URL:

https://cdn.iobit.com/dl/iobituninstaller.exe

Full analysis: https://app.any.run/tasks/b2b8ee8d-9339-47e2-aa29-77d6ba9d2600
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 01, 2024, 21:19:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
evasion
Indicators:
MD5:

B23B19871E48657AD49DCF9C3F205082

SHA1:

F9B12C734B654CAA0805C58E4EF1E97A50D83228

SHA256:

AB4FE9B7EFE31BE56E432B0EFB1FADFFCA177230D907CF2D292D47145229DA18

SSDEEP:

3:N8coPawelXLNn:2czwelXLN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • iobituninstaller.exe (PID: 1696)
      • iobituninstaller.exe (PID: 3516)
      • iobituninstaller.tmp (PID: 1740)
      • iobituninstaller.exe (PID: 1236)
      • iushrun.exe (PID: 2060)
      • iobituninstaller.tmp (PID: 1808)
      • CrRestore.exe (PID: 1892)
      • IObitDownloader.exe (PID: 2068)
      • AutoUpdate.exe (PID: 324)
      • iTopSetup.exe.exe (PID: 1192)
      • UninstallMonitor.exe (PID: 2376)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.exe (PID: 3300)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 4000)
      • Autoupdate.exe (PID: 1852)
      • atud.exe (PID: 3640)

    • Registers / Runs the DLL via REGSVR32.EXE

      • iush.exe (PID: 980)
      • IObitUninstaler.exe (PID: 2588)

    • Steals credentials from Web Browsers

      • IObitUninstaler.exe (PID: 2588)
      • iTopVPN.exe (PID: 876)

    • Actions looks like stealing of personal data

      • IObitUninstaler.exe (PID: 2588)
      • iTopVPN.exe (PID: 876)

    • Runs injected code in another process

      • icop32.exe (PID: 2804)
      • ICONPIN32.exe (PID: 1216)

    • Application was injected by another process

      • explorer.exe (PID: 1164)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iobituninstaller.exe (PID: 1696)
      • iobituninstaller.exe (PID: 3516)
      • iobituninstaller.tmp (PID: 1740)
      • iobituninstaller.exe (PID: 1236)
      • iushrun.exe (PID: 2060)
      • iobituninstaller.tmp (PID: 1808)
      • CrRestore.exe (PID: 1892)
      • iTopSetup.exe.exe (PID: 1192)
      • AutoUpdate.exe (PID: 324)
      • UninstallMonitor.exe (PID: 2376)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.exe (PID: 3300)
      • IObitDownloader.exe (PID: 2068)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 4000)
      • atud.exe (PID: 3640)
      • Autoupdate.exe (PID: 1852)

    • Reads the Windows owner or organization settings

      • iobituninstaller.tmp (PID: 1740)
      • iobituninstaller.tmp (PID: 1808)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)

    • Reads security settings of Internet Explorer

      • iobituninstaller.tmp (PID: 1808)
      • iobituninstaller.tmp (PID: 1740)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • Setup.exe (PID: 2072)
      • IObitUninstaler.exe (PID: 2588)
      • IObitDownloader.exe (PID: 2068)
      • AUpdate.exe (PID: 1172)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • IdrInit.exe (PID: 3544)
      • ugin.exe (PID: 4000)
      • iTopDataRecovery.exe (PID: 2984)
      • iTopVPN.exe (PID: 876)

    • Reads the Internet Settings

      • iobituninstaller.tmp (PID: 1740)
      • iobituninstaller.tmp (PID: 1808)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • IObitUninstaler.exe (PID: 2588)
      • Setup.exe (PID: 2072)
      • AUpdate.exe (PID: 1172)
      • IObitDownloader.exe (PID: 2068)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 4000)
      • IdrInit.exe (PID: 3544)
      • iTopDataRecovery.exe (PID: 2984)
      • iTopVPN.exe (PID: 876)
      • iTopVPNMini.exe (PID: 2908)

    • Process drops SQLite DLL files

      • iobituninstaller.tmp (PID: 1808)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)

