93f99bf6ce947e342f87ee449f20c7848b039c93de44bcdee037e99d9ae69ec8

Analysis

max time kernel
151s
max time network
111s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
03-03-2023 22:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IObit.Uninstaller.12.1.0.5 - XYZ/iobituninstaller.exe
Size

27.8MB
MD5

ca16a886519d06b1fa8605317e0974ab
SHA1

4b3d9ce72f602c69c1609825c80aeb201785c60e
SHA256

3c64c3cad3a672f59c8dcd51fb0eba76669f3a08866336825c14409a91257894
SHA512

3f61b981603a0a21b757d97ef5d729cc466d209527034b541baabd95f9350a9143ff717fdbef157735e8161019ca1b6b5094bf63cf8f27e10d9aa326f781d766
SSDEEP

393216:uhqRX2+Q+t83Pj+lmP/00rjcfBwr93r5Ermhdc1ihMPGn8eAAAHuRUWatgTmEVHi:uhqh2+ptQvKaY4Mk8YuujAg5VH5eR

Score

7^/10

adware discovery persistence stealer

Malware Config

Signatures

Executes dropped EXE 10 IoCs

Processes:

iobituninstaller.tmpSetup.exeiobituninstaller.tmpiushrun.exeiush.exeIUService.exeDSPut.exeCrRestore.exeUninstallPromote.exeUninstallMonitor.exe

pid	process
1392	iobituninstaller.tmp
284	Setup.exe
1564	iobituninstaller.tmp
1892	iushrun.exe
1000	iush.exe
1252	IUService.exe
1256	DSPut.exe
576	CrRestore.exe
788	UninstallPromote.exe
1804	UninstallMonitor.exe

Loads dropped DLL 64 IoCs

Processes:

iobituninstaller.exeiobituninstaller.tmpiobituninstaller.exeiobituninstaller.tmpiushrun.exeiush.exeIUService.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exeDSPut.exeCrRestore.exeUninstallPromote.exeUninstallMonitor.exe

pid	process
1516	iobituninstaller.exe
1392	iobituninstaller.tmp
1392	iobituninstaller.tmp
1392	iobituninstaller.tmp
840	iobituninstaller.exe
1564	iobituninstaller.tmp
1892	iushrun.exe
1892	iushrun.exe
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1564	iobituninstaller.tmp
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1252	IUService.exe
560	regsvr32.exe
876	regsvr32.exe
1252	IUService.exe
1252	IUService.exe
1252	IUService.exe
1252	IUService.exe
756	regsvr32.exe
308	regsvr32.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1256	DSPut.exe
1256	DSPut.exe
1256	DSPut.exe
1256	DSPut.exe
1256	DSPut.exe
1564	iobituninstaller.tmp
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
1564	iobituninstaller.tmp
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
1252	IUService.exe
1804	UninstallMonitor.exe
1804	UninstallMonitor.exe
1804	UninstallMonitor.exe

Modifies system executable filetype association 2 TTPs 2 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe

Registers COM server for autorun 1 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\UninstallExplorer.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IUMenuRight.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ = "C:\\PROGRA~2\\IObit\\IOBITU~1\\UNINST~1.DLL"	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

Processes:

iush.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu\desktop.ini	iush.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\NoInternetExplorer = "1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\NewTime = "2023-03-03 23:42:22:005"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ = "ExplorerWnd Helper"	regsvr32.exe

Drops file in Program Files directory 64 IoCs

Processes:

