URL:

https://cdn-129.anonfiles.com/Ldocj4I7u5/81daf590-1631971498/iobituninstaller.zip

Full analysis: https://app.any.run/tasks/5c3c4161-e4fb-4a22-abc8-d8a4d1d1ab03
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: September 18, 2021, 13:15:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

CC66E8DD5E1A90CD05C83811EE5BEA7D

SHA1:

0EB2FCA7169044E6F132787630F47FFD7E8AC944

SHA256:

43D06869FD25E3199100739E1E5E9FF960B67FCC4C19DB7AC1A84183F8D5390B

SSDEEP:

3:N8cFX6iKk2/jeBEXIGcn6IzxlXLcn:2cFjKk2beBoIGcn6GxlXLc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • iobituninstaller.exe (PID: 3296)
      • iobituninstaller.exe (PID: 2232)
      • iobituninstaller.exe (PID: 2184)
      • iushrun.exe (PID: 3016)
      • CrRestore.exe (PID: 1608)

    • Application was dropped or rewritten from another process

      • iobituninstaller.exe (PID: 3296)
      • iobituninstaller.exe (PID: 2232)
      • Setup.exe (PID: 3148)
      • iobituninstaller.exe (PID: 2184)
      • iushrun.exe (PID: 3016)
      • iush.exe (PID: 3992)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • UninstallPromote.exe (PID: 3480)
      • IUService.exe (PID: 1916)
      • IObitUninstaler.exe (PID: 3728)
      • iush.exe (PID: 2636)
      • UninstallMonitor.exe (PID: 312)
      • IObitDownloader.exe (PID: 276)
      • IObitDownloader.exe (PID: 2496)
      • AutoUpdate.exe (PID: 3328)
      • AUpdate.exe (PID: 2504)
      • isrSetup.exe.exe (PID: 756)
      • iTopSetup.exe.exe (PID: 956)
      • UninstallMonitor.exe (PID: 3100)
      • iScrInit.exe (PID: 1780)
      • iScrInit.exe (PID: 2156)
      • GpuCheck.exe (PID: 2668)
      • iScrInit.exe (PID: 1608)
      • UninstallInfo.exe (PID: 4012)
      • ISS_Setup.exe (PID: 2408)
      • LocalLang.exe (PID: 868)

    • Actions looks like stealing of personal data

      • iobituninstaller.tmp (PID: 1132)
      • IObitUninstaler.exe (PID: 3728)

    • Loads dropped or rewritten executable

      • iushrun.exe (PID: 3016)
      • iush.exe (PID: 3992)
      • IUService.exe (PID: 1916)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • regsvr32.exe (PID: 1224)
      • svchost.exe (PID: 880)
      • UninstallPromote.exe (PID: 3480)
      • regsvr32.exe (PID: 3112)
      • IObitUninstaler.exe (PID: 3728)
      • UninstallMonitor.exe (PID: 312)
      • iush.exe (PID: 2636)
      • IObitDownloader.exe (PID: 2496)
      • IObitDownloader.exe (PID: 276)
      • regsvr32.exe (PID: 1824)
      • AUpdate.exe (PID: 2504)
      • AutoUpdate.exe (PID: 3328)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iush.exe (PID: 3992)
      • IObitUninstaler.exe (PID: 3728)

    • Loads the Task Scheduler COM API

      • iush.exe (PID: 3992)
      • IObitUninstaler.exe (PID: 3728)

    • Changes settings of System certificates

      • IObitUninstaler.exe (PID: 3728)

    • Steals credentials from Web Browsers

      • IObitUninstaler.exe (PID: 3728)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 3424)

    • Reads the computer name

      • WinRAR.exe (PID: 4092)
      • iobituninstaller.tmp (PID: 3740)
      • iobituninstaller.tmp (PID: 1132)
      • Setup.exe (PID: 3148)
      • iobituninstaller.tmp (PID: 816)
      • iushrun.exe (PID: 3016)
      • iush.exe (PID: 3992)
      • IUService.exe (PID: 1916)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • UninstallPromote.exe (PID: 3480)
      • IObitUninstaler.exe (PID: 3728)
      • iush.exe (PID: 2636)
      • UninstallMonitor.exe (PID: 312)
      • IObitDownloader.exe (PID: 276)
      • IObitDownloader.exe (PID: 2496)
      • AUpdate.exe (PID: 2504)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.tmp (PID: 2560)
      • iScrInit.exe (PID: 4024)
      • iScrInit.exe (PID: 3588)
      • iScrInit.exe (PID: 3344)
      • iScrInit.exe (PID: 840)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 4092)
      • iobituninstaller.exe (PID: 3296)
      • iobituninstaller.exe (PID: 2232)
      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.exe (PID: 2184)
      • iushrun.exe (PID: 3016)
      • iobituninstaller.tmp (PID: 816)
      • CrRestore.exe (PID: 1608)
      • AutoUpdate.exe (PID: 3328)
      • UninstallMonitor.exe (PID: 312)
      • IObitDownloader.exe (PID: 2496)
      • iTopSetup.exe.exe (PID: 956)
      • isrSetup.exe.tmp (PID: 2560)

