File name:

Uninstall.Tool.v3.6.1.5687.exe

Full analysis: https://app.any.run/tasks/9c38a0ef-6e53-4c25-99c7-0a3432f5268f
Verdict: Malicious activity
Analysis date: July 22, 2022, 13:59:09
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

ABFD060BD5AE7C302A143C6F929FB4B1

SHA1:

74EE18FD80B63458D57A15562401735AA4B2CCA7

SHA256:

3E2C3752D5028C22294BF562C347111AFA79C677720BE4C2530A1C7EB11A1B18

SSDEEP:

98304:Dmjp9afCqdhyHAN6waqfMQgbX+uuT5rooAq:00vhy9/QgbXgrV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • regsvr32.exe (PID: 2240)

    • Drops executable file immediately after starts

      • UninstallTool.exe (PID: 1184)
      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Loads the Task Scheduler COM API

      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 1472)

    • Registers / Runs the DLL via REGSVR32.EXE

      • nsA1EB.tmp (PID: 4072)

    • Application was dropped or rewritten from another process

      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 1184)
      • UninstallTool.exe (PID: 484)
      • UninstallTool.exe (PID: 2848)
      • UninstallToolHelper.exe (PID: 2492)
      • UninstallTool.exe (PID: 1472)

  • SUSPICIOUS

    • Checks supported languages

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • ns9D82.tmp (PID: 1376)
      • UninstallTool.exe (PID: 1184)
      • ns9E00.tmp (PID: 3672)
      • nsA16D.tmp (PID: 1852)
      • UninstallTool.exe (PID: 2748)
      • nsA0FF.tmp (PID: 3568)
      • UninstallTool.exe (PID: 484)
      • nsA1EB.tmp (PID: 4072)
      • UninstallTool.exe (PID: 1472)
      • UninstallTool.exe (PID: 2848)
      • UninstallToolHelper.exe (PID: 2492)

    • Reads the computer name

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • UninstallTool.exe (PID: 1184)
      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 1472)
      • UninstallTool.exe (PID: 2848)

    • Creates a directory in Program Files

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Starts application with an unusual extension

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Executable content was dropped or overwritten

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • UninstallTool.exe (PID: 1184)

    • Drops a file with a compile date too recent

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • UninstallTool.exe (PID: 1184)

    • Creates files in the driver directory

      • UninstallTool.exe (PID: 1184)

    • Creates files in the program directory

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Creates files in the user directory

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)
      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 2848)

    • Creates a software uninstall entry

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Creates files in the Windows directory

      • UninstallTool.exe (PID: 1184)

    • Changes default file association

      • UninstallTool.exe (PID: 484)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 2240)

    • Reads the date of Windows installation

      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 2848)

    • Searches for installed software

      • UninstallTool.exe (PID: 2748)
      • UninstallTool.exe (PID: 2848)

  • INFO

    • Reads the hosts file

      • Uninstall.Tool.v3.6.1.5687.exe (PID: 3252)

    • Checks supported languages

      • regsvr32.exe (PID: 2240)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

ProductName: Uninstall Tool v3.6.1.5687
LegalCopyright: © CrystalIdea Software
FileVersion: 3.6.1.5687
FileDescription: Uninstall Tool v3.6.1.5687
CompanyName: CrystalIdea Software
Comments: -
CharacterSet: Unicode
LanguageCode: English (U.S.)
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 3.6.1.5687
FileVersionNumber: 3.6.1.5687
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x350d
UninitializedDataSize: 16384
InitializedDataSize: 428544
CodeSize: 26112
LinkerVersion: 6
PEType: PE32
TimeStamp: 2019:12:16 01:54:10+01:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 16-Dec-2019 00:54:10
Detected languages:
  • English - United States
Comments: -
CompanyName: CrystalIdea Software
FileDescription: Uninstall Tool v3.6.1.5687
FileVersion: 3.6.1.5687
LegalCopyright: © CrystalIdea Software
ProductName: Uninstall Tool v3.6.1.5687

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 16-Dec-2019 00:54:10
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x0000647B
0x00006600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.42101
.rdata
0x00008000
0x00001384
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.13635
.data
0x0000A000
0x00066358
0x00000600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.00201
.ndata
0x00071000
0x00100000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x00171000
0x0000AFD8
0x0000B000
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
2.79106