iobituninstaller.tmpCrRestore.exeiush.exe

description	ioc	process
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-FU4V4.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-SMGQ2.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_ia64\is-LHI1Q.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_ia64\IUForceDelete.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_amd64\IUFileFilter.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_amd64\IURegistryFilter.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Backup\IObitUninstaler.exe	CrRestore.exe
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-IVPHI.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-TEUPF.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-GFCPH.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-PKJU0.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_x86\is-BAIEA.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-KHN97.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-P02HJ.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Skin\is-MA97I.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Database\is-4AKDL.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_ia64\IUForceDelete.sys	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_x86\is-AVHA4.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Update\Update.ini	iush.exe
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-LDQD9.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-4LQD2.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_x86\is-G9G5T.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_amd64\is-4UP5Q.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-OHNI3.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-IDKQS.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-4DUEE.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-JL47J.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Database\is-41A2L.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\History\is-ESHVV.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Action Center\is-0NPE5.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_ia64\IUFileFilter.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_x86\IURegistryFilter.sys	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Database\is-6MH52.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Database\is-HGDJG.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Backup\RegisterCom.dll	CrRestore.exe
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-511IJ.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-EPMPP.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-SJRLP.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\TaskbarPin\is-ROURF.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Skin\is-92BHN.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_x86\IURegistryFilter.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_ia64\IUProcessFilter.sys	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_x86\IUFileFilter.sys	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\unins000.dat	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-MQOP1.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-U06FH.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-M25VH.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Database\is-TD9UF.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_amd64\IUProcessFilter.sys	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\History\is-DFRI9.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-ENF7N.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_amd64\is-TMRVL.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_ia64\is-C4NCU.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_ia64\is-UTHMA.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Backup\cr.key	CrRestore.exe
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-SPUJV.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-N79IB.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-JS3DH.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win10_x86\IUForceDelete.sys	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Drivers\win7_ia64\is-2J30H.tmp	iobituninstaller.tmp
File opened for modification	C:\Program Files (x86)\IObit\IObit Uninstaller\unins000.dat	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\is-R8DQ9.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-I8U35.tmp	iobituninstaller.tmp
File created	C:\Program Files (x86)\IObit\IObit Uninstaller\Language\is-77JRH.tmp	iobituninstaller.tmp

Drops file in Windows directory 2 IoCs

Processes:

UninstallMonitor.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	UninstallMonitor.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\DisplayIcon.ico	UninstallMonitor.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 10 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe	nsis_installer_2
\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe	nsis_installer_2
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe	nsis_installer_2

Modifies registry class 52 IoCs

Processes:

regsvr32.exeregsvr32.exeiush.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UninstallExplorer.ExplorerBtn\Clsid	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\Shell	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\IObitUninstaller	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UninstallExplorer.ExplorerBtn\Clsid\ = "{10921475-03CE-4E04-90CE-E2E7EF20C814}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\DefaultIcon	iush.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\DefaultIcon\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IObitUninstaler.exe,0"	iush.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL\AppID = "{59A55EF0-525F-4276-AB62-8F7E5F230399}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ = "ExplorerWnd Helper"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\ShellFolder	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PfShellExtension.DLL	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\UninstallExplorer.ExplorerBtn\ = "ExplorerWnd Helper"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\ProgID\ = "UninstallExplorer.ExplorerBtn"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59A55EF0-525F-4276-AB62-8F7E5F230399}\ = "PfShellExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\UninstallExplorer.ExplorerBtn	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\UninstallExplorer.dll"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\{305CA226-D286-468e-B848-2B2E8E697B74} 2 = "8"	iush.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000_Classes\Local Settings	iush.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IUMenuRight.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\IObitUninstaller	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\InfoTip = "Uninstall/Remove programs, clean browser plugins"	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\Shell\Open	iush.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\ = "IObitUninstaller Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\IObitUninstaller	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\IObitUninstaller\ = "{836AB26C-2DE4-41D3-AC24-4C6C2699B960}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\0\win64\ = "C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IUMenuRight.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\Shell\Open\command	iush.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\Shell\Open\command\ = "\"C:\\Program Files (x86)\\IObit\\IObit Uninstaller\\IObitUninstaler.exe\" control_statistics"	iush.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\ShellFolder\Attributes = "48"	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{836AB26C-2DE4-41D3-AC24-4C6C2699B960}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{DAF0374A-11AB-4E4E-B141-663E77D63E4C}\1.0\ = "PfShellExtension 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{10921475-03CE-4E04-90CE-E2E7EF20C814}\InprocServer32\ = "C:\\PROGRA~2\\IObit\\IOBITU~1\\UNINST~1.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8DE189EC-C9C8-4D31-9F18-E0B7407019A9}\ = "IObit Uninstaller"	iush.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{59A55EF0-525F-4276-AB62-8F7E5F230399}	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

Processes:

Setup.exeiushrun.exeiush.exeIUService.exeDSPut.exeCrRestore.exeiobituninstaller.tmpUninstallPromote.exeUninstallMonitor.exe

pid	process
284	Setup.exe
284	Setup.exe
284	Setup.exe
1892	iushrun.exe
1892	iushrun.exe
1892	iushrun.exe
1892	iushrun.exe
1892	iushrun.exe
1000	iush.exe
1000	iush.exe
1000	iush.exe
1252	IUService.exe
1252	IUService.exe
1000	iush.exe
1256	DSPut.exe
1256	DSPut.exe
1000	iush.exe
1252	IUService.exe
576	CrRestore.exe
576	CrRestore.exe
576	CrRestore.exe
1564	iobituninstaller.tmp
788	UninstallPromote.exe
788	UninstallPromote.exe
788	UninstallPromote.exe
1252	IUService.exe
1252	IUService.exe
1804	UninstallMonitor.exe
1804	UninstallMonitor.exe
1804	UninstallMonitor.exe
1804	UninstallMonitor.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

460
Suspicious use of FindShellTrayWindow 7 IoCs

Processes:

Setup.exeiushrun.exeiobituninstaller.tmpiush.exeCrRestore.exeUninstallMonitor.exe

pid process

284 Setup.exe
284 Setup.exe
1892 iushrun.exe
1564 iobituninstaller.tmp
1000 iush.exe
576 CrRestore.exe
1804 UninstallMonitor.exe

pid	process
460

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iobituninstaller.exeiobituninstaller.tmpSetup.exeiobituninstaller.exeiobituninstaller.tmpiush.exeregsvr32.exeregsvr32.exe

description	pid	process	target process
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1516 wrote to memory of 1392	1516	iobituninstaller.exe	iobituninstaller.tmp
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 1392 wrote to memory of 284	1392	iobituninstaller.tmp	Setup.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 284 wrote to memory of 840	284	Setup.exe	iobituninstaller.exe
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 840 wrote to memory of 1564	840	iobituninstaller.exe	iobituninstaller.tmp
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1892	1564	iobituninstaller.tmp	iushrun.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1564 wrote to memory of 1000	1564	iobituninstaller.tmp	iush.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 876	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 1000 wrote to memory of 560	1000	iush.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 560 wrote to memory of 756	560	regsvr32.exe	regsvr32.exe
PID 876 wrote to memory of 308	876	regsvr32.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516

C:\Users\Admin\AppData\Local\Temp\is-PK65S.tmp\iobituninstaller.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PK65S.tmp\iobituninstaller.tmp" /SL5="$70126,28560639,139264,C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1392

C:\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe" /setup "C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe" "" "/Ver=12.1.0.5"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:284

C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe
"C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe" /verysilent /NORESTART /DIR="C:\Program Files (x86)\IObit\IObit Uninstaller\" /TASKS="desktopicon, " /do /dt ""
4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:840

C:\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp" /SL5="$1018A,28560639,139264,C:\Users\Admin\AppData\Local\Temp\IObit.Uninstaller.12.1.0.5 - XYZ\iobituninstaller.exe" /verysilent /NORESTART /DIR="C:\Program Files (x86)\IObit\IObit Uninstaller\" /TASKS="desktopicon, " /do /dt ""
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1564

C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe
"C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe" /ii "C:\Program Files (x86)\IObit\IObit Uninstaller"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1892

C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe" /if "C:\Program Files (x86)\IObit\IObit Uninstaller" /dt /insur=
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1000

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll"
8⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Modifies registry class
PID:308

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll"
7⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll"
8⤵
- Loads dropped DLL
- Registers COM server for autorun
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:756

C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\DSPut.exe" /Now /update /W3sidmVyc2lvbiI6IjAuMC4wLjAiLCJzaG93IjowLCJjbGljayI6MCwibGFzdCI6MH1d
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1256

C:\Program Files (x86)\IObit\IObit Uninstaller\CrRestore.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\CrRestore.exe" /Backup
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:576

C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallPromote.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallPromote.exe" /INSTALL un12
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:788

C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1252

C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe
"C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallMonitor.exe" /srvupt
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1804

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\IObit\IObit Uninstaller\CrRestore.exe
Filesize
1.0MB

MD5
b36135b0836dd61fc18102b2699b9465

SHA1
f9e48a659981956207f35c92be8e910ca806bbc4

SHA256
07fb2cd4620a2e399f2e6ea53de5c287fb40e02c4a848a6059785d467bb2e097

SHA512
956f2de321313acca1c90660118749c49d928ce35cf1983b5e47305a7a6e0dbc8272868d6e9f911f6506d36a2f93cda91f03676710305692331527deab6ffd34