    • Checks supported languages

      • WinRAR.exe (PID: 4092)
      • iobituninstaller.exe (PID: 3296)
      • iobituninstaller.tmp (PID: 3740)
      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.exe (PID: 2232)
      • Setup.exe (PID: 3148)
      • iobituninstaller.exe (PID: 2184)
      • iobituninstaller.tmp (PID: 816)
      • iushrun.exe (PID: 3016)
      • iush.exe (PID: 3992)
      • IUService.exe (PID: 1916)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • UninstallPromote.exe (PID: 3480)
      • IObitUninstaler.exe (PID: 3728)
      • iush.exe (PID: 2636)
      • UninstallMonitor.exe (PID: 312)
      • IObitDownloader.exe (PID: 276)
      • IObitDownloader.exe (PID: 2496)
      • AUpdate.exe (PID: 2504)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.exe (PID: 756)
      • isrSetup.exe.tmp (PID: 2560)
      • iScrInit.exe (PID: 4024)
      • iScrInit.exe (PID: 3588)
      • iScrInit.exe (PID: 3344)
      • iScrInit.exe (PID: 840)
      • iTopSetup.exe.exe (PID: 956)

    • Reads Windows owner or organization settings

      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.tmp (PID: 816)
      • isrSetup.exe.tmp (PID: 2560)

    • Reads the Windows organization settings

      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.tmp (PID: 816)
      • isrSetup.exe.tmp (PID: 2560)

    • Drops a file with a compile date too recent

      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.tmp (PID: 816)
      • CrRestore.exe (PID: 1608)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.tmp (PID: 2560)

    • Creates files in the user directory

      • Setup.exe (PID: 3148)
      • iush.exe (PID: 3992)
      • CrRestore.exe (PID: 1608)
      • UninstallMonitor.exe (PID: 312)
      • IObitUninstaler.exe (PID: 3728)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.tmp (PID: 2560)

    • Creates files in the program directory

      • Setup.exe (PID: 3148)
      • iush.exe (PID: 3992)
      • CrRestore.exe (PID: 1608)
      • UninstallPromote.exe (PID: 3480)
      • IObitDownloader.exe (PID: 2496)
      • AutoUpdate.exe (PID: 3328)

    • Creates a directory in Program Files

      • Setup.exe (PID: 3148)
      • iushrun.exe (PID: 3016)
      • iobituninstaller.tmp (PID: 816)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.tmp (PID: 2560)

    • Drops a file that was compiled in debug mode

      • iushrun.exe (PID: 3016)
      • iobituninstaller.tmp (PID: 816)
      • isrSetup.exe.tmp (PID: 2560)
      • UninstallMonitor.exe (PID: 312)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 1224)
      • regsvr32.exe (PID: 3112)
      • regsvr32.exe (PID: 1824)

    • Searches for installed software

      • Setup.exe (PID: 3148)
      • iush.exe (PID: 3992)
      • DSPut.exe (PID: 4028)
      • CrRestore.exe (PID: 1608)
      • iush.exe (PID: 2636)
      • IObitDownloader.exe (PID: 2496)
      • IObitDownloader.exe (PID: 276)
      • AutoUpdate.exe (PID: 3328)
      • IObitUninstaler.exe (PID: 3728)
      • UninstallMonitor.exe (PID: 312)

    • Executed as Windows Service

      • IUService.exe (PID: 1916)

    • Removes files from Windows directory

      • IUService.exe (PID: 1916)

    • Changes default file association

      • iush.exe (PID: 3992)

    • Reads the date of Windows installation

      • iush.exe (PID: 3992)
      • IObitUninstaler.exe (PID: 3728)
      • UninstallMonitor.exe (PID: 312)

    • Creates a software uninstall entry

      • iush.exe (PID: 3992)

