38934abd31eaf9ed9c91d99f4946598820bd4cdf96d5fa6cb921edf33e68ec6e

Analysis

max time kernel
299s
max time network
276s
platform
windows10_x64
resource
win10v20210410
submitted
15-07-2021 09:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IObit.Uninstaller-11.0.0.40.RC.exe
Size

21.6MB
MD5

e0c176fc73efc0500be51fc5ed64c41a
SHA1

c445a3e636e756cba347141f95130830789bce52
SHA256

38934abd31eaf9ed9c91d99f4946598820bd4cdf96d5fa6cb921edf33e68ec6e
SHA512

b9b3af6d6082146a8b8fc49086bcd34a936c2078d59512b0af2cc5c8209c89d4d6f32c8950cd7e8d12639543a638ce6c16feb24bca959e922570273aeb688402

Score

10^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 20 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Executes dropped EXE 13 IoCs

Processes:

UninstallMonitor.exesvchost.exeIObitUninstaler.exeUninstallMonitor.exeAUpdate.exeAutoUpdate.exeUninstallMonitor.exeDSPut.exePPUninstaller.exeIObitUninstaler.exeUninstallMonitor.exeAUpdate.exeAutoUpdate.exe

pid	process
2744	UninstallMonitor.exe
1328	svchost.exe
1172	IObitUninstaler.exe
2268	UninstallMonitor.exe
2280	AUpdate.exe
4168	AutoUpdate.exe
4472	UninstallMonitor.exe
4732	DSPut.exe
4744	PPUninstaller.exe
4264	IObitUninstaler.exe
4440	UninstallMonitor.exe
4576	AUpdate.exe
4628	AutoUpdate.exe

Loads dropped DLL 64 IoCs

Processes:

IObit.Uninstaller-11.0.0.40.RC.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeUninstallMonitor.exesvchost.exeIObitUninstaler.exeUninstallMonitor.exe

pid	process
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
1804	IObit.Uninstaller-11.0.0.40.RC.exe
3168	regsvr32.exe
2156	regsvr32.exe
1968	regsvr32.exe
2488	regsvr32.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
1328	svchost.exe
1328	svchost.exe
1328	svchost.exe
1328	svchost.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
1172	IObitUninstaler.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

PPUninstaller.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense PPUninstaller.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\QHActiveDefense	PPUninstaller.exe

Drops file in System32 directory 2 IoCs

Processes:

IObitUninstaler.exeIObitUninstaler.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	IObitUninstaler.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	IObitUninstaler.exe

Drops file in Program Files directory 64 IoCs

Processes:

IObit.Uninstaller-11.0.0.40.RC.exeAutoUpdate.exeIObitUninstaler.exeAutoUpdate.exePPUninstaller.exe

description	ioc	process
File created	C:\Program Files (x86)\IObit Uninstaller\madexcept_.bpl	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win7_amd64\IUForceDelete.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\Polish.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Norwegian.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\InfoHelp.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\lang.dat	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\libssl-1_1.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win7_ia64\IUForceDelete.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File opened for modification	C:\Program Files (x86)\IObit Uninstaller\Update\Temp\	AutoUpdate.exe
File opened for modification	C:\Program Files (x86)\IObit Uninstaller\History\Russian.ini	IObitUninstaler.exe
File created	C:\Program Files (x86)\IObit Uninstaller\PluginHelper.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\PlugDB.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Skin\white.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File opened for modification	C:\Program Files (x86)\IObit Uninstaller\Update\	AutoUpdate.exe
File created	C:\Program Files (x86)\IObit Uninstaller\update\update.ini.tmp	AutoUpdate.exe
File created	C:\Program Files (x86)\IObit Uninstaller\RegisterCom.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\filectl.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_amd64\IUProcessFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\English.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\PPUninstaller.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\SBData.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_x86\IUFileFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\Dutch.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\Portuguese(PT-BR).ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Arabic.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Georgian.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Lithuanian.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\iush.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\libcrypto-1_1.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\DS\DSNow.data	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_amd64\IUFileFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win7_x86\IUFileFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\French.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_ia64\IUProcessFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\Danish.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\SpecUTool.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Action Center\itop.png	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\SoftPM.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\UninstallRote.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\LatestNews\NewsData_v2.dat.tmp	IObitUninstaler.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win7_ia64\IUProcessFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File opened for modification	C:\Program Files (x86)\IObit Uninstaller\Database\SoftPM.dbd	PPUninstaller.exe
File created	C:\Program Files (x86)\IObit Uninstaller\DSPut.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\HdProm.dll	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\UninstallPromote.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_ia64\IURegistryFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win7_amd64\IURegistryFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Slovenian.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\FB.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_x86\IURegistryFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Dutch.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Italian.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\Portuguese(PT-PT).lng	IObit.Uninstaller-11.0.0.40.RC.exe
File opened for modification	C:\Program Files (x86)\IObit Uninstaller\Update\Temp\	AutoUpdate.exe
File created	C:\Program Files (x86)\IObit Uninstaller\IUService.exe	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\SoftHealth.dbd	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Drivers\win10_amd64\IURegistryFilter.sys	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\History\Italian.ini	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\English.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Language\German.lng	IObit.Uninstaller-11.0.0.40.RC.exe
File created	C:\Program Files (x86)\IObit Uninstaller\Database\uninstall_qdb.dbd	IObit.Uninstaller-11.0.0.40.RC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Program Files (x86)\IObit Uninstaller\iush.exe	nsis_installer_2
C:\Program Files (x86)\IObit Uninstaller\iush.exe	nsis_installer_2

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\FLAGS	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ = "C:\\Program Files (x86)\\IObit Uninstaller\\IUMenuRight.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\IObit Uninstaller"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ = "C:\\Program Files (x86)\\IObit Uninstaller\\IUMenuRight.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59A55EF0-525F-4276-AB62-8F7E5F230399}\ = "PfShellExtension"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ = "C:\\Program Files (x86)\\IObit Uninstaller\\UninstallExplorer.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\ = "IObitUnstaler Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL\AppID = "{59A55EF0-525F-4276-AB62-8F7E5F230399}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UninstallExplorer.ExplorerBtn\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\ = "IObitUnstaler Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\ = "IObitUnstaler Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59A55EF0-525F-4276-AB62-8F7E5F230399}\ = "PfShellExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUnstaler	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\IObitUnstaler\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

IObitUninstaler.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	IObitUninstaler.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	IObitUninstaler.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	IObitUninstaler.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

UninstallMonitor.exesvchost.exeIObitUninstaler.exeUninstallMonitor.exeAUpdate.exeAutoUpdate.exeUninstallMonitor.exe

pid	process
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
2744	UninstallMonitor.exe
1328	svchost.exe
1328	svchost.exe
1328	svchost.exe
1328	svchost.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
2268	UninstallMonitor.exe
2268	UninstallMonitor.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
2280	AUpdate.exe
2280	AUpdate.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
4168	AutoUpdate.exe
4168	AutoUpdate.exe
4168	AutoUpdate.exe
4168	AutoUpdate.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
4472	UninstallMonitor.exe
4472	UninstallMonitor.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe
1172	IObitUninstaler.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