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll
Filesize
279KB

MD5
1ebc697e2208dfdd334614ec68748bdc

SHA1
675651d163ade43e999ee717af0bafe30bc87794

SHA256
aaa6f093939a529d35006bd0ac85c3dfd08afd3b9d962bd89c7aca9fbdc0dc1b

SHA512
d0b49ea29b0ee68ffe10354c9af41a398152c2028c4c074c86fdf9aadf3b0d71c4abcf9019e23b89f544f0e3a09584865549407457d442a1e4df58dd2a0c5c9b

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
Filesize
163KB

MD5
d14256b80b0d05980a6a16ed1a88c183

SHA1
6e7c4a3ec4210b9e98975faaf812bc2a9f16e58d

SHA256
e4fbb7dff7cd225802a38f2a79071e18f772788f0f6b0642e88276c51fe6216b

SHA512
43654762ae4326ba7f6a46732426dd049b16df66a0ec41880c46f83984693561b4b0cc83fa8d25212437fb3bb0fcbac56ef3aa7a4b4088002dbd312748afbbc6

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\IUService.exe
Filesize
163KB

MD5
d14256b80b0d05980a6a16ed1a88c183

SHA1
6e7c4a3ec4210b9e98975faaf812bc2a9f16e58d

SHA256
e4fbb7dff7cd225802a38f2a79071e18f772788f0f6b0642e88276c51fe6216b

SHA512
43654762ae4326ba7f6a46732426dd049b16df66a0ec41880c46f83984693561b4b0cc83fa8d25212437fb3bb0fcbac56ef3aa7a4b4088002dbd312748afbbc6

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\ProductStatistics.dll
Filesize
1.8MB

MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\RegisterCom.dll
Filesize
1000KB

MD5
802cd64f6ea985824b2ff10130147640

SHA1
998ee7a9587e780e84f5a43a6e8f02c100cd43ca

SHA256
87672dd803468ddc2561ecacb5cb9b3384fec231f6694d02efa8cdc9ff867223

SHA512
a68a09112ee7a17c332008bf65d13fa5b6cf458d59d9c927f16bf2ab9705cf58285d53c116658b2644318d246771deb23ce544f719a7b3605801d3c4365bbcdc

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
Filesize
2.4MB

MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\UninstallPromote.exe
Filesize
3.7MB

MD5
dc346f0543d10d0d201598a085ff68ee

SHA1
a297c32445a1e87e81641f6055621c10c584479a

SHA256
69cb33f342a778ec542567822db72cbf872177b86eaea268adc90e69748baa8e

SHA512
9f154847aee267d652d8b3a6d048ea7f52407c12adb8ee1ac91a07c0ce3217abac4f74ff756b2eda9fd39ff782d5202f4e0a6d37c0939daacba0c2965388bbf6

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\lang.dat
Filesize
64B

MD5
57e662a5837b148d81299227db5466fc

SHA1
2b97cf3c51dbedc7332cc197eadd8a471bf0b537

SHA256
8fafe1313c12256581c7698302d8eab1d2a21739ee57adeb850260d0df22503c

SHA512
3028a8125b144a221872de60d33352b0720711019e04688f99670b8f6180647020f38b8be60a7b14d06e3fd9ab0210bd8e2deac5759702d66336b3852eda1593

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\madBasic_.bpl
Filesize
205KB

MD5
0470b3205faf06b0b807629c7462ea90

SHA1
b0b309ba97caca555c1c1edf90b7c777d0ee4deb

SHA256
50e8481906f27e92bb80f4b7139f90949b960b1b2898dd0f6875147f44d8ad20

SHA512
7aa09d6eca8fa7add3c9b81ba6196d3e2665ab93dffda3ac26a24e3b3745d8d1afb340ac41822979845701ed54459637ab2206c5597a2413a2af1d37f7c62f32

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\madDisAsm_.bpl
Filesize
58KB

MD5
61d323161f2cbc187e6a36a12a0734fa

SHA1
6f3b54a3860ed8cf5746516c86c4c75fcfc1e0ae

SHA256
fbb9b4f1944b82701c7c06971a24cfed09d6e7f4a0f1684eba49800e3396fe3a

SHA512
0f1f8e8fef47791e0e6a62b2b91aec7d014c98b0b576940d99a4a7f714747120927b96cc70fb7b25cfd43276db059b1a9e4b73b0d51c29b63eb8a40ee2afb63b

