exe (PID: 2424)
      • unins000.exe (PID: 908)
      • unins000.exe (PID: 3636)
      • iush.exe (PID: 3572)

    • Reads the computer name

      • iobituninstaller.tmp (PID: 2372)
      • iobituninstaller.tmp (PID: 2900)
      • Setup.exe (PID: 1308)
      • iobituninstaller.tmp (PID: 3680)
      • iushrun.exe (PID: 2112)
      • iush.exe (PID: 3984)
      • IUService.exe (PID: 844)
      • DSPut.exe (PID: 3444)
      • CrRestore.exe (PID: 1780)
      • UninstallPromote.exe (PID: 2052)
      • IObitUninstaler.exe (PID: 2424)
      • iush.exe (PID: 3128)
      • AUpdate.exe (PID: 1652)
      • AutoUpdate.exe (PID: 2268)
      • _iu14D2N.tmp (PID: 2764)
      • _iu14D2N.tmp (PID: 3364)
      • UninstallPromote.exe (PID: 3752)
      • iush.exe (PID: 2824)
      • PPUninstaller.exe (PID: 560)
      • iush.exe (PID: 3572)

    • Creates files in the program directory

      • Setup.exe (PID: 1308)
      • iushrun.exe (PID: 2112)
      • iobituninstaller.tmp (PID: 3680)
      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • CrRestore.exe (PID: 1780)
      • UninstallPromote.exe (PID: 2052)
      • IObitUninstaler.exe (PID: 2424)
      • AutoUpdate.exe (PID: 2268)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 1308)
      • iush.exe (PID: 3984)
      • CrRestore.exe (PID: 1780)
      • IObitUninstaler.exe (PID: 2424)
      • UninstallPromote.exe (PID: 2052)
      • AUpdate.exe (PID: 1652)
      • AutoUpdate.exe (PID: 2268)
      • PPUninstaller.exe (PID: 560)
      • iush.exe (PID: 3572)

    • Creates a software uninstall entry

      • iobituninstaller.tmp (PID: 3680)

    • Reads the machine GUID from the registry

      • iush.exe (PID: 3984)
      • DSPut.exe (PID: 3444)
      • IObitUninstaler.exe (PID: 2424)
      • AUpdate.exe (PID: 1652)
      • PPUninstaller.exe (PID: 560)
      • iush.exe (PID: 3572)

    • Checks proxy server information

      • DSPut.exe (PID: 3444)
      • AUpdate.exe (PID: 1652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
76
Monitored processes
33
Malicious processes
17
Suspicious processes
5

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iobituninstaller.exe iobituninstaller.tmp no specs iobituninstaller.exe iobituninstaller.tmp setup.exe iobituninstaller.exe iobituninstaller.tmp iushrun.exe iush.exe regsvr32.exe regsvr32.exe iuservice.exe dsput.exe crrestore.exe uninstallpromote.exe iobituninstaler.exe iush.exe regsvr32.exe aupdate.exe autoupdate.exe cmd.exe no specs unins000.exe _iu14d2n.tmp no specs iush.exe unins000.exe no specs _iu14d2n.tmp no specs uninstallpromote.exe ppuninstaller.exe iush.exe regsvr32.exe no specs regsvr32.exe

Process information

PID
CMD
Path
Indicators
Parent process
560"C:\Program Files\IObit\IObit Uninstaller\PPUninstaller.exe" /uC:\Program Files\IObit\IObit Uninstaller\PPUninstaller.exe
_iu14D2N.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit Scanner
Exit code:
0
Version:
13.0.0.18
Modules
Images
c:\program files\iobit\iobit uninstaller\ppuninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
844"C:\Program Files\IObit\IObit Uninstaller\IUService.exe"C:\Program Files\IObit\IObit Uninstaller\IUService.exe
services.exe
User:
SYSTEM
Company:
IObit
Integrity Level:
SYSTEM
Description:
IU Service Program
Exit code:
0
Version:
13.0.0.0
Modules
Images
c:\program files\iobit\iobit uninstaller\iuservice.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
908"C:\Program Files\IObit\IObit Uninstaller\unins000.exe"C:\Program Files\IObit\IObit Uninstaller\unins000.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
1
Version:
51.1052.0.0
Modules
Images
c:\program files\iobit\iobit uninstaller\unins000.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1092"C:\Windows\System32\regsvr32.exe" /u /s "C:\Program Files\IObit\IObit Uninstaller\UninstallExplorer.dll"C:\Windows\System32\regsvr32.exe
iush.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1308"C:\Users\admin\AppData\Local\Temp\is-VR9P0.tmp\Installer\Setup.exe" /setup "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\iobituninstaller.exe" "" "/Ver=13.4.0.2"C:\Users\admin\AppData\Local\Temp\is-VR9P0.tmp\Installer\Setup.exe
iobituninstaller.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit Uninstaller
Exit code:
0
Version:
13.3.0.42
Modules
Images
c:\users\admin\appdata\local\temp\is-vr9p0.tmp\installer\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1384"C:\Program Files\Internet Explorer\iexplore.exe" "https://www.iobit.com/en/advanceduninstaller.php#"C:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1652"C:\Program Files\IObit\IObit Uninstaller\AUpdate.exe" /a un13 /p iobit /v 13.4.0.2 /t 1 /d 7 /un /userC:\Program Files\IObit\IObit Uninstaller\AUpdate.exe
IObitUninstaler.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Common Component
Exit code:
0
Version:
4.1.0.491
Modules
Images
c:\program files\iobit\iobit uninstaller\aupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1656"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\iobituninstaller.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\iobituninstaller.exe
iexplore.exe
User:
admin
Company:
IObit
Integrity Level:
MEDIUM
Description:
Setup File
Exit code:
0
Version:
13.4.0.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\iobituninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1768"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\iobituninstaller.exe" /SPAWNWND=$901D0 /NOTIFYWND=$701FA C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\iobituninstaller.exe
iobituninstaller.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Setup File
Exit code:
0
Version:
13.4.0.2
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\po2hn1x2\iobituninstaller.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
1780"C:\Program Files\IObit\IObit Uninstaller\CrRestore.exe" /BackupC:\Program Files\IObit\IObit Uninstaller\CrRestore.exe
iobituninstaller.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Genuine Verification Program
Exit code:
0
Version:
13.0.0.1
Modules
Images
c:\program files\iobit\iobit uninstaller\crrestore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
85 676
Read events
83 843
Write events
1 711
Delete events
122