    • Searches for installed software

      • iobituninstaller.tmp (PID: 1808)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • CrRestore.exe (PID: 1892)
      • IObitUninstaler.exe (PID: 2588)
      • UninstallMonitor.exe (PID: 2376)
      • IObitDownloader.exe (PID: 2068)
      • iush.exe (PID: 3292)
      • AutoUpdate.exe (PID: 324)
      • UninstallMonitor.exe (PID: 844)
      • iTopVPN.exe (PID: 876)

    • Drops a system driver (possible attempt to evade defenses)

      • iobituninstaller.tmp (PID: 1808)
      • iTopSetup.exe.tmp (PID: 1196)
      • ugin.exe (PID: 4000)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 680)
      • regsvr32.exe (PID: 1772)
      • regsvr32.exe (PID: 2736)

    • Executes as Windows Service

      • IUService.exe (PID: 2336)
      • IDRService.exe (PID: 3912)

    • Creates a software uninstall entry

      • iush.exe (PID: 980)

    • Reads the date of Windows installation

      • iush.exe (PID: 980)
      • IObitUninstaler.exe (PID: 2588)
      • UninstallMonitor.exe (PID: 2376)
      • UninstallMonitor.exe (PID: 844)

    • Uses TASKKILL.EXE to kill process

      • iTopSetup.exe.tmp (PID: 1196)

    • Process requests binary or script from the Internet

      • IObitDownloader.exe (PID: 2068)
      • AutoUpdate.exe (PID: 324)

    • Process drops legitimate windows executable

      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)

    • Starts CMD.EXE for commands execution

      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 4000)
      • iTopVPN.exe (PID: 876)

    • Starts SC.EXE for service management

      • cmd.exe (PID: 1092)
      • cmd.exe (PID: 3212)
      • cmd.exe (PID: 3684)
      • cmd.exe (PID: 2148)
      • cmd.exe (PID: 3724)
      • cmd.exe (PID: 2728)
      • cmd.exe (PID: 2452)
      • cmd.exe (PID: 1728)
      • cmd.exe (PID: 764)
      • cmd.exe (PID: 3832)
      • cmd.exe (PID: 2556)
      • cmd.exe (PID: 1352)

    • The process verifies whether the antivirus software is installed

      • IObitUninstaler.exe (PID: 2588)
      • iTopVPN.exe (PID: 876)

    • Application launched itself

      • ugin.exe (PID: 4000)

    • Process uses IPCONFIG to clear DNS cache

      • cmd.exe (PID: 2820)
      • cmd.exe (PID: 1992)

    • Checks for external IP

      • UninstallInfo.exe (PID: 3444)
      • unpr.exe (PID: 3044)
      • ugin.exe (PID: 4000)
      • iTopVPN.exe (PID: 876)
      • aud.exe (PID: 3420)

    • Connects to unusual port

      • iTopVPN.exe (PID: 876)

  • INFO

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 1164)

    • Application launched itself

      • iexplore.exe (PID: 3672)
      • msedge.exe (PID: 3516)
      • msedge.exe (PID: 2320)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3692)
      • iexplore.exe (PID: 3672)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3672)
      • iexplore.exe (PID: 3692)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3672)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3672)