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\madExcept_.bpl
Filesize
431KB

MD5
8be2193312995c8a442e71dab101c021

SHA1
6cc4722f740724b62b29082c8d17ee7dcf5491a8

SHA256
774afb7dfb8bd192838890b1b522b3f05b3762d6db3f412df7a4f51ee6eb052b

SHA512
9900d52a06bfeb93970e15667e048e35f50debbf3b03f1d318ef0939877be870d507c98831b7a78b1f6ec69127552d1cba64cb33d1452514a87cf756f056796f

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\rtl120.bpl
Filesize
1.1MB

MD5
83ac415bcad54682d56dfee0066000e2

SHA1
916e00f9cfebe0bc1296d5b9e84b86d80548e800

SHA256
91ade0cbd518fd898f61b53d27f89c4ab64bc3dba22483a4b9b78d5826a333e4

SHA512
ca90a6026cb8265f23d7feb45b5caded216e87d72c4f2cc579e44c29ef7a213efbb54435551c0d1e44fe9979d54cbee91b1150eddb701ce89dec1555ec017703

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\update\update.ini
Filesize
27KB

MD5
f7bf707d233f2438c8d8d75015bf9e51

SHA1
83c07bf47e7660b2881779a86c89c8ebd709e057

SHA256
9666e49ab6a9c4a0b4590467cc8779af79940bb25d6c29e8956280560b6b9deb

SHA512
8800098c1304b1b31efedb1d1758402269f237a735dd76002e0bda820095e942ad39cf2e0915aab45a05e6a532d1eacd56584a21ebc4bd7b1853829bf9a5198c

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\vcl120.bpl
Filesize
1.9MB

MD5
9cef56e9868e96afabb1fcd8758931b8

SHA1
8e99aa4839e6e29a4213ca0309c6ea02a46442f7

SHA256
28fdac79c3e1656e4c60de4b6bc6dca390ef5b86f58d75e1f352bc964a4efdcb

SHA512
b296b74c637d7db8bc82d98e794c8f27afba5e061d06c6bcbbd806eee511dcd2414a7d8505af0b4d71c96dada57126c38f83f13552079fec3c2e4aa1a647074f

Download Submit
C:\Program Files (x86)\IObit\IObit Uninstaller\winid.dat
Filesize
689B

MD5
5da07430ccf1b2259a7732ed04cda31b

SHA1
69489b6ffc6daced009d6dc96c0b94536fd2b0cf

SHA256
c3c76cfeb42ab6f40c6cf3d04a9fdc9314c8950e7414ebbef7b7a1a02f7baf23

SHA512
5bc4ad6a6c21a4522d686795dfc8167e97fd46888e527ab181ef5d75cbe4c43b3e7c1e2d4311816523476137ef054967f945dbe06ccde4b5283d550193bff0f3

Download Submit
C:\ProgramData\IObit\IObit Uninstaller\IUService.ini
Filesize
158B

MD5
8044f9c9aa099e090c84b60134fe9211

SHA1
23ebeb8d3b82bd3fb26be4676dd0577241a8d9a7

SHA256
b715e9ea68d9adc6fb664567844cb23239e4ff95502837396f596b160bb5f62d

SHA512
61ba79165ac5875c262c63fc19047998aa3b5979207435d4bb8081378e019ae784c8f9c07705c8ab7f91be8b72e127fa4054764059019246590fec582d4641f1

Download Submit
C:\ProgramData\IObit\Install.ini
Filesize
96B

MD5
ca931f89f1771ed230c06f6f8ac942a5

SHA1
3b61333ca44b2a0ab17d1625f8e6ec8efc152714

SHA256
6c21d222c99de8aa021bf361f0997d5b895a4455c76d6d500ff6e8ddaf3478ca

SHA512
f7e25c61223ab7225bb251c0c6afc435af136b1823e4b26a707c27854f77ddeb03c8c0aedbec60c4c9759680fe0ef195c82f1c20aab05962e34c0f783ede6659

Download Submit
C:\ProgramData\IObit\iobitpromotion.ini
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\ProgramData\IObit\iobitpromotion.ini
Filesize
142B