    • Creates files in the Windows directory

      • svchost.exe (PID: 880)

    • Adds / modifies Windows certificates

      • IObitUninstaler.exe (PID: 3728)

    • Drops a file with too old compile date

      • isrSetup.exe.tmp (PID: 2560)
      • UninstallMonitor.exe (PID: 312)

    • Uses TASKKILL.EXE to kill process

      • iTopSetup.exe.tmp (PID: 328)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2368)

    • Checks supported languages

      • iexplore.exe (PID: 3424)
      • iexplore.exe (PID: 2368)
      • regsvr32.exe (PID: 1224)
      • regsvr32.exe (PID: 3112)
      • svchost.exe (PID: 880)
      • regsvr32.exe (PID: 1824)

    • Reads the computer name

      • iexplore.exe (PID: 3424)
      • iexplore.exe (PID: 2368)

    • Changes internet zones settings

      • iexplore.exe (PID: 2368)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2368)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3424)
      • iexplore.exe (PID: 2368)
      • IObitUninstaler.exe (PID: 3728)
      • AutoUpdate.exe (PID: 3328)

    • Checks Windows Trust Settings

      • iexplore.exe (PID: 3424)
      • iexplore.exe (PID: 2368)
      • IObitUninstaler.exe (PID: 3728)
      • AutoUpdate.exe (PID: 3328)

    • Reads the date of Windows installation

      • iexplore.exe (PID: 2368)

    • Application was dropped or rewritten from another process

      • iobituninstaller.tmp (PID: 3740)
      • iobituninstaller.tmp (PID: 1132)
      • iobituninstaller.tmp (PID: 816)
      • iScrInit.exe (PID: 3588)
      • iScrInit.exe (PID: 4024)
      • iScrInit.exe (PID: 840)
      • iScrInit.exe (PID: 3344)
      • isrSetup.exe.tmp (PID: 2560)
      • iTopSetup.exe.tmp (PID: 328)

    • Creates a software uninstall entry

      • iobituninstaller.tmp (PID: 816)
      • isrSetup.exe.tmp (PID: 2560)

    • Creates files in the program directory

      • iobituninstaller.tmp (PID: 816)
      • iScrInit.exe (PID: 4024)
      • isrSetup.exe.tmp (PID: 2560)

    • Dropped object may contain Bitcoin addresses

      • iobituninstaller.tmp (PID: 816)
      • IObitUninstaler.exe (PID: 3728)
      • AutoUpdate.exe (PID: 3328)
      • isrSetup.exe.tmp (PID: 2560)