IObitUninstaler.exeIObitUninstaler.exe

pid process

1172 IObitUninstaler.exe
4264 IObitUninstaler.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

620
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 4740 vssvc.exe
Token: SeRestorePrivilege 4740 vssvc.exe
Token: SeAuditPrivilege 4740 vssvc.exe

pid	process
1172	IObitUninstaler.exe
4264	IObitUninstaler.exe

pid	process
620

description	pid	process
Token: SeBackupPrivilege	4740	vssvc.exe
Token: SeRestorePrivilege	4740	vssvc.exe
Token: SeAuditPrivilege	4740	vssvc.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

IObit.Uninstaller-11.0.0.40.RC.exeUninstallMonitor.exesvchost.exeIObitUninstaler.exeAutoUpdate.exePPUninstaller.exeIObitUninstaler.exeAutoUpdate.exe

pid	process
1804	IObit.Uninstaller-11.0.0.40.RC.exe
2744	UninstallMonitor.exe
1328	svchost.exe
1172	IObitUninstaler.exe
4168	AutoUpdate.exe
4744	PPUninstaller.exe
4264	IObitUninstaler.exe
4628	AutoUpdate.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

IObit.Uninstaller-11.0.0.40.RC.exeregsvr32.exeregsvr32.exeUninstallMonitor.exeIObitUninstaler.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeIObitUninstaler.exeregsvr32.exe

description	pid	process	target process
PID 1804 wrote to memory of 3168	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 1804 wrote to memory of 3168	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 1804 wrote to memory of 3168	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 3168 wrote to memory of 2156	3168	regsvr32.exe	regsvr32.exe
PID 3168 wrote to memory of 2156	3168	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 1968	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 1804 wrote to memory of 1968	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 1804 wrote to memory of 1968	1804	IObit.Uninstaller-11.0.0.40.RC.exe	regsvr32.exe
PID 1968 wrote to memory of 2488	1968	regsvr32.exe	regsvr32.exe
PID 1968 wrote to memory of 2488	1968	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 2744	1804	IObit.Uninstaller-11.0.0.40.RC.exe	UninstallMonitor.exe
PID 1804 wrote to memory of 2744	1804	IObit.Uninstaller-11.0.0.40.RC.exe	UninstallMonitor.exe
PID 1804 wrote to memory of 2744	1804	IObit.Uninstaller-11.0.0.40.RC.exe	UninstallMonitor.exe
PID 2744 wrote to memory of 1328	2744	UninstallMonitor.exe	svchost.exe
PID 2744 wrote to memory of 1328	2744	UninstallMonitor.exe	svchost.exe
PID 2744 wrote to memory of 1328	2744	UninstallMonitor.exe	svchost.exe
PID 1172 wrote to memory of 2268	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 1172 wrote to memory of 2268	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 1172 wrote to memory of 2268	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 1172 wrote to memory of 692	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 692	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 692	1172	IObitUninstaler.exe	regsvr32.exe
PID 692 wrote to memory of 192	692	regsvr32.exe	regsvr32.exe
PID 692 wrote to memory of 192	692	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 2280	1172	IObitUninstaler.exe	AUpdate.exe
PID 1172 wrote to memory of 2280	1172	IObitUninstaler.exe	AUpdate.exe
PID 1172 wrote to memory of 2280	1172	IObitUninstaler.exe	AUpdate.exe
PID 1172 wrote to memory of 4168	1172	IObitUninstaler.exe	AutoUpdate.exe
PID 1172 wrote to memory of 4168	1172	IObitUninstaler.exe	AutoUpdate.exe
PID 1172 wrote to memory of 4168	1172	IObitUninstaler.exe	AutoUpdate.exe
PID 1172 wrote to memory of 4344	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4344	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4344	1172	IObitUninstaler.exe	regsvr32.exe
PID 4344 wrote to memory of 4356	4344	regsvr32.exe	regsvr32.exe
PID 4344 wrote to memory of 4356	4344	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 4460	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4460	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4460	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4472	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 1172 wrote to memory of 4472	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 1172 wrote to memory of 4472	1172	IObitUninstaler.exe	UninstallMonitor.exe
PID 4460 wrote to memory of 4492	4460	regsvr32.exe	regsvr32.exe
PID 4460 wrote to memory of 4492	4460	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 4624	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4624	1172	IObitUninstaler.exe	regsvr32.exe
PID 1172 wrote to memory of 4624	1172	IObitUninstaler.exe	regsvr32.exe
PID 4624 wrote to memory of 4636	4624	regsvr32.exe	regsvr32.exe
PID 4624 wrote to memory of 4636	4624	regsvr32.exe	regsvr32.exe
PID 1172 wrote to memory of 4732	1172	IObitUninstaler.exe	DSPut.exe
PID 1172 wrote to memory of 4732	1172	IObitUninstaler.exe	DSPut.exe
PID 1172 wrote to memory of 4732	1172	IObitUninstaler.exe	DSPut.exe
PID 1172 wrote to memory of 4744	1172	IObitUninstaler.exe	PPUninstaller.exe
PID 1172 wrote to memory of 4744	1172	IObitUninstaler.exe	PPUninstaller.exe
PID 1172 wrote to memory of 4744	1172	IObitUninstaler.exe	PPUninstaller.exe
PID 4264 wrote to memory of 4440	4264	IObitUninstaler.exe	UninstallMonitor.exe
PID 4264 wrote to memory of 4440	4264	IObitUninstaler.exe	UninstallMonitor.exe
PID 4264 wrote to memory of 4440	4264	IObitUninstaler.exe	UninstallMonitor.exe
PID 4264 wrote to memory of 3776	4264	IObitUninstaler.exe	regsvr32.exe
PID 4264 wrote to memory of 3776	4264	IObitUninstaler.exe	regsvr32.exe
PID 4264 wrote to memory of 3776	4264	IObitUninstaler.exe	regsvr32.exe
PID 3776 wrote to memory of 3148	3776	regsvr32.exe	regsvr32.exe
PID 3776 wrote to memory of 3148	3776	regsvr32.exe	regsvr32.exe
PID 4264 wrote to memory of 4576	4264	IObitUninstaler.exe	AUpdate.exe
PID 4264 wrote to memory of 4576	4264	IObitUninstaler.exe	AUpdate.exe

C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller-11.0.0.40.RC.exe
"C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller-11.0.0.40.RC.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1804

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3168

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Modifies registry class
PID:2156

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\IObit Uninstaller\UninstallExplorer.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\UninstallExplorer.dll"
3⤵
- Loads dropped DLL
- Modifies registry class
PID:2488

C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
"C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe" /srvupt
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2744

C:\Program Files (x86)\IObit Uninstaller\iush.exe
"C:\Program Files (x86)\IObit Uninstaller\iush.exe" /ur "C:\Program Files (x86)\IObit Uninstaller\"
3⤵
PID:1328

C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe
"C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1172

C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
"C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe" /Set
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2268

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:692

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:192

C:\Program Files (x86)\IObit Uninstaller\AUpdate.exe
"C:\Program Files (x86)\IObit Uninstaller\AUpdate.exe" /a un11 /p iobit /v 11.0.0.40 /t 4 /d 7 /un /user
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2280