MD5
c664bbae8717352f30d93d7cd96d7c12

SHA1
8e78cd7abbec189c408bc2b5b2c5adcde05de764

SHA256
7e4e1b5cffdddbb697dff0a2284c0d7909068107f29d21e1c56b16adbddd2f07

SHA512
80d7d9ade8c8a99252ab402693730ca637f707e1270bc324ce914f94c541a5aa94a9ba97db2016ac7ae2b0ac312beef30cd59d35ceff491496cbe4f62472d869

Download Submit
C:\ProgramData\ProductData\StatCache.db
Filesize
267B

MD5
8a65aab8e5daca662ded2df0cd53dda7

SHA1
b9ff09e7c69d24aea98bf171abca583d1fdbdfb7

SHA256
918ebc48e0c24764dec917104ac5b51e9d57306a90220194d0abaca12b193ac8

SHA512
f0833e3921c15a9d692b6950cc049a70e5f7e91206387df2b4b3f9f6c9a9b4a3e5f061a574bf497a19fa75d2a166be789ce4d574dcd2027bd3dfceb009b9ef1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\TempMain.ini
Filesize
70B

MD5
98543f5d16bc219711c3563959e79a55

SHA1
f53e8345f25c0fb9e260659d2eb329dd8acc551e

SHA256
b98a5f3777ba43e100e7d5597be2b4963382efe24249475408cd8fe5f3b43aa6

SHA512
800d6f4ae69e5123ccae499e955a0fc63e2f545c55044ab23f5ee3bdaa50d2454d398e00ccdbd734390f817e3b056bbe6cd3a41bb36f9f459f7de6fdb982f913

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PK65S.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
Filesize
186B

MD5
bd312646580fd1cdf1a4f89a6f0b2781

SHA1
045634f2f4ffb3848a1078c08ef38244aeeb28e9

SHA256
14e44b0dcc23b223d0ef31ae8a03e278a8c971889cd074dfb406534ba6a0a1cf

SHA512
b0b953803c750988a657c2148fc0ab4d3590bd1abb075ebeb7a584ce367d097a503f033fdc943c3f4daa0d80ca3779ec2a090c7ae7b3d7418462658dd1c5956b

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
Filesize
186B

MD5
bd312646580fd1cdf1a4f89a6f0b2781

SHA1
045634f2f4ffb3848a1078c08ef38244aeeb28e9

SHA256
14e44b0dcc23b223d0ef31ae8a03e278a8c971889cd074dfb406534ba6a0a1cf

SHA512
b0b953803c750988a657c2148fc0ab4d3590bd1abb075ebeb7a584ce367d097a503f033fdc943c3f4daa0d80ca3779ec2a090c7ae7b3d7418462658dd1c5956b

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
Filesize
242B

MD5
fb386fc8c1472b30871c1b7d8cf5f9f4

SHA1
1c2e0d066030c3292afc61312d86d10ee5506c7b

SHA256
73f14a70927c6bd4639d34b9fde6887c2467dadd817a7ab59f9d0f62d94258fd

SHA512
4537cf949cc0783d74ca75c753d6d1d39b5841092462b718f3a292a4f37df47021e90752f945b25f5f66ba8e8ca3b1bb41ad0016510b72af6964d7e235748133

Download Submit
C:\Users\Admin\AppData\Roaming\IObit\IObit Uninstaller\Main.ini
Filesize
510B

MD5
c5dfd9f9baa571814bd5687024d5f05b

SHA1
a3afc51756da39cd9ecfdc582bc30423c06c5a16

SHA256
e855f3b53df32a41fb0fb09885740d691ec163b226f650c0cd5b7c057bbd07cc

SHA512
d6d991ae89d75c4b39210b092c076f8a81f05698bc1a424c4da4f408f6135e5f78f2d9859384ff2b975e0ba2a2c7fb68b8793d477e5dcaa178014901d73698c7

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IObitUninstaler.exe
Filesize
9.0MB

MD5
15eec68860c39f41c93de058379ec962

SHA1
0fc240b3ea81d787248d37eca69491ac875b43c9

SHA256
67cabf2946f05a5bb3aae7a86b6850773f5eb8c3f62b4b3af6975a7e67446f1f

SHA512
299de493da5aa97dac06068f93d7dd6c26b066210a601767645e1b1c038fbbcfe59a54dd8d38c92149d5bf34b605342fb3fab8b4baee60e112ef1874f23d8681