    • Creates files in the user directory

      • iexplore.exe (PID: 2368)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2368)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2368)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
93
Monitored processes
47
Malicious processes
21
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start download and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start iexplore.exe iexplore.exe winrar.exe iobituninstaller.exe iobituninstaller.tmp no specs iobituninstaller.exe iobituninstaller.tmp setup.exe iobituninstaller.exe iobituninstaller.tmp iushrun.exe iush.exe regsvr32.exe regsvr32.exe iuservice.exe dsput.exe crrestore.exe uninstallpromote.exe svchost.exe no specs iobituninstaler.exe iush.exe uninstallmonitor.exe iobitdownloader.exe no specs iobitdownloader.exe regsvr32.exe aupdate.exe autoupdate.exe isrsetup.exe.exe no specs isrsetup.exe.tmp iscrinit.exe iscrinit.exe iscrinit.exe iscrinit.exe itopsetup.exe.exe locallang.exe no specs uninstallmonitor.exe no specs itopsetup.exe.tmp no specs iscrinit.exe no specs iscrinit.exe no specs gpucheck.exe no specs ugin.exe no specs iscrinit.exe no specs uninstallinfo.exe no specs taskkill.exe no specs iss_setup.exe no specs iss_setup.tmp no specs ugin.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
276"C:\Program Files\IObit\IObit Uninstaller\IObitDownloader.exe" "/File=C:\Users\admin\AppData\Local\Temp\Freeware-iu.upt" /show /lang=English.lng /product=un "iTop In"C:\Program Files\IObit\IObit Uninstaller\IObitDownloader.exe—iush.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
IObit Downloader
Exit code:
0
Version:
11.0.0.17
Modules
Images
c:\program files\iobit\iobit uninstaller\iobitdownloader.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\kernel32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
312"C:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe" /SetC:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe
IObitUninstaler.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
UninstallMonitor
Exit code:
0
Version:
11.0.1.15
Modules
Images
c:\windows\system32\kernel32.dll
c:\program files\iobit\iobit uninstaller\uninstallmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
328"C:\Users\admin\AppData\Local\Temp\is-A5BT0.tmp\iTopSetup.exe.tmp" /SL5="$102DE,12830154,204800,C:\ProgramData\IObit\IObit Uninstaller\Downloader\un\iTopSetup.exe.exe" /sp- /verysilent /suppressmsgboxes /NoRestart /insur=iu_in_bC:\Users\admin\AppData\Local\Temp\is-A5BT0.tmp\iTopSetup.exe.tmp—iTopSetup.exe.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-a5bt0.tmp\itopsetup.exe.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
756"C:\ProgramData\IObit\IObit Uninstaller\Downloader\un\isrSetup.exe.exe" /sp- /verysilent /suppressmsgboxes /insur=iu_inC:\ProgramData\IObit\IObit Uninstaller\Downloader\un\isrSetup.exe.exe—IObitDownloader.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Screen Recorder
Exit code:
0
Version:
1.3.0.331
Modules
Images
c:\programdata\iobit\iobit uninstaller\downloader\un\isrsetup.exe.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
816"C:\Users\admin\AppData\Local\Temp\is-EQ41N.tmp\iobituninstaller.tmp" /SL5="$201CE,25494495,139264,C:\Users\admin\AppData\Local\Temp\Rar$EXa4092.11628\iobituninstaller.exe" /verysilent /NORESTART /DIR="C:\Program Files\IObit\IObit Uninstaller\" /TASKS="desktopicon, " /do /dt ""C:\Users\admin\AppData\Local\Temp\is-EQ41N.tmp\iobituninstaller.tmp
iobituninstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-eq41n.tmp\iobituninstaller.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
840"C:\Users\admin\AppData\Local\Temp\is-O04F0.tmp\iScrInit.exe" /KillProcess /installdir="C:\Program Files\iTop Screen Recorder"C:\Users\admin\AppData\Local\Temp\is-O04F0.tmp\iScrInit.exe
isrSetup.exe.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop Screen Recorderr Ini
Exit code:
0
Version:
1.0.0.219
Modules
Images
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-o04f0.tmp\iscrinit.exe
c:\windows\system32\oleaut32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
868"C:\Program Files\iTop Screen Recorder\LocalLang.exe" C:\Program Files\iTop Screen Recorder\LocalLang.exe—isrSetup.exe.tmp
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
Check Language
Exit code:
0
Version:
1.0.0.20
Modules
Images
c:\program files\itop screen recorder\locallang.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
880C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\system32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
956"C:\ProgramData\IObit\IObit Uninstaller\Downloader\un\iTopSetup.exe.exe" /sp- /verysilent /suppressmsgboxes /NoRestart /insur=iu_in_bC:\ProgramData\IObit\IObit Uninstaller\Downloader\un\iTopSetup.exe.exe
IObitDownloader.exe
User:
admin
Company:
iTop Inc.
Integrity Level:
HIGH
Description:
iTop VPN
Exit code:
0
Version:
2.2.0.1935
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1132"C:\Users\admin\AppData\Local\Temp\is-8FU5K.tmp\iobituninstaller.tmp" /SL5="$301BA,25494495,139264,C:\Users\admin\AppData\Local\Temp\Rar$EXa4092.11628\iobituninstaller.exe" /SPAWNWND=$201BC /NOTIFYWND=$50170 C:\Users\admin\AppData\Local\Temp\is-8FU5K.tmp\iobituninstaller.tmp
iobituninstaller.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\is-8fu5k.tmp\iobituninstaller.tmp
c:\windows\system32\kernel32.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
Total events
67 178
Read events
66 363
Write events
803
Delete events
12

Modification events

(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30911631
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30911631
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2368) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
311
Suspicious files
78
Text files
248
Unknown types
53

Dropped files

PID
Process
Filename
Type
3424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iobituninstaller[1].zipcompressed
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4binary
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4der
MD5:—
SHA256:—
2368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:—
SHA256:—
2368iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:—
SHA256:—
3424iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iobituninstaller.zip.dycxcuy.partialcompressed
MD5:—
SHA256:—
2368iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFD132043DD59DD2D6.TMPgmc
MD5:—
SHA256:—
2368iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{7BFE91DD-1882-11EC-B77D-12A9866C77DE}.datbinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
62
TCP/UDP connections
417
DNS requests
34
Threats
42