C:\Program Files (x86)\IObit Uninstaller\AutoUpdate.exe
"C:\Program Files (x86)\IObit Uninstaller\AutoUpdate.exe" /Nomal
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4168

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:4344

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4356

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4492

C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
"C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe" /Set
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4472

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:4636

C:\Program Files (x86)\IObit Uninstaller\DSPut.exe
"C:\Program Files (x86)\IObit Uninstaller\DSPut.exe"
2⤵
- Executes dropped EXE
PID:4732

C:\Program Files (x86)\IObit Uninstaller\PPUninstaller.exe
"C:\Program Files (x86)\IObit Uninstaller\PPUninstaller.exe" /x
2⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:4744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s PcaSvc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5112

C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe
"C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4264

C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
"C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe" /Set
2⤵
- Executes dropped EXE
PID:4440

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
- Suspicious use of WriteProcessMemory
PID:3776

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3148

C:\Program Files (x86)\IObit Uninstaller\AUpdate.exe
"C:\Program Files (x86)\IObit Uninstaller\AUpdate.exe" /a un11 /p iobit /v 11.0.0.40 /t 4 /d 7 /un /user
2⤵
- Executes dropped EXE
PID:4576

C:\Program Files (x86)\IObit Uninstaller\AutoUpdate.exe
"C:\Program Files (x86)\IObit Uninstaller\AutoUpdate.exe" /Nomal
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:4628

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
2⤵
PID:2856

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll"
3⤵
- Modifies system executable filetype association
- Modifies registry class
PID:3228

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Security Software Discovery

T1063

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\IObit Uninstaller\Database\uninstall_qdb.dbd
MD5
05f4380d6b8cc84c2a35f0b737d29bef

SHA1
a609239c74d55e1ab8df79d93208255a759fe996

SHA256
fdb69f15959dd76ab26721ed7541d7e067109e0e2a4bdaae839303b0d9a12b9d

SHA512
b30549778782b29a04867bf602c714c159d021e76b48908a57ca9bb547fbc7ef6764af9b1bda7cc1c47eed53c34e338ee5d45ff5ef38ee6afdecb52feeefe40c

Download Submit
C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe
MD5
e5ec46f24308ded30d6dbf922a305489

SHA1
816b7a812f6f8009ffd30e80ac79bae90c588f2b

SHA256
bdeef9ca90945b8342d63d2995ef6e38e9ff026d1327719353b03c6454be72c0

SHA512
d9459ff4fd918361f99bd820bd61526d82d35abd16e7dd682c255e395c6a9c81a4df937c5b59d568b1454074953dba6710898a90e8efe03437e04af4dab9d016

Download Submit
C:\Program Files (x86)\IObit Uninstaller\IObitUninstaler.exe
MD5
e5ec46f24308ded30d6dbf922a305489

SHA1
816b7a812f6f8009ffd30e80ac79bae90c588f2b

SHA256
bdeef9ca90945b8342d63d2995ef6e38e9ff026d1327719353b03c6454be72c0

SHA512
d9459ff4fd918361f99bd820bd61526d82d35abd16e7dd682c255e395c6a9c81a4df937c5b59d568b1454074953dba6710898a90e8efe03437e04af4dab9d016

Download Submit
C:\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll
MD5
f11bec02e3020823e429a46b3f53deb9

SHA1
d7e61fc7dac283ea01168c2c65e748e1b4c74840

SHA256
74f2d7f17913317f4aee8534d7933be4eaa2266430ad14e098e517168d063677

SHA512
8ccba41b8806ef33d01cf9e103f27e598ad5c3d7e4da54d916ff180569cd5ce9640d5fcce9d29dacadfeb40a0ad7cdee616671c64535a0e8aacefb7d62c0919e

Download Submit
C:\Program Files (x86)\IObit Uninstaller\Language\Russian.lng
MD5
b3371add952be30cbc760433698293fb

SHA1
033d70eab536b2fd40608e81e32900d6e632d5df

SHA256
3c9b9a1e99f8d53eef6a122434b6bc8a36f572112f6c6e1f28170b30ad0c2472

SHA512
e306fd04c95fe9426df7be0827680a72aaf5da3257a1c8a3adc04f4a043ea8d8d60b4441bdcd2da332cf233a21fb6770799375a883a50321619f266b2aed5ca7

Download Submit
C:\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll
MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
C:\Program Files (x86)\IObit Uninstaller\RegisterCom.dll
MD5
dc643cd641031badd4a4e0a3d311974b

SHA1
e113d5feec130f71de5e5c9407710835a44a3fd8

SHA256
2a8a0fc3e8d2863a77bb8fdae8f4bde5fcd72a2f4bfa3d3eb4c59d46b9073ef4

SHA512
6ef1d7dc0b7af406637aa2a9c1bba52adb0b0d9681ce8e86b1c829b5436244c70e8f94705b63d56d4ad34938310ea1f28cdd08efd149df2c4246f8653394b1a4

Download Submit
C:\Program Files (x86)\IObit Uninstaller\UninstallExplorer.dll
MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
MD5
f8b124345b0b4976c5164641c94606bc

SHA1
f9cf6c0afb7757cbeacaec57a4ade69752d94e6a

SHA256
9fd3b7f9a970583a2ccdcb33ffdd420a45fe51e7e5ffdddc54c0c306cabe3f1b

SHA512
55e24dd544eb8286e7db4f8cd95a0b7b475b30e076126a896444686129910b67cf30309ff4ddb1a619fa0cacc2839eeff2e67179fbb30738caad307b8e5098a8

Download Submit
C:\Program Files (x86)\IObit Uninstaller\UninstallMonitor.exe
MD5
f8b124345b0b4976c5164641c94606bc

SHA1
f9cf6c0afb7757cbeacaec57a4ade69752d94e6a

SHA256
9fd3b7f9a970583a2ccdcb33ffdd420a45fe51e7e5ffdddc54c0c306cabe3f1b

SHA512
55e24dd544eb8286e7db4f8cd95a0b7b475b30e076126a896444686129910b67cf30309ff4ddb1a619fa0cacc2839eeff2e67179fbb30738caad307b8e5098a8

Download Submit
C:\Program Files (x86)\IObit Uninstaller\database\FB.dbd
MD5
4f7abf396222d28aac78ab28b79c4656

SHA1
f9620964dc8fbb37e23daa27927e40e726642528

SHA256
e1a1b79bcf92e3c17ff23a7ead1fb75cc5b7b3c3ff499dea35596f1752ac1de5

SHA512
5596b8c6dfb3fe0b0c11c80e96805efe303dfe415bf09a2895915694a6420383a4f74c4a4a9489c61d9bde3c60557ba2264bdfa3bca3edb6209b22aee6d7b1ce

Download Submit
C:\Program Files (x86)\IObit Uninstaller\filectl.dll
MD5
81322acf62aeec380bbecbf169e4c7c7

SHA1
df0152231c21962fd2c336e44d269bdda3a41f78

SHA256
ea33adbedb42d94469a73a79b9ad153a13cbcb50a0069964b2cb90935e35775d

SHA512
ffdfe4a0fbcd50896d7cfc6caf78ecc726b7e639fda58b90274547f2827c7ed03693d9527ce52f66b782e6c8ed961b4fe3a0d3dcaec4d29c2e19a32d533e066a