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.28847
1070
UNKNOWN
English - United States
RT_MANIFEST
2
2.84768
9640
UNKNOWN
English - United States
RT_ICON
3
1.87288
4264
UNKNOWN
English - United States
RT_ICON
4
0
3752
UNKNOWN
English - United States
RT_ICON
5
0
2216
UNKNOWN
English - United States
RT_ICON
6
0
1384
UNKNOWN
English - United States
RT_ICON
7
0
1128
UNKNOWN
English - United States
RT_ICON
8
0
744
UNKNOWN
English - United States
RT_ICON
9
0
296
UNKNOWN
English - United States
RT_ICON
103
1.19813
132
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
6
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start start uninstall.tool.v3.6.1.5687.exe ns9d82.tmp no specs uninstalltool.exe ns9e00.tmp no specs uninstalltool.exe no specs nsa0ff.tmp no specs uninstalltool.exe no specs nsa16d.tmp no specs uninstalltool.exe no specs nsa1eb.tmp no specs regsvr32.exe no specs uninstalltool.exe no specs uninstalltoolhelper.exe no specs uninstall.tool.v3.6.1.5687.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
484"C:\Program Files\Uninstall Tool\UninstallTool.exe" /add_control_panel_iconC:\Program Files\Uninstall Tool\UninstallTool.exe—nsA0FF.tmp
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool
Exit code:
0
Version:
3.6.1.5687
Modules
Images
c:\program files\uninstall tool\uninstalltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
1184"C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silentC:\Program Files\Uninstall Tool\UninstallTool.exe
ns9D82.tmp
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool
Exit code:
0
Version:
3.6.1.5687
Modules
Images
c:\program files\uninstall tool\uninstalltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1376"C:\Users\admin\AppData\Local\Temp\nsw6450.tmp\ns9D82.tmp" "C:\Program Files\Uninstall Tool\UninstallTool.exe" /install_service_silentC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\ns9D82.tmp—Uninstall.Tool.v3.6.1.5687.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsw6450.tmp\ns9d82.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1472"C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uacC:\Program Files\Uninstall Tool\UninstallTool.exe—nsA16D.tmp
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool
Exit code:
0
Version:
3.6.1.5687
Modules
Images
c:\program files\uninstall tool\uninstalltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
1852"C:\Users\admin\AppData\Local\Temp\nsw6450.tmp\nsA16D.tmp" "C:\Program Files\Uninstall Tool\UninstallTool.exe" /skip_uacC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\nsA16D.tmp—Uninstall.Tool.v3.6.1.5687.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsw6450.tmp\nsa16d.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2240regsvr32.exe /s "C:\Program Files\Uninstall Tool\utshellext.dll"C:\Windows\system32\regsvr32.exe—nsA1EB.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2492"C:\Program Files\Uninstall Tool\UninstallToolHelper.exe"C:\Program Files\Uninstall Tool\UninstallToolHelper.exe—UninstallTool.exe
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool Helper Process
Exit code:
0
Version:
1, 1, 17, 5
Modules
Images
c:\program files\uninstall tool\uninstalltoolhelper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2596"C:\Users\admin\AppData\Local\Temp\Uninstall.Tool.v3.6.1.5687.exe" C:\Users\admin\AppData\Local\Temp\Uninstall.Tool.v3.6.1.5687.exe—Explorer.EXE
User:
admin
Company:
CrystalIdea Software
Integrity Level:
MEDIUM
Description:
Uninstall Tool v3.6.1.5687
Exit code:
3221226540
Version:
3.6.1.5687
Modules
Images
c:\users\admin\appdata\local\temp\uninstall.tool.v3.6.1.5687.exe
c:\windows\system32\ntdll.dll
2748"C:\Program Files\Uninstall Tool\UninstallTool.exe" /initC:\Program Files\Uninstall Tool\UninstallTool.exe—ns9E00.tmp
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool
Exit code:
0
Version:
3.6.1.5687
Modules
Images
c:\program files\uninstall tool\uninstalltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\user32.dll
c:\windows\system32\msimg32.dll
c:\windows\system32\sechost.dll
2848"C:\Program Files\Uninstall Tool\UninstallTool.exe"C:\Program Files\Uninstall Tool\UninstallTool.exe—Uninstall.Tool.v3.6.1.5687.exe
User:
admin
Company:
CrystalIDEA Software
Integrity Level:
HIGH
Description:
Uninstall Tool
Exit code:
0
Version:
3.6.1.5687
Modules
Images
c:\program files\uninstall tool\uninstalltool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
Total events
8 214
Read events
8 055
Write events
159
Delete events
0