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2368
iexplore.exe
GET
304
8.253.207.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?377a063b31d5d8a8
US
—
—
whitelisted
2368
iexplore.exe
GET
304
8.253.207.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4aefdc36caaa7610
US
—
—
whitelisted
2368
iexplore.exe
GET
304
8.253.207.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b17ee077a706dad0
US
—
—
whitelisted
1080
svchost.exe
GET
304
8.253.207.120:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f0635202fa048553
US
—
—
whitelisted
3424
iexplore.exe
GET
200
92.123.224.83:80
http://crl.identrust.com/DSTROOTCAX3CRL.crl
unknown
der
1.16 Kb
whitelisted
2368
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
3148
Setup.exe
GET
200
152.199.20.140:80
http://update.iobit.com/infofiles/ac/appver-ac.upt
US
text
600 b
whitelisted
3148
Setup.exe
GET
206
152.199.20.140:80
http://update.iobit.com/infofiles/iu11/Freeware-iu11.upt
US
text
2.36 Kb
whitelisted
3148
Setup.exe
GET
206
152.199.20.140:80
http://update.iobit.com/infofiles/iu11/Freeware-iu11.upt
US
binary
2.36 Kb
whitelisted
3148
Setup.exe
GET
206
152.199.20.140:80
http://update.iobit.com/infofiles/ac/appver-ac.upt
US
text
600 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3424
iexplore.exe
45.154.253.58:443
cdn-129.anonfiles.com
—
—
suspicious
3424
iexplore.exe
8.253.207.120:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
3424
iexplore.exe
92.123.224.83:80
crl.identrust.com
Akamai International B.V.
—
suspicious
3424
iexplore.exe
104.89.32.83:80
x1.c.lencr.org
Akamai Technologies, Inc.
NL
suspicious
2368
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2368
iexplore.exe
8.253.207.120:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
1080
svchost.exe
8.253.207.120:80
ctldl.windowsupdate.com
Level 3 Communications, Inc.
US
malicious
2368
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3148
Setup.exe
152.199.20.140:80
update.iobit.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
malicious
3148
Setup.exe
23.23.144.131:80
ascstats.iobit.com
Amazon.com, Inc.
US
suspicious

DNS requests

Domain
IP
Reputation
cdn-129.anonfiles.com
  • 45.154.253.58
suspicious
ctldl.windowsupdate.com
  • 8.253.207.120
  • 8.248.137.254
  • 8.248.119.254
  • 67.26.137.254
  • 8.248.141.254
whitelisted
crl.identrust.com
  • 92.123.224.83
  • 92.123.224.57
whitelisted
x1.c.lencr.org
  • 104.89.32.83
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
update.iobit.com
  • 152.199.20.140
whitelisted
ascstats.iobit.com
  • 23.23.144.131
  • 50.17.203.109
  • 54.243.43.234
whitelisted
stats.iobit.com
  • 52.3.174.214
  • 54.210.60.41
suspicious

Threats

PID
Process
Class
Message
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3148
Setup.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
3992
iush.exe
Potentially Bad Traffic
ET INFO Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
Setup.exe
StartDownCfg
Setup.exe
LanID=1033
Setup.exe
ALangID=1033
Setup.exe
doFinshedEvent_appver
Setup.exe
doFinshedEvent
Setup.exe
Isshowstring:1
Setup.exe
VRecommendFlag.FAll True
Setup.exe
DetectionEx [??????????? ???????????] DisplayName=('Kaspersky' & (not 'Password')) [Kaspersky] DisplayName=('Kaspersky' & (not 'Password')) [??] DisplayName=('Kaspersky' & (not 'Password')) [McAfee] DisplayName=(('McAfee' & ('AntiVirus' | 'Security' | 'Protection' | 'LiveSafe' | 'Firewall' | 'VPN')) | ('???') | ('BT NetProtect' | 'Firewall' | 'VPN')) [Check Point] DisplayName=('ZoneAlarm' & ('Security' | 'Antivirus' | 'Firewall' | 'VPN')) [QuickHeal] DisplayName=('Quick Heal' & ('Security' | 'Antivirus' | 'Firewall' | 'VPN' | 'PCTuner')) [Adguard] DisplayName=('AdGuard') [F-Secure] DisplayName=('Freedome' | 'F-Secure ID PROTECTION' | 'F-Secure SAFE')
Setup.exe
Itop promote Welcome
Setup.exe
Itop check
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn-129.anonfiles.com/Ldocj4I7u5/81daf590-1631971498/iobituninstaller.zip