    • Checks supported languages

      • iobituninstaller.exe (PID: 1696)
      • iobituninstaller.tmp (PID: 2860)
      • iobituninstaller.exe (PID: 3516)
      • iobituninstaller.tmp (PID: 1740)
      • Setup.exe (PID: 2072)
      • iobituninstaller.exe (PID: 1236)
      • iobituninstaller.tmp (PID: 1808)
      • iushrun.exe (PID: 2060)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • IUService.exe (PID: 2336)
      • CrRestore.exe (PID: 1892)
      • UninstallPromote.exe (PID: 448)
      • UninstallMonitor.exe (PID: 2376)
      • IObitUninstaler.exe (PID: 2588)
      • IObitDownloader.exe (PID: 2068)
      • AUpdate.exe (PID: 1172)
      • iush.exe (PID: 3292)
      • AutoUpdate.exe (PID: 324)
      • iTopSetup.exe.exe (PID: 1192)
      • iTopSetup.exe.tmp (PID: 1196)
      • ugin.exe (PID: 3008)
      • ugin.exe (PID: 3576)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • iTop Data Recovery_Setup_IU.exe (PID: 3300)
      • ugin.exe (PID: 2016)
      • ullc.exe (PID: 2896)
      • iTopVPN.exe (PID: 2692)
      • ugin.exe (PID: 4000)
      • IdrInit.exe (PID: 3544)
      • LocalLang.exe (PID: 1368)
      • icop32.exe (PID: 2804)
      • iTopInsur.exe (PID: 3264)
      • iTopInsur.exe (PID: 2384)
      • UninstallInfo.exe (PID: 3444)
      • UninstallMonitor.exe (PID: 844)
      • ugin.exe (PID: 3136)
      • ICONPIN32.exe (PID: 1216)
      • IDRService.exe (PID: 3912)
      • iTopDataRecovery.exe (PID: 2984)
      • Autoupdate.exe (PID: 1852)
      • AUpdate.exe (PID: 1316)
      • AUpdate.exe (PID: 3456)
      • ugin.exe (PID: 2548)
      • unpr.exe (PID: 3044)
      • iTopVPN.exe (PID: 876)
      • ugin.exe (PID: 2852)
      • atud.exe (PID: 3640)
      • aud.exe (PID: 884)
      • aud.exe (PID: 3420)
      • iTopVPNMini.exe (PID: 2908)
      • Newfts.exe (PID: 2792)
      • aud.exe (PID: 848)

    • Create files in a temporary directory

      • iobituninstaller.exe (PID: 1696)
      • iobituninstaller.exe (PID: 3516)
      • Setup.exe (PID: 2072)
      • iobituninstaller.tmp (PID: 1808)
      • iushrun.exe (PID: 2060)
      • iobituninstaller.tmp (PID: 1740)
      • iobituninstaller.exe (PID: 1236)
      • IObitUninstaler.exe (PID: 2588)
      • iTopSetup.exe.exe (PID: 1192)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.exe (PID: 3300)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • explorer.exe (PID: 1164)
      • icop32.exe (PID: 2804)
      • ICONPIN32.exe (PID: 1216)
      • SecEdit.exe (PID: 3800)
      • SecEdit.exe (PID: 1632)
      • iTopVPN.exe (PID: 876)

    • Reads the computer name

      • iobituninstaller.tmp (PID: 2860)
      • Setup.exe (PID: 2072)
      • iobituninstaller.tmp (PID: 1808)
      • iushrun.exe (PID: 2060)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • IUService.exe (PID: 2336)
      • CrRestore.exe (PID: 1892)
      • IObitUninstaler.exe (PID: 2588)
      • UninstallMonitor.exe (PID: 2376)
      • UninstallPromote.exe (PID: 448)
      • iobituninstaller.tmp (PID: 1740)
      • IObitDownloader.exe (PID: 2068)
      • AUpdate.exe (PID: 1172)
      • iush.exe (PID: 3292)
      • AutoUpdate.exe (PID: 324)
      • iTopSetup.exe.tmp (PID: 1196)
      • ugin.exe (PID: 3576)
      • ugin.exe (PID: 3008)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 2016)
      • ugin.exe (PID: 4000)
      • iTopVPN.exe (PID: 2692)
      • iTopInsur.exe (PID: 3264)
      • IdrInit.exe (PID: 3544)
      • iTopInsur.exe (PID: 2384)
      • UninstallInfo.exe (PID: 3444)
      • UninstallMonitor.exe (PID: 844)
      • ugin.exe (PID: 3136)
      • IDRService.exe (PID: 3912)
      • iTopDataRecovery.exe (PID: 2984)
      • Autoupdate.exe (PID: 1852)
      • AUpdate.exe (PID: 1316)
      • ugin.exe (PID: 2548)
      • unpr.exe (PID: 3044)
      • AUpdate.exe (PID: 3456)
      • aud.exe (PID: 3420)
      • atud.exe (PID: 3640)
      • iTopVPN.exe (PID: 876)
      • ugin.exe (PID: 2852)
      • aud.exe (PID: 884)
      • iTopVPNMini.exe (PID: 2908)
      • Newfts.exe (PID: 2792)
      • aud.exe (PID: 848)