Modification events

(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:DisplayName
Value:
Uninstall Tool
(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:Publisher
Value:
CrystalIdea Software
(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:UninstallString
Value:
C:\Program Files\Uninstall Tool\Uninstall.exe
(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:DisplayIcon
Value:
C:\Program Files\Uninstall Tool\UninstallTool.exe
(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:DisplayVersion
Value:
3.6.1.5687
(PID) Process:(3252) Uninstall.Tool.v3.6.1.5687.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Uninstall Tool
Operation:writeName:EstimatedSize
Value:
7065
(PID) Process:(1184) UninstallTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CisUtMonitor\Instances
Operation:writeName:DefaultInstance
Value:
CisUtMonitor Instance
(PID) Process:(1184) UninstallTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CisUtMonitor\Instances\CisUtMonitor Instance
Operation:writeName:Altitude
Value:
260505
(PID) Process:(1184) UninstallTool.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\CisUtMonitor\Instances\CisUtMonitor Instance
Operation:writeName:Flags
Value:
0
(PID) Process:(1184) UninstallTool.exeKey:HKEY_CURRENT_USER\Software\CrystalIdea Software\Uninstall Tool
Operation:writeName:DriverVersionNum
Value:
261
Executable files
25
Suspicious files
6
Text files
50
Unknown types
3

Dropped files

PID
Process
Filename
Type
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\UninstallTool_x86.datexecutable
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\languages\Arabic.xmlxml
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\languages\Armenian.xmlxml
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\languages\Azerbaijani.xmlxml
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\languages\Belarusian.xmlxml
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Program Files\Uninstall Tool\languages\Bulgarian.xmlxml
MD5:—
SHA256:—
3252Uninstall.Tool.v3.6.1.5687.exeC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\modern-header.bmpimage
MD5:C9AF6A11105C91310535B91EB239F6C4
SHA256:9852D80396C89060F96BDF75067E95D18A840608B56952668FE34C5481F86FE5
3252Uninstall.Tool.v3.6.1.5687.exeC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\nsDialogs.dllexecutable
MD5:EC9640B70E07141FEBBE2CD4CC42510F
SHA256:C5BA017732597A82F695B084D1AA7FE3B356168CC66105B9392A9C5B06BE5188
3252Uninstall.Tool.v3.6.1.5687.exeC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\2.bmpimage
MD5:03E71E2F27CB3C60F2515B378D5934A7
SHA256:242603B8262926CB598FF0F8094775CF6A4EC4FA5DC8191B9CF226888AF9F96E
3252Uninstall.Tool.v3.6.1.5687.exeC:\Users\admin\AppData\Local\Temp\nsw6450.tmp\System.dllexecutable
MD5:8CF2AC271D7679B1D68EEFC1AE0C5618
SHA256:6950991102462D84FDC0E3B0AE30C95AF8C192F77CE3D78E8D54E6B22F7C09BA
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
29
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
93.184.220.29:80
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl
US
der
592 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
142.250.185.131:443
www.gstatic.com
Google Inc.
US
whitelisted
—
—
172.217.18.3:443
fonts.gstatic.com
Google Inc.
US
whitelisted
—
—
142.250.74.205:443
accounts.google.com
Google Inc.
US
whitelisted
—
—
142.250.185.238:443
clients2.google.com
Google Inc.
US
whitelisted
—
—
142.250.74.196:443
www.google.com
Google Inc.
US
whitelisted
3252
Uninstall.Tool.v3.6.1.5687.exe
104.20.68.143:443
pastebin.com
Cloudflare Inc
US
malicious
—
—
185.26.182.94:443
certs.opera.com
Opera Software AS
—
whitelisted
—
—
142.250.185.227:443
clientservices.googleapis.com
Google Inc.
US
whitelisted
—
—
142.250.186.138:443
content-autofill.googleapis.com
Google Inc.
US
whitelisted
—
—
93.184.220.29:80
crl3.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 172.67.34.170
  • 104.20.67.143
malicious
accounts.google.com
  • 142.250.74.205
shared
clientservices.googleapis.com
  • 142.250.185.227
whitelisted
clients2.google.com
  • 142.250.185.238
whitelisted
www.google.com
  • 142.250.74.196
malicious
ssl.gstatic.com
  • 142.250.184.227
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.142
whitelisted
www.gstatic.com
  • 142.250.185.131
whitelisted
fonts.gstatic.com
  • 172.217.18.3
whitelisted
content-autofill.googleapis.com
  • 142.250.186.138
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Uninstall.Tool.v3.6.1.5687.exe