Download Submit
C:\Program Files (x86)\IObit Uninstaller\iush.exe
MD5
8bac57bf339857a168d122aa31b0f459

SHA1
f181beb2a51aa7277beeafb22c979faa857ef0ba

SHA256
d5d3b1f6a2a5f761a5ced7bebb3744d3a713754790cd2d8d786c2142da136ee6

SHA512
f0742342ae803475c89b06bb8b12526d8d45e0564f9bb2d85be1d61ee87e1596d75a4b10a158d89a9bb73101b671b6f628dbfa2e4b25eba7d66a2672152a4b72

Download Submit
C:\Program Files (x86)\IObit Uninstaller\iush.exe
MD5
8bac57bf339857a168d122aa31b0f459

SHA1
f181beb2a51aa7277beeafb22c979faa857ef0ba

SHA256
d5d3b1f6a2a5f761a5ced7bebb3744d3a713754790cd2d8d786c2142da136ee6

SHA512
f0742342ae803475c89b06bb8b12526d8d45e0564f9bb2d85be1d61ee87e1596d75a4b10a158d89a9bb73101b671b6f628dbfa2e4b25eba7d66a2672152a4b72

Download Submit
C:\Program Files (x86)\IObit Uninstaller\lang.dat
MD5
57e662a5837b148d81299227db5466fc

SHA1
2b97cf3c51dbedc7332cc197eadd8a471bf0b537

SHA256
8fafe1313c12256581c7698302d8eab1d2a21739ee57adeb850260d0df22503c

SHA512
3028a8125b144a221872de60d33352b0720711019e04688f99670b8f6180647020f38b8be60a7b14d06e3fd9ab0210bd8e2deac5759702d66336b3852eda1593

Download Submit
C:\Program Files (x86)\IObit Uninstaller\madBasic_.bpl
MD5
0470b3205faf06b0b807629c7462ea90

SHA1
b0b309ba97caca555c1c1edf90b7c777d0ee4deb

SHA256
50e8481906f27e92bb80f4b7139f90949b960b1b2898dd0f6875147f44d8ad20

SHA512
7aa09d6eca8fa7add3c9b81ba6196d3e2665ab93dffda3ac26a24e3b3745d8d1afb340ac41822979845701ed54459637ab2206c5597a2413a2af1d37f7c62f32

Download Submit
C:\Program Files (x86)\IObit Uninstaller\madDisAsm_.bpl
MD5
61d323161f2cbc187e6a36a12a0734fa

SHA1
6f3b54a3860ed8cf5746516c86c4c75fcfc1e0ae

SHA256
fbb9b4f1944b82701c7c06971a24cfed09d6e7f4a0f1684eba49800e3396fe3a

SHA512
0f1f8e8fef47791e0e6a62b2b91aec7d014c98b0b576940d99a4a7f714747120927b96cc70fb7b25cfd43276db059b1a9e4b73b0d51c29b63eb8a40ee2afb63b

Download Submit
C:\Program Files (x86)\IObit Uninstaller\madExcept_.bpl
MD5
6a98d399196717b26db6ad57a8df87a0

SHA1
b7ed3e83bfa2996af770a0155bff14c190dd792e

SHA256
f15243689010ab289d9fd29ee0efe89fef82488ea0f0e5a7e4dd365004a850de

SHA512
668e4eb5b80826200ab44fbeaf7861fdb782b50a9cd9cfd74cde5df09e091360f4eb189f6b2403380acf70dbe1752373621116093500e5a4328a2e76fdaddce3

Download Submit
C:\Program Files (x86)\IObit Uninstaller\rgfpctl.dll
MD5
f4cf24ea24e658d4c093fb9e15453c64

SHA1
8eef4b455692993cd79058a1408c0b7e9412204c

SHA256
ed8a9e88487db3411105e68437c783f8d01f4f26933d19d15a28f0a8e62aee42

SHA512
9db26fa00c0fdc3e87929ed9fd1a94863b3bd8b92c1c3127672f9797731b4e3e494643b4df4b1f76119dba717bdfa0fab0f2822e6326d10781f570a64f07d89c

Download Submit
C:\Program Files (x86)\IObit Uninstaller\rtl120.bpl
MD5
83ac415bcad54682d56dfee0066000e2

SHA1
916e00f9cfebe0bc1296d5b9e84b86d80548e800

SHA256
91ade0cbd518fd898f61b53d27f89c4ab64bc3dba22483a4b9b78d5826a333e4

SHA512
ca90a6026cb8265f23d7feb45b5caded216e87d72c4f2cc579e44c29ef7a213efbb54435551c0d1e44fe9979d54cbee91b1150eddb701ce89dec1555ec017703

Download Submit
C:\Program Files (x86)\IObit Uninstaller\sqlite3.dll
MD5
b3d2c44cb44f323210dd99c701daf877

SHA1
3dde51bdb4addbfb14162dc51fc84b10335ce0ac

SHA256
19f3bfcbaed4d727209df368909afdde92ef1e12587d3ebf3a2c233eceb93ce2

SHA512
5eae44c8758e664d36179c682abf8c1e3adf4c88013f51e86df08114ac90cd0fde89b838019e19ec73f9b0c35b108c423053ecb2bf36324651865fbef9d6d904

Download Submit
C:\Program Files (x86)\IObit Uninstaller\vcl120.bpl
MD5
9cef56e9868e96afabb1fcd8758931b8

SHA1
8e99aa4839e6e29a4213ca0309c6ea02a46442f7

SHA256
28fdac79c3e1656e4c60de4b6bc6dca390ef5b86f58d75e1f352bc964a4efdcb

SHA512
b296b74c637d7db8bc82d98e794c8f27afba5e061d06c6bcbbd806eee511dcd2414a7d8505af0b4d71c96dada57126c38f83f13552079fec3c2e4aa1a647074f

Download Submit
C:\Program Files (x86)\IObit Uninstaller\vclx120.bpl
MD5
ce332581d5bd58b3120754431e866f22

SHA1
8b0fdc55d1cdc430c3d9689d057c62ba3e5d5514

SHA256
4335551dc47bf65d3292ba6fa5d102565814ec36d904be83afedf11fcc17d060

SHA512
16e6d64c57dc5cb775cb8f27801e54d73a9892f06c32167602a92aab8f526acb1f44f005620d3a1ef1dc9aa2e1e227a0e55389653d17d3bb9df245f5a6c17f90

Download Submit
C:\Program Files (x86)\IObit Uninstaller\webres.dll
MD5
aa54cffc0ff4c5094ca0f5bf2e9877ff

SHA1
3f6214b31def288dae0f51fc5b651421718f31f8

SHA256
d0234958f3d93d8b653bec8ad9d31a065ca499d9c8247e589f0a3affe77f1fd2

SHA512
ccfe635a4e667399d8a2adc4db6bc8d8e4c7178162bbed1da785d977cd385df00238478aea0132a193bcd87732585d46c8025319eb060e1e48f8f24f836d862f

Download Submit
C:\Program Files (x86)\IObit Uninstaller\winid.dat
MD5
ee211641b9cacb97eb18aec70c6f63ff