    • Creates files or folders in the user directory

      • Setup.exe (PID: 2072)
      • iush.exe (PID: 980)
      • CrRestore.exe (PID: 1892)
      • UninstallPromote.exe (PID: 448)
      • UninstallMonitor.exe (PID: 2376)
      • AUpdate.exe (PID: 1172)
      • IObitDownloader.exe (PID: 2068)
      • IObitUninstaler.exe (PID: 2588)
      • AutoUpdate.exe (PID: 324)
      • ugin.exe (PID: 3576)
      • iTopVPN.exe (PID: 2692)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • iTopInsur.exe (PID: 3264)
      • explorer.exe (PID: 1164)
      • iTopSetup.exe.tmp (PID: 1196)
      • Autoupdate.exe (PID: 1852)
      • iTopVPN.exe (PID: 876)
      • atud.exe (PID: 3640)
      • iTopVPNMini.exe (PID: 2908)

    • Creates files in the program directory

      • Setup.exe (PID: 2072)
      • iushrun.exe (PID: 2060)
      • iobituninstaller.tmp (PID: 1808)
      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • CrRestore.exe (PID: 1892)
      • UninstallPromote.exe (PID: 448)
      • IObitUninstaler.exe (PID: 2588)
      • IObitDownloader.exe (PID: 2068)
      • AutoUpdate.exe (PID: 324)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)
      • ugin.exe (PID: 2016)
      • iTopVPN.exe (PID: 2692)
      • ugin.exe (PID: 4000)
      • iTopInsur.exe (PID: 3264)
      • UninstallInfo.exe (PID: 3444)
      • IDRService.exe (PID: 3912)
      • iTopDataRecovery.exe (PID: 2984)
      • AUpdate.exe (PID: 1316)
      • Autoupdate.exe (PID: 1852)
      • unpr.exe (PID: 3044)
      • ugin.exe (PID: 2852)
      • iTopVPN.exe (PID: 876)
      • atud.exe (PID: 3640)

    • Creates a software uninstall entry

      • iobituninstaller.tmp (PID: 1808)
      • iTopSetup.exe.tmp (PID: 1196)
      • iTop Data Recovery_Setup_IU.tmp (PID: 3536)

    • Reads the machine GUID from the registry

      • iush.exe (PID: 980)
      • DSPut.exe (PID: 968)
      • UninstallMonitor.exe (PID: 2376)
      • IObitUninstaler.exe (PID: 2588)
      • AUpdate.exe (PID: 1172)
      • iTopVPN.exe (PID: 2692)
      • ugin.exe (PID: 4000)
      • icop32.exe (PID: 2804)
      • ICONPIN32.exe (PID: 1216)
      • AUpdate.exe (PID: 1316)
      • Autoupdate.exe (PID: 1852)
      • AUpdate.exe (PID: 3456)
      • unpr.exe (PID: 3044)
      • aud.exe (PID: 3420)
      • iTopVPN.exe (PID: 876)
      • atud.exe (PID: 3640)
      • iTopVPNMini.exe (PID: 2908)
      • aud.exe (PID: 848)
      • aud.exe (PID: 884)

    • Checks proxy server information

      • DSPut.exe (PID: 968)
      • AUpdate.exe (PID: 1172)

    • Process checks Internet Explorer phishing filters

      • iTopVPN.exe (PID: 876)

    • Process checks whether UAC notifications are on

      • iTopVPN.exe (PID: 876)

    • Manual execution by a user

      • msedge.exe (PID: 2320)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
183
Monitored processes
117
Malicious processes
22
Suspicious processes
7