Modification events

(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31093878
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31093878
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(1384) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
164
Suspicious files
87
Text files
265
Unknown types
57

Dropped files

PID
Process
Filename
Type
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62der
MD5:8CD7CEF0588674E8DB4A03F3A4626189
SHA256:3A6909E44D7A0B3065D9ED18E46BA5C0AB6E5F5F078D8889A366B8ABA9D9EEF3
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D03E46CD585BBE111C712E6577BC5F07_B0E62F3370DEB32FD1A99D49E8486B4Cbinary
MD5:72E8E269298958C87A1A44EE356EB456
SHA256:E72F0CE8CF64C3D40C993644426421437A337E405F7F9B732F40D09A622AF9C0
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:8C56FCAB1BF144F44AE7368C483E343F
SHA256:DCB62545E1A8D0D309CDDBDC2E615E0F921EFE6B27496E5B74BD99A60178FCFA
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:026C7C08E484DF8F87A31007E6AEEFEA
SHA256:793F7F16D7D917AD727DD4B814BCBB7049CDFA877CC228E65E997B088A4692D1
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_FB287BEB63DB9E8D59A799779773B97Cbinary
MD5:5284B82565AF80190740127E20151694
SHA256:EB930168FDFC9C5171A18DEB0FDACF47AA25F99D9C288B6060C8CFF9D3011181
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894der
MD5:2AAB0BBD1CC7A3B05607B16C8527504F
SHA256:9E1D365FE83DB2B2E5AE6022A320882C45E436F88F842BA1BE7585DDC4C19CE2
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62binary
MD5:9E036B5698532E7FDC3F9662DA52084A
SHA256:C4CF2137C11B615D6A2A1430F65BAA53C65ED627C1D17D53B69C149C35A141E1
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8binary
MD5:F625226A3D76A5FD777631E91097516E
SHA256:642836CCD1D7FB3A14E79FB3EBACA32C0753FB4A897BC6845362650945DCA4AB
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_B0E62F3370DEB32FD1A99D49E8486B4Cbinary
MD5:EA699DB3C823C4FF4949B63A8281E5B2
SHA256:C682ED1A5C3CE31C7F8E48A5FE07432CFFBA119BB88D7E3997864E60888BB9E5
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8der
MD5:E5F61B1F34E1116DC000B912AC81E221
SHA256:26E8A3A2FB097DACF883124176A750581DCAE2DBDF4B833068DA9B6EB2DE3760
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
112
DNS requests
41
Threats
42

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3916
iexplore.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d362edf7b65e9a48
unknown
—
—
unknown
3916
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41
unknown
—
—
unknown
3916
iexplore.exe
GET
200
108.138.2.10:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
binary
2.02 Kb
unknown
3916
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
binary
1.49 Kb
unknown
3916
iexplore.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
unknown
binary
1.37 Kb
unknown
3916
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
18.245.65.219:80
http://ocsp.r2m01.amazontrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBShdVEFnSEQ0gG5CBtzM48cPMe9XwQUgbgOY4qJEhjl%2Bjs7UJWf5uWQE4UCEAMpJs%2BO%2FhUI93RIOUqmQvI%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3916
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
unknown
3916
iexplore.exe
GET
200
142.250.185.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3916
iexplore.exe
54.157.74.215:443
www.iobit.com
AMAZON-AES
US
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
2.19.126.137:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3916
iexplore.exe
108.138.2.10:80
o.ss2.us
AMAZON-02
US
unknown
3916
iexplore.exe
18.245.39.64:80
ocsp.rootg2.amazontrust.com
—
US
unknown
3916
iexplore.exe
18.245.65.219:80
ocsp.r2m01.amazontrust.com
—
US
unknown
3916
iexplore.exe
216.58.206.74:443
fonts.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
www.iobit.com
  • 54.157.74.215
  • 54.172.169.86
  • 52.7.147.120
whitelisted
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 173.222.108.210
  • 173.222.108.226
whitelisted
o.ss2.us
  • 108.138.2.10
  • 108.138.2.107
  • 108.138.2.173
  • 108.138.2.195
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.245.39.64
shared
ocsp.r2m01.amazontrust.com
  • 18.245.65.219
whitelisted
fonts.googleapis.com
  • 216.58.206.74
whitelisted
codes.iobit.com
  • 152.199.20.140
whitelisted
kit.fontawesome.com
  • 172.64.147.188
  • 104.18.40.68
whitelisted
www.googletagmanager.com
  • 216.58.212.136
whitelisted

Threats

PID
Process
Class
Message
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
1308
Setup.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
Setup.exe
OpenKeyReadOnly error
Setup.exe
Install un13 : NotInstall
Setup.exe
Result: 1
Setup.exe
LanID=1033
Setup.exe
NowVer: 13.4.0.2
Setup.exe
TFrmWizard.FormCreate
Setup.exe
LanID=1033
Setup.exe
ALangID=1033
Setup.exe
time1
Setup.exe
time4
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.iobit.com/en/advanceduninstaller.php#