SHA1
5e5e6e8ebc27ed4be955030221ea24a238a9fde2

SHA256
3c2cb160b6fa779b6ce241dc6bcd2919a2f557e093b91c286b0d7a760ab90e62

SHA512
94ad1dc2ccab1f87a756558c469e439129dda7b02fd0f421a4ee7555e852de76666c35e2499d8c85abbb66521d8aa618950653cc9e94399897ae925048b3e003

Download Submit
C:\ProgramData\ProductData\StatCache.db
MD5
792cbc515f89c345c1261cf0c843126f

SHA1
11fadb3de35a09a2ffab7f494bf23d2bec1afc47

SHA256
bb859993540fcacd65dcc9f32ad2186508c4fc46cb8f94bc67f944be665b85bb

SHA512
a8bace62c58296971b43b93ee203b7babc0c63e1a65ff0f6991282600eedb72dbf0e9c33659286251543f951a03c47f0a61d8465971e3925acb07fc6feb70520

Download Submit
C:\ProgramData\ProductData\un11Stat.ini
MD5
498bf04b418b0ffddd5f161f9bc23f66

SHA1
54d40b3257cf9ad26b4b32570adaae5bf7e41ab1

SHA256
055f4fc31ae6a820deb7fead8b43483b91651dc79e7deae1772527c04d1fa11c

SHA512
24b1c2ed7c8f47c0fde5023c3459ba8a68694984f0118b5c59f5f2b7ef5b548cd752c14be8842d96c5030f7f3177938d632c4f3a07b3951ae0b46808c08ae3b6

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
MD5
32256dd0a3b4881b0cf49857a9f012bd

SHA1
0213b99ff73770f640111c001debc7346aa36fc4

SHA256
1408e78002730a169a5bd6ec73a56df314ab7b676e14c98d093f76bd6e0fd4b0

SHA512
7771d120e0aa9b1ec55b7f180ada703259c4170c54a78ee6339678de4325f526e712620ff0743e5765d40230b94c1bc598a97bf7e52a73748fbc912e299db320

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
MD5
80de0030399c83dfb1fec856c5aea6f5

SHA1
e87a18f2fa1ddab88be2743e99feaf7a40a70ef4

SHA256
d44eeca704d54ab7b9c3c58e64bb85ae80f226e1f350234887bf388a013a0f03

SHA512
f1e1985bb1d24af76d8d9bd220e6f1c7e5fb92aedc6dce35e31e4aa6813e55c063ac702737eb8add5f3489bfb7e1ad80287eff6d5f7d38af6f524796fc47637a

Download Submit
\??\c:\program files (x86)\iobit uninstaller\skin\classic.dll
MD5
dc2bf4d9680ea248bf8c27514ec70a31

SHA1
dded748f4a11dfd34126473b3695ab023c732a17

SHA256
da978f86020b875ec534e7b47535847d35d3cfb891b43296f369394fbca5cb46

SHA512
8741aeeb0272b03f682dfe0f889c1ee8fdf24af9b4a15410b3895f0c9e7a8e17b66c39ac267ba813334220e5f72c8e8cc7411ce4d99825fb61e275d4119e2a97

Download Submit
\??\c:\program files (x86)\iobit uninstaller\skin\public.dll
MD5
202b3a90f4b327ff609df955ae3326a1

SHA1
febfbd70351eb2a4c71d74fd5bf3444b411d21cf

SHA256
f9802c62355250741a9a6aeac9cc7e452d6c2e0f4c0163e4197571a867508b28

SHA512
43b547221bf030fd3f2cad03c2da4d02cb41ff0a0ef6938ece5fdaa82c63ee2f4bec5ca5c06863d5e2be9ae811eb255f361f81cc0111c78c4497fd1e32d8b247

Download Submit
\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll
MD5
f11bec02e3020823e429a46b3f53deb9

SHA1
d7e61fc7dac283ea01168c2c65e748e1b4c74840

SHA256
74f2d7f17913317f4aee8534d7933be4eaa2266430ad14e098e517168d063677

SHA512
8ccba41b8806ef33d01cf9e103f27e598ad5c3d7e4da54d916ff180569cd5ce9640d5fcce9d29dacadfeb40a0ad7cdee616671c64535a0e8aacefb7d62c0919e

Download Submit
\Program Files (x86)\IObit Uninstaller\IUMenuRight.dll
MD5
f11bec02e3020823e429a46b3f53deb9

SHA1
d7e61fc7dac283ea01168c2c65e748e1b4c74840

SHA256
74f2d7f17913317f4aee8534d7933be4eaa2266430ad14e098e517168d063677

SHA512
8ccba41b8806ef33d01cf9e103f27e598ad5c3d7e4da54d916ff180569cd5ce9640d5fcce9d29dacadfeb40a0ad7cdee616671c64535a0e8aacefb7d62c0919e

Download Submit
\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll
MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll
MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll
MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
\Program Files (x86)\IObit Uninstaller\ProductStatistics.dll
MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
\Program Files (x86)\IObit Uninstaller\RegisterCom.dll
MD5
dc643cd641031badd4a4e0a3d311974b

SHA1
e113d5feec130f71de5e5c9407710835a44a3fd8

SHA256
2a8a0fc3e8d2863a77bb8fdae8f4bde5fcd72a2f4bfa3d3eb4c59d46b9073ef4

SHA512
6ef1d7dc0b7af406637aa2a9c1bba52adb0b0d9681ce8e86b1c829b5436244c70e8f94705b63d56d4ad34938310ea1f28cdd08efd149df2c4246f8653394b1a4

Download Submit
\Program Files (x86)\IObit Uninstaller\RegisterCom.dll
MD5
dc643cd641031badd4a4e0a3d311974b

SHA1
e113d5feec130f71de5e5c9407710835a44a3fd8

SHA256
2a8a0fc3e8d2863a77bb8fdae8f4bde5fcd72a2f4bfa3d3eb4c59d46b9073ef4

SHA512
6ef1d7dc0b7af406637aa2a9c1bba52adb0b0d9681ce8e86b1c829b5436244c70e8f94705b63d56d4ad34938310ea1f28cdd08efd149df2c4246f8653394b1a4

Download Submit
\Program Files (x86)\IObit Uninstaller\RegisterCom.dll
MD5
dc643cd641031badd4a4e0a3d311974b

SHA1
e113d5feec130f71de5e5c9407710835a44a3fd8

SHA256
2a8a0fc3e8d2863a77bb8fdae8f4bde5fcd72a2f4bfa3d3eb4c59d46b9073ef4

SHA512
6ef1d7dc0b7af406637aa2a9c1bba52adb0b0d9681ce8e86b1c829b5436244c70e8f94705b63d56d4ad34938310ea1f28cdd08efd149df2c4246f8653394b1a4

Download Submit
\Program Files (x86)\IObit Uninstaller\RegisterCom.dll
MD5
dc643cd641031badd4a4e0a3d311974b