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe iobituninstaller.exe iobituninstaller.tmp no specs iobituninstaller.exe iobituninstaller.tmp setup.exe iobituninstaller.exe iobituninstaller.tmp iushrun.exe iush.exe regsvr32.exe regsvr32.exe iuservice.exe dsput.exe crrestore.exe uninstallpromote.exe iobituninstaler.exe uninstallmonitor.exe iobitdownloader.exe iush.exe regsvr32.exe aupdate.exe autoupdate.exe itopsetup.exe.exe itopsetup.exe.tmp ugin.exe no specs taskkill.exe no specs ugin.exe no specs itop data recovery_setup_iu.exe itop data recovery_setup_iu.tmp cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs ugin.exe no specs ullc.exe itopvpn.exe ugin.exe cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs locallang.exe itopinsur.exe idrinit.exe icop32.exe itopinsur.exe uninstallinfo.exe uninstallmonitor.exe no specs ugin.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs sc.exe no specs cmd.exe no specs iconpin32.exe sc.exe no specs idrservice.exe itopdatarecovery.exe autoupdate.exe aupdate.exe aupdate.exe ugin.exe no specs unpr.exe itopvpn.exe ugin.exe no specs atud.exe aud.exe aud.exe cmd.exe no specs ipconfig.exe no specs itopvpnmini.exe newfts.exe aud.exe cmd.exe no specs ipconfig.exe no specs secedit.exe no specs secedit.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cmd.exe no specs ping.exe no specs cmd.exe no specs ping.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
324"C:\Program Files\IObit\IObit Uninstaller\AutoUpdate.exe" /NomalC:\Program Files\IObit\IObit Uninstaller\AutoUpdate.exe
IObitUninstaler.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
Autoupdate
Exit code:
0
Version:
13.0.0.100
Modules
Images
c:\program files\iobit\iobit uninstaller\autoupdate.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
324"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1600 --field-trial-handle=1212,i,7887629754303419756,7248407712059946144,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
392cmd.exe /c ping www.google.comC:\Windows\System32\cmd.exe—iTopVPN.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
448"C:\Program Files\IObit\IObit Uninstaller\UninstallPromote.exe" /INSTALL un13C:\Program Files\IObit\IObit Uninstaller\UninstallPromote.exe
iobituninstaller.tmp
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
UnistallPromote
Exit code:
0
Version:
2.0.0.306
Modules
Images
c:\program files\iobit\iobit uninstaller\uninstallpromote.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
448sc stop iTopDataRecoveryService4C:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
680"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files\IObit\IObit Uninstaller\IUMenuRight.dll"C:\Windows\System32\regsvr32.exe
iush.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
748sc stop windivertC:\Windows\System32\sc.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
A tool to aid in developing services for WindowsNT
Exit code:
1060
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
748"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1504 --field-trial-handle=1212,i,7887629754303419756,7248407712059946144,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
764"C:\Windows\System32\cmd.exe" /c sc description iTopDataRecoveryService4 "iTop Data Recovery Service"C:\Windows\System32\cmd.exe—iTop Data Recovery_Setup_IU.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
844"C:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe" /srvuptC:\Program Files\IObit\IObit Uninstaller\UninstallMonitor.exe—IUService.exe
User:
admin
Company:
IObit
Integrity Level:
HIGH
Description:
UninstallMonitor
Exit code:
0
Version:
13.2.0.3
Modules
Images
c:\program files\iobit\iobit uninstaller\uninstallmonitor.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\iobit\iobit uninstaller\rtl120.bpl
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
207 548
Read events
206 192
Write events
1 239
Delete events
117

Modification events

(PID) Process:(1164) explorer.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{C8E6F269-B90A-4053-A3BE-499AFCEC98C4}.check.0
Operation:writeName:CheckSetting
Value:
01000000D08C9DDF0115D1118C7A00C04FC297EB01000000DBDD10622BD67741A42163F361389C47000000000200000000001066000000010000200000009E29A13965AAB3C0F94785465D8FB7D823EFB73335269E5D5E9EF7771D6C8C32000000000E8000000002000020000000355C66E1CAFB2126BC8F9EC7E53638C0FC69D2D67498A2CFE26A57FC4E75BA993000000065B77A562AE12BDA6E15075ECDB951A9BE7E7CCDB9B33C53EAFB5289633665B54F4A6FE88B5B496443677CF430FD1067400000008CA89BE3F4F4A662E8881AE868B1982C1A2DE915767F7FF23AEAD6353F3053067215F257E6B5D8FFED6FBA07FF88CFD3745C0534F4DB161E89C344BE3AEB50E5
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
936440368
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091742
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091742
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3672) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
Executable files
417
Suspicious files
154
Text files
592
Unknown types
80