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll
Filesize
279KB

MD5
1ebc697e2208dfdd334614ec68748bdc

SHA1
675651d163ade43e999ee717af0bafe30bc87794

SHA256
aaa6f093939a529d35006bd0ac85c3dfd08afd3b9d962bd89c7aca9fbdc0dc1b

SHA512
d0b49ea29b0ee68ffe10354c9af41a398152c2028c4c074c86fdf9aadf3b0d71c4abcf9019e23b89f544f0e3a09584865549407457d442a1e4df58dd2a0c5c9b

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\IUMenuRight.dll
Filesize
279KB

MD5
1ebc697e2208dfdd334614ec68748bdc

SHA1
675651d163ade43e999ee717af0bafe30bc87794

SHA256
aaa6f093939a529d35006bd0ac85c3dfd08afd3b9d962bd89c7aca9fbdc0dc1b

SHA512
d0b49ea29b0ee68ffe10354c9af41a398152c2028c4c074c86fdf9aadf3b0d71c4abcf9019e23b89f544f0e3a09584865549407457d442a1e4df58dd2a0c5c9b

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\ProductStatistics.dll
Filesize
1.8MB

MD5
2423af45638cccfd934bd903e6ffd38a

SHA1
c7b04774ee368d3f697c58fa5932c5106fba9580

SHA256
4b47b481d2bb327e784413d803d902cdd0758e202f2f494fcce4332037c54fd8

SHA512
b94a03681e8c59aadf1ce27b0fe616cdf46394462c431d334e7b9cd7be5a7d9dc20a275451b3db40a9e311707c9635dea16a81d6f7982358027766003582141c

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\RegisterCom.dll
Filesize
1000KB

MD5
802cd64f6ea985824b2ff10130147640

SHA1
998ee7a9587e780e84f5a43a6e8f02c100cd43ca

SHA256
87672dd803468ddc2561ecacb5cb9b3384fec231f6694d02efa8cdc9ff867223

SHA512
a68a09112ee7a17c332008bf65d13fa5b6cf458d59d9c927f16bf2ab9705cf58285d53c116658b2644318d246771deb23ce544f719a7b3605801d3c4365bbcdc

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
Filesize
2.4MB

MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\UninstallExplorer.dll
Filesize
2.4MB

MD5
05066aff4c5cedacbd35dae7b9ae7f62

SHA1
2335db652b28109dfb80b74e067974cd87a768b7

SHA256
050e79882e2c4fde169c8595baaf7cf24bb8ae3cdb6f8c65ced1a9670e762414

SHA512
da2ff93f25390f4f5e34e19b11ea3f1604cdfcf18f28b470dcd2d4849d1c209c5934f2a7f2c614bdd213afdcf8967a727d80035652ced9964b0562ef704b2a33

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\iush.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\madbasic_.bpl
Filesize
205KB

MD5
0470b3205faf06b0b807629c7462ea90

SHA1
b0b309ba97caca555c1c1edf90b7c777d0ee4deb

SHA256
50e8481906f27e92bb80f4b7139f90949b960b1b2898dd0f6875147f44d8ad20

SHA512
7aa09d6eca8fa7add3c9b81ba6196d3e2665ab93dffda3ac26a24e3b3745d8d1afb340ac41822979845701ed54459637ab2206c5597a2413a2af1d37f7c62f32

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\maddisAsm_.bpl
Filesize
58KB

MD5
61d323161f2cbc187e6a36a12a0734fa

SHA1
6f3b54a3860ed8cf5746516c86c4c75fcfc1e0ae

SHA256
fbb9b4f1944b82701c7c06971a24cfed09d6e7f4a0f1684eba49800e3396fe3a

SHA512
0f1f8e8fef47791e0e6a62b2b91aec7d014c98b0b576940d99a4a7f714747120927b96cc70fb7b25cfd43276db059b1a9e4b73b0d51c29b63eb8a40ee2afb63b

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\madexcept_.bpl
Filesize
431KB