SHA1
e113d5feec130f71de5e5c9407710835a44a3fd8

SHA256
2a8a0fc3e8d2863a77bb8fdae8f4bde5fcd72a2f4bfa3d3eb4c59d46b9073ef4

SHA512
6ef1d7dc0b7af406637aa2a9c1bba52adb0b0d9681ce8e86b1c829b5436244c70e8f94705b63d56d4ad34938310ea1f28cdd08efd149df2c4246f8653394b1a4

Download Submit
\Program Files (x86)\IObit Uninstaller\UninstallExplorer.dll
MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
\Program Files (x86)\IObit Uninstaller\UninstallExplorer.dll
MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
\Program Files (x86)\IObit Uninstaller\filectl.dll
MD5
81322acf62aeec380bbecbf169e4c7c7

SHA1
df0152231c21962fd2c336e44d269bdda3a41f78

SHA256
ea33adbedb42d94469a73a79b9ad153a13cbcb50a0069964b2cb90935e35775d

SHA512
ffdfe4a0fbcd50896d7cfc6caf78ecc726b7e639fda58b90274547f2827c7ed03693d9527ce52f66b782e6c8ed961b4fe3a0d3dcaec4d29c2e19a32d533e066a

Download Submit
\Program Files (x86)\IObit Uninstaller\madbasic_.bpl
MD5
0470b3205faf06b0b807629c7462ea90

SHA1
b0b309ba97caca555c1c1edf90b7c777d0ee4deb

SHA256
50e8481906f27e92bb80f4b7139f90949b960b1b2898dd0f6875147f44d8ad20

SHA512
7aa09d6eca8fa7add3c9b81ba6196d3e2665ab93dffda3ac26a24e3b3745d8d1afb340ac41822979845701ed54459637ab2206c5597a2413a2af1d37f7c62f32

Download Submit
\Program Files (x86)\IObit Uninstaller\maddisAsm_.bpl
MD5
61d323161f2cbc187e6a36a12a0734fa

SHA1
6f3b54a3860ed8cf5746516c86c4c75fcfc1e0ae

SHA256
fbb9b4f1944b82701c7c06971a24cfed09d6e7f4a0f1684eba49800e3396fe3a

SHA512
0f1f8e8fef47791e0e6a62b2b91aec7d014c98b0b576940d99a4a7f714747120927b96cc70fb7b25cfd43276db059b1a9e4b73b0d51c29b63eb8a40ee2afb63b

Download Submit
\Program Files (x86)\IObit Uninstaller\madexcept_.bpl
MD5
6a98d399196717b26db6ad57a8df87a0

SHA1
b7ed3e83bfa2996af770a0155bff14c190dd792e

SHA256
f15243689010ab289d9fd29ee0efe89fef82488ea0f0e5a7e4dd365004a850de

SHA512
668e4eb5b80826200ab44fbeaf7861fdb782b50a9cd9cfd74cde5df09e091360f4eb189f6b2403380acf70dbe1752373621116093500e5a4328a2e76fdaddce3

Download Submit
\Program Files (x86)\IObit Uninstaller\rgfpctl.dll
MD5
f4cf24ea24e658d4c093fb9e15453c64

SHA1
8eef4b455692993cd79058a1408c0b7e9412204c

SHA256
ed8a9e88487db3411105e68437c783f8d01f4f26933d19d15a28f0a8e62aee42

SHA512
9db26fa00c0fdc3e87929ed9fd1a94863b3bd8b92c1c3127672f9797731b4e3e494643b4df4b1f76119dba717bdfa0fab0f2822e6326d10781f570a64f07d89c

Download Submit
\Program Files (x86)\IObit Uninstaller\rgfpctl.dll
MD5
f4cf24ea24e658d4c093fb9e15453c64

SHA1
8eef4b455692993cd79058a1408c0b7e9412204c

SHA256
ed8a9e88487db3411105e68437c783f8d01f4f26933d19d15a28f0a8e62aee42

SHA512
9db26fa00c0fdc3e87929ed9fd1a94863b3bd8b92c1c3127672f9797731b4e3e494643b4df4b1f76119dba717bdfa0fab0f2822e6326d10781f570a64f07d89c

Download Submit
\Program Files (x86)\IObit Uninstaller\rtl120.bpl
MD5
83ac415bcad54682d56dfee0066000e2

SHA1
916e00f9cfebe0bc1296d5b9e84b86d80548e800

SHA256
91ade0cbd518fd898f61b53d27f89c4ab64bc3dba22483a4b9b78d5826a333e4

SHA512
ca90a6026cb8265f23d7feb45b5caded216e87d72c4f2cc579e44c29ef7a213efbb54435551c0d1e44fe9979d54cbee91b1150eddb701ce89dec1555ec017703

Download Submit
\Program Files (x86)\IObit Uninstaller\sqlite3.dll
MD5
b3d2c44cb44f323210dd99c701daf877

SHA1
3dde51bdb4addbfb14162dc51fc84b10335ce0ac

SHA256
19f3bfcbaed4d727209df368909afdde92ef1e12587d3ebf3a2c233eceb93ce2

SHA512
5eae44c8758e664d36179c682abf8c1e3adf4c88013f51e86df08114ac90cd0fde89b838019e19ec73f9b0c35b108c423053ecb2bf36324651865fbef9d6d904

Download Submit
\Program Files (x86)\IObit Uninstaller\vcl120.bpl
MD5
9cef56e9868e96afabb1fcd8758931b8

SHA1
8e99aa4839e6e29a4213ca0309c6ea02a46442f7

SHA256
28fdac79c3e1656e4c60de4b6bc6dca390ef5b86f58d75e1f352bc964a4efdcb

SHA512
b296b74c637d7db8bc82d98e794c8f27afba5e061d06c6bcbbd806eee511dcd2414a7d8505af0b4d71c96dada57126c38f83f13552079fec3c2e4aa1a647074f

Download Submit
\Program Files (x86)\IObit Uninstaller\vcl120.bpl
MD5
9cef56e9868e96afabb1fcd8758931b8

SHA1
8e99aa4839e6e29a4213ca0309c6ea02a46442f7

SHA256
28fdac79c3e1656e4c60de4b6bc6dca390ef5b86f58d75e1f352bc964a4efdcb

SHA512
b296b74c637d7db8bc82d98e794c8f27afba5e061d06c6bcbbd806eee511dcd2414a7d8505af0b4d71c96dada57126c38f83f13552079fec3c2e4aa1a647074f

Download Submit
\Program Files (x86)\IObit Uninstaller\vclx120.bpl
MD5
ce332581d5bd58b3120754431e866f22

SHA1
8b0fdc55d1cdc430c3d9689d057c62ba3e5d5514

SHA256
4335551dc47bf65d3292ba6fa5d102565814ec36d904be83afedf11fcc17d060

SHA512
16e6d64c57dc5cb775cb8f27801e54d73a9892f06c32167602a92aab8f526acb1f44f005620d3a1ef1dc9aa2e1e227a0e55389653d17d3bb9df245f5a6c17f90

Download Submit
\Program Files (x86)\IObit Uninstaller\webres.dll
MD5
aa54cffc0ff4c5094ca0f5bf2e9877ff