Dropped files

PID
Process
Filename
Type
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419binary
MD5:674FD3659AC32095781E9BA590CBDF4E
SHA256:61A92BA69B34343A3727127B4FF6D94BBE733ED012804C3D9FE8ACA398764A50
3692iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419der
MD5:42739CB9BE9EB584A8D70102F91B4400
SHA256:CBE26AA643A15829E5174491B4B6D96244A10FB590242799C77D404B95A30F72
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\iobituninstaller[1].exeexecutable
MD5:B82331518903D01A0DD309777D4BFA24
SHA256:7DCFFB14182A968091A8852B10F5260E7D2551CDCF062C2769ECB3A1F01FB9F2
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iobituninstaller.exe.uednp5o.partial:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
3672iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776der
MD5:7FC33726F376CEA71AF10745418356DE
SHA256:F8E57550B73B7D0FEF4D4B9DD034020DC81E5655317A1A416E1AC6DC89C771BB
3692iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iobituninstaller.exe.uednp5o.partialexecutable
MD5:2CC8EC50F3CB82F80C653C0DDE687252
SHA256:55998BDB9D1F1920180244C3F3B3256978FD14CDFCE7A952B4B5F61A4043FE0B
3672iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFEBCB3B4813B9CC67.TMPbinary
MD5:A5054C455733196E85FB4D2A68EC345B
SHA256:B95BF587111B6FF7CE3266DF74C2C6C2A321153900D0B55852E19EA1FFC86348
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\versionlist.xmlxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3672iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\iobituninstaller.exeexecutable
MD5:2CC8EC50F3CB82F80C653C0DDE687252
SHA256:55998BDB9D1F1920180244C3F3B3256978FD14CDFCE7A952B4B5F61A4043FE0B
1696iobituninstaller.exeC:\Users\admin\AppData\Local\Temp\is-CM1I7.tmp\iobituninstaller.tmpexecutable
MD5:F5FB27A31D6AFC9FDC50F8B712CFAFBB
SHA256:49A99807F43BC7D52757BF753A06F79FA7FB088B1E1A51933CDCB68B4BF224B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
424
DNS requests
43
Threats
104

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3692
iexplore.exe
GET
304
88.221.110.112:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
—
3692
iexplore.exe
GET
304
88.221.110.96:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bd117e088266f0f9
unknown
—
—
—
3692
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
unknown
binary
471 b
—
1080
svchost.exe
GET
200
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?89bca2e7018c82c0
unknown
compressed
67.5 Kb
—
1080
svchost.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1b8fee253118cbef
unknown
compressed
67.5 Kb
—
3672
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d416ea50f343b89b
unknown
—
—
—
3672
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?aeb32cb922858c96
unknown
—
—
—
3672
iexplore.exe
GET
304
2.19.126.163:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a0c79e91eb4e7878
unknown
—
—
—
3672
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
binary
471 b
—
2072
Setup.exe
GET
—
152.199.20.140:80
http://update.iobit.com/dl/iu/file/installer/installer.zlb
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
3692
iexplore.exe
152.199.20.140:443
cdn.iobit.com
EDGECAST
US
unknown
3692
iexplore.exe
88.221.110.112:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
88.221.110.96:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3692
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
unknown
1080
svchost.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown
3672
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
unknown
3672
iexplore.exe
2.19.126.163:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
cdn.iobit.com
  • 152.199.20.140
unknown
ctldl.windowsupdate.com
  • 88.221.110.112
  • 2.16.100.168
  • 88.221.110.96
  • 2.19.126.163
  • 2.19.126.137
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
iecvlist.microsoft.com
  • 152.199.19.161
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
unknown
update.iobit.com
  • 152.199.20.140
unknown
stats.iobit.com
  • 54.164.98.208
  • 54.160.64.54
  • 52.4.232.72
unknown
ascstats.iobit.com
  • 54.162.44.188
  • 54.209.220.66
  • 52.7.98.249
unknown
ieonline.microsoft.com
  • 204.79.197.200
unknown
go.microsoft.com
  • 23.43.62.58
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
—
—
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
Setup.exe
OpenKeyReadOnly error
Setup.exe
Install un13 : NotInstall
Setup.exe
Result: 1
Setup.exe
LanID=1033
Setup.exe
NowVer: 13.3.0.2
Setup.exe
TFrmWizard.FormCreate
Setup.exe
ALangID=1033
Setup.exe
LanID=1033
Setup.exe
time1
Setup.exe
doFinshedEvent_Freeware 0
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
https://cdn.iobit.com/dl/iobituninstaller.exe