SHA1
3f6214b31def288dae0f51fc5b651421718f31f8

SHA256
d0234958f3d93d8b653bec8ad9d31a065ca499d9c8247e589f0a3affe77f1fd2

SHA512
ccfe635a4e667399d8a2adc4db6bc8d8e4c7178162bbed1da785d977cd385df00238478aea0132a193bcd87732585d46c8025319eb060e1e48f8f24f836d862f

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\Aero.dll
MD5
5155e506b908b41e113bbd7c10d4082f

SHA1
0e0d2d3a6c76c08d434ac7359eb9927f82ac6065

SHA256
9bbbdd180dac3cf4ce36cbc12bd862cdd00880d87027395f92ede5476d1f0dd0

SHA512
a43f04fffb05458a307054caaa45ba81c383b0265d7af798996806ecb07b72bb5350df7bf4d6d7b21a30c82f4308343845bb32cc8e0ad0cd36e352499ca7ccb1

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\BrandingURL.dll
MD5
71c46b663baa92ad941388d082af97e7

SHA1
5a9fcce065366a526d75cc5ded9aade7cadd6421

SHA256
bb2b9c272b8b66bc1b414675c2acba7afad03fff66a63babee3ee57ed163d19e

SHA512
5965bd3f5369b9a1ed641c479f7b8a14af27700d0c27d482aa8eb62acc42f7b702b5947d82f9791b29bcba4d46e1409244f0a8ddce4ec75022b5e27f6d671bce

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\LangDLL.dll
MD5
d6d8addfea0ee1bba9b841e3bec0b5cd

SHA1
a36ba78140600a7b1a502bea25c50c76666f5d3f

SHA256
ccb76172c2565356a838d7867a51e021478fed4d83eb41fe1dbb703f8efa28f9

SHA512
3f85eb0baca0794adbc7460af8b3b21d5b0b9d250eeba842f8524ea9736877aaabd5f51035bee8836ad46bf1d01e416119ca7f296bae32bacdad44622c1715ec

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\System.dll
MD5
f4e3fa5c852d2bdc41756e58124b21d3

SHA1
a49ec55e50d25efa45ce93366fb64c4fbb1d8261

SHA256
e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c

SHA512
3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\System.dll
MD5
f4e3fa5c852d2bdc41756e58124b21d3

SHA1
a49ec55e50d25efa45ce93366fb64c4fbb1d8261

SHA256
e457505b7648838185fd971e19daf6fd626824d7935a2701342df7099315e62c

SHA512
3ccbd9bf27d7927fdf34aecf672d78cb85d00b2b53da631f60683e46d85eda73021d2ae2c7c3d533424b1f8d174093d2186e1bd821fe02312fc142048b75d243

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\ToolTips.dll
MD5
9a0da2692764bb842411a8b9687ebbb7

SHA1
5c3a459faa08a704bdf162476897ad4580ae39bd

SHA256
28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb

SHA512
814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\ToolTips.dll
MD5
9a0da2692764bb842411a8b9687ebbb7

SHA1
5c3a459faa08a704bdf162476897ad4580ae39bd

SHA256
28aeaa48c929188a0d169887cc3f16370741467ae49e1db59763f030710a6bbb

SHA512
814d686617df4fe9f50a93dac9428babff3a14836aa27b4666976379ec3fafcab65fd82d8886998fa65e7b59dc192ca067cf8b4cdeb8ef551812912d80dab8ed

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\nsDialogs.dll
MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
\Users\Admin\AppData\Local\Temp\nsp213B.tmp\nsDialogs.dll
MD5
c10e04dd4ad4277d5adc951bb331c777

SHA1
b1e30808198a3ae6d6d1cca62df8893dc2a7ad43

SHA256
e31ad6c6e82e603378cb6b80e67d0e0dcd9cf384e1199ac5a65cb4935680021a

SHA512
853a5564bf751d40484ea482444c6958457cb4a17fb973cf870f03f201b8b2643be41bccde00f6b2026dc0c3d113e6481b0dc4c7b0f3ae7966d38c92c6b5862e

Download Submit
memory/192-327-0x0000000000000000-mapping.dmp

Download
memory/692-324-0x0000000000000000-mapping.dmp

Download
memory/1172-318-0x0000000008BC0000-0x0000000008BC1000-memory.dmp

Filesize
4KB

Download
memory/1172-260-0x0000000001010000-0x000000000104F000-memory.dmp

Filesize
252KB

Download
memory/1172-360-0x0000000005BA3000-0x0000000005BA5000-memory.dmp

Filesize
8KB

Download
memory/1172-332-0x0000000008810000-0x0000000008811000-memory.dmp

Filesize
4KB

Download
memory/1172-329-0x0000000008A30000-0x0000000008A31000-memory.dmp

Filesize
4KB

Download
memory/1172-325-0x0000000008800000-0x0000000008801000-memory.dmp

Filesize
4KB

Download
memory/1172-326-0x0000000005BA0000-0x0000000005BA1000-memory.dmp

Filesize
4KB

Download
memory/1172-323-0x0000000007AA0000-0x0000000007AA1000-memory.dmp

Filesize
4KB

Download
memory/1172-322-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

Filesize
4KB

Download
memory/1172-321-0x0000000002CD0000-0x0000000002CD1000-memory.dmp

Filesize
4KB

Download
memory/1172-320-0x0000000005B20000-0x0000000005B21000-memory.dmp

Filesize
4KB

Download
memory/1172-319-0x0000000008BE0000-0x0000000008BE1000-memory.dmp

Filesize
4KB

Download
memory/1172-316-0x0000000007BD0000-0x0000000007BD1000-memory.dmp

Filesize
4KB

Download
memory/1172-311-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

Filesize
4KB

Download
memory/1172-312-0x0000000008620000-0x0000000008621000-memory.dmp

Filesize
4KB

Download
memory/1172-310-0x0000000007AC0000-0x0000000007AC1000-memory.dmp

Filesize
4KB

Download
memory/1172-309-0x0000000007B80000-0x0000000007B81000-memory.dmp

Filesize
4KB

Download
memory/1172-308-0x0000000007B30000-0x0000000007B31000-memory.dmp

Filesize
4KB

Download
memory/1172-305-0x0000000006030000-0x0000000006031000-memory.dmp

Filesize
4KB

Download
memory/1172-307-0x0000000006180000-0x0000000006181000-memory.dmp

Filesize
4KB

Download
memory/1172-306-0x0000000007AD0000-0x0000000007AD1000-memory.dmp

Filesize
4KB

Download
memory/1172-281-0x0000000005B30000-0x0000000005B31000-memory.dmp

Filesize
4KB

Download
memory/1172-280-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/1172-263-0x0000000001011000-0x00000000011D0000-memory.dmp

Filesize
1.7MB

Download
memory/1172-262-0x0000000001011000-0x00000000011D0000-memory.dmp

Filesize
1.7MB

Download
memory/1172-261-0x0000000001250000-0x00000000012D8000-memory.dmp

Filesize
544KB

Download
memory/1328-257-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-234-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-213-0x0000000003F60000-0x0000000004061000-memory.dmp

Filesize
1.0MB

Download
memory/1328-214-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1328-218-0x0000000004690000-0x0000000004867000-memory.dmp

Filesize
1.8MB

Download
memory/1328-258-0x0000000004080000-0x0000000004081000-memory.dmp

Filesize
4KB

Download
memory/1328-256-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-219-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-220-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-255-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-254-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-253-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-252-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-221-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-222-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-249-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-223-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-224-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-225-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-226-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-227-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-228-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-229-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-231-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-230-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-233-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-232-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-209-0x0000000000000000-mapping.dmp

Download
memory/1328-235-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-236-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-251-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-250-0x00000000043F0000-0x00000000043F1000-memory.dmp

Filesize
4KB

Download
memory/1328-240-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-241-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-243-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-242-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-244-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-245-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-246-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-247-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1328-248-0x0000000004691000-0x0000000004800000-memory.dmp

Filesize
1.4MB

Download
memory/1804-122-0x0000000006891000-0x0000000006893000-memory.dmp

Filesize
8KB

Download
memory/1804-119-0x0000000006881000-0x0000000006883000-memory.dmp

Filesize
8KB

Download
memory/1968-130-0x0000000000000000-mapping.dmp

Download
memory/2156-128-0x0000000000000000-mapping.dmp

Download
memory/2268-314-0x0000000004030000-0x0000000004031000-memory.dmp

Filesize
4KB

Download
memory/2268-302-0x0000000000000000-mapping.dmp

Download
memory/2268-315-0x0000000000770000-0x00000000008BA000-memory.dmp

Filesize
1.3MB

Download
memory/2268-313-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/2280-328-0x0000000000000000-mapping.dmp

Download
memory/2280-330-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download
memory/2488-133-0x0000000000000000-mapping.dmp

Download
memory/2488-158-0x0000000002AC0000-0x0000000002AC1000-memory.dmp

Filesize
4KB

Download
memory/2744-197-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-182-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-205-0x0000000006AF0000-0x0000000006AF1000-memory.dmp

Filesize
4KB

Download
memory/2744-203-0x0000000006330000-0x0000000006331000-memory.dmp

Filesize
4KB

Download
memory/2744-180-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-206-0x0000000006C40000-0x0000000006C41000-memory.dmp

Filesize
4KB

Download
memory/2744-204-0x00000000069A0000-0x00000000069A1000-memory.dmp

Filesize
4KB

Download
memory/2744-179-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-199-0x0000000004AE0000-0x0000000004AE1000-memory.dmp

Filesize
4KB

Download
memory/2744-181-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-178-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-196-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-195-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-194-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-207-0x0000000007010000-0x0000000007011000-memory.dmp

Filesize
4KB

Download
memory/2744-185-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-135-0x0000000000000000-mapping.dmp

Download
memory/2744-193-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-186-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-201-0x0000000004B10000-0x0000000004B11000-memory.dmp

Filesize
4KB

Download
memory/2744-183-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-184-0x0000000004160000-0x0000000004161000-memory.dmp

Filesize
4KB

Download
memory/2744-192-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-191-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-189-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-190-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2744-160-0x0000000002C50000-0x0000000002C51000-memory.dmp

Filesize
4KB

Download
memory/2744-165-0x00000000040C0000-0x00000000040C1000-memory.dmp

Filesize
4KB

Download
memory/2744-164-0x00000000043C0000-0x00000000044C1000-memory.dmp

Filesize
1.0MB

Download
memory/2744-187-0x0000000004890000-0x0000000004891000-memory.dmp

Filesize
4KB

Download
memory/2744-177-0x0000000004C50000-0x0000000004E27000-memory.dmp

Filesize
1.8MB

Download
memory/2744-188-0x0000000004C51000-0x0000000004DC0000-memory.dmp

Filesize
1.4MB

Download
memory/2856-517-0x0000000000000000-mapping.dmp

Download
memory/3148-481-0x0000000000000000-mapping.dmp

Download
memory/3168-125-0x0000000000000000-mapping.dmp

Download
memory/3228-518-0x0000000000000000-mapping.dmp

Download
memory/3776-480-0x0000000000000000-mapping.dmp

Download
memory/4168-358-0x0000000005680000-0x0000000005681000-memory.dmp

Filesize
4KB

Download
memory/4168-333-0x0000000000000000-mapping.dmp

Download
memory/4168-359-0x00000000056D0000-0x00000000056D1000-memory.dmp

Filesize
4KB

Download
memory/4168-356-0x0000000003FB0000-0x0000000003FB1000-memory.dmp

Filesize
4KB

Download
memory/4168-354-0x0000000003F90000-0x0000000003F91000-memory.dmp

Filesize
4KB

Download
memory/4168-355-0x0000000003FA0000-0x0000000003FA1000-memory.dmp

Filesize
4KB

Download
memory/4168-357-0x0000000003E40000-0x0000000003E41000-memory.dmp

Filesize
4KB

Download
memory/4168-338-0x00000000007D0000-0x00000000007D1000-memory.dmp

Filesize
4KB

Download
memory/4344-361-0x0000000000000000-mapping.dmp

Download
memory/4356-362-0x0000000000000000-mapping.dmp

Download
memory/4440-469-0x0000000000000000-mapping.dmp

Download
memory/4460-363-0x0000000000000000-mapping.dmp

Download
memory/4472-370-0x0000000000830000-0x0000000000831000-memory.dmp

Filesize
4KB

Download
memory/4472-369-0x0000000004030000-0x0000000004031000-memory.dmp

Filesize
4KB

Download
memory/4472-368-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/4472-364-0x0000000000000000-mapping.dmp

Download
memory/4492-366-0x0000000000000000-mapping.dmp

Download
memory/4576-487-0x0000000000000000-mapping.dmp

Download
memory/4624-371-0x0000000000000000-mapping.dmp

Download
memory/4628-492-0x0000000000000000-mapping.dmp

Download
memory/4636-372-0x0000000000000000-mapping.dmp

Download
memory/4732-393-0x0000000000590000-0x00000000006DA000-memory.dmp

Filesize
1.3MB

Download
memory/4732-400-0x0000000002060000-0x0000000002061000-memory.dmp

Filesize
4KB

Download
memory/4732-373-0x0000000000000000-mapping.dmp

Download
memory/4744-410-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/4744-404-0x0000000003D10000-0x0000000003D11000-memory.dmp

Filesize
4KB

Download
memory/4744-414-0x0000000004FA0000-0x0000000004FA1000-memory.dmp

Filesize
4KB

Download
memory/4744-416-0x0000000005380000-0x0000000005381000-memory.dmp

Filesize
4KB

Download
memory/4744-418-0x00000000054D0000-0x00000000054D1000-memory.dmp

Filesize
4KB

Download
memory/4744-406-0x0000000003D20000-0x0000000003D21000-memory.dmp

Filesize
4KB

Download
memory/4744-402-0x0000000003D00000-0x0000000003D01000-memory.dmp

Filesize
4KB

Download
memory/4744-412-0x0000000004F90000-0x0000000004F91000-memory.dmp

Filesize
4KB

Download
memory/4744-397-0x00000000022D0000-0x00000000022D1000-memory.dmp

Filesize
4KB

Download
memory/4744-395-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/4744-374-0x0000000000000000-mapping.dmp

Download
memory/4744-408-0x0000000003F00000-0x0000000003F01000-memory.dmp

Filesize
4KB

Download