MD5
8be2193312995c8a442e71dab101c021

SHA1
6cc4722f740724b62b29082c8d17ee7dcf5491a8

SHA256
774afb7dfb8bd192838890b1b522b3f05b3762d6db3f412df7a4f51ee6eb052b

SHA512
9900d52a06bfeb93970e15667e048e35f50debbf3b03f1d318ef0939877be870d507c98831b7a78b1f6ec69127552d1cba64cb33d1452514a87cf756f056796f

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\rtl120.bpl
Filesize
1.1MB

MD5
83ac415bcad54682d56dfee0066000e2

SHA1
916e00f9cfebe0bc1296d5b9e84b86d80548e800

SHA256
91ade0cbd518fd898f61b53d27f89c4ab64bc3dba22483a4b9b78d5826a333e4

SHA512
ca90a6026cb8265f23d7feb45b5caded216e87d72c4f2cc579e44c29ef7a213efbb54435551c0d1e44fe9979d54cbee91b1150eddb701ce89dec1555ec017703

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\unins000.exe
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
\Program Files (x86)\IObit\IObit Uninstaller\vcl120.bpl
Filesize
1.9MB

MD5
9cef56e9868e96afabb1fcd8758931b8

SHA1
8e99aa4839e6e29a4213ca0309c6ea02a46442f7

SHA256
28fdac79c3e1656e4c60de4b6bc6dca390ef5b86f58d75e1f352bc964a4efdcb

SHA512
b296b74c637d7db8bc82d98e794c8f27afba5e061d06c6bcbbd806eee511dcd2414a7d8505af0b4d71c96dada57126c38f83f13552079fec3c2e4aa1a647074f

Download Submit
\Users\Admin\AppData\Local\Temp\filectl.dll
Filesize
63KB

MD5
ac33819578af85cefcfd73cbd99821f4

SHA1
1499393c24ee2a50aa92a21fd8d88c86552321d3

SHA256
63ed2a1c8f49336a005428fb59c3304cb69c073d60e497e83e81ad7ef23f9f37

SHA512
4e15a2ccf3f21fb1900ffb956b2a2356ce975a21ff1efea9784f8efc4c34b2308ae86b8d5c8759f177a8b79d116511c758b8df171e6efc2b9479cf64a76dd7da

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Installer\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
\Users\Admin\AppData\Local\Temp\is-4U9M3.tmp\Setup.exe
Filesize
5.8MB

MD5
eca5782b9d041698c54335dfd9b33b6e

SHA1
c63e90365ac293aa988903fa64325c301d7a984a

SHA256
421b442a057015451e891aa248d282c640dc825d1321216e047763261e1e8188

SHA512
79ab65a4a9b75fadb7dcd9da951245177684976364e53c6e9141baa19e67a5891bb50d68b1acf2f9e3bc0067a3f6972470de708a2724d44d9d8955a0762b4075

Download Submit
\Users\Admin\AppData\Local\Temp\is-68HJ2.tmp\Installer\iushrun.exe
Filesize
5.1MB

MD5
ffc5d2a25105740bbfe1309e3093fec1

SHA1
29117ef35406b3c9620ab2d1d0ac54907d3f2b44

SHA256
3418a6b01d1ec08562b7efa0c9ceab0928fbf08e139e4daf75d40b5ecffdebe1

SHA512
39f19008552f42d5105427ac7d25a0d8beffa21d36d1f9d6b6668db3b654ded201391e5d561c07ba8d707279abcfda246c615eb24017c4cbb1424af434c53a09

Download Submit
\Users\Admin\AppData\Local\Temp\is-BIH53.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
\Users\Admin\AppData\Local\Temp\is-PK65S.tmp\iobituninstaller.tmp
Filesize
1.2MB

MD5
04ed91f797aab3675201f21dd84de8e1

SHA1
88489c2853c5983b01b1eeb0a307a444e7cb405a

SHA256
8b4d460ddb8e8420cbffe2a7d60a11cff6a3e4762208f8b56f7af83fd5ec1fc6

SHA512
5926502702d26abd4959ba2c7a704c8b11aa077682c8807fce181364a1691624137f7a0a48d58166d400bf5bb948c2b8e916a8826520869582540e424ea2d80b

Download Submit
\Users\Admin\AppData\Local\Temp\rgfpctl.dll
Filesize
524KB

MD5
8e5e15bf48ea6e53cff7bffa4d76ecaf

SHA1
fe44a1c730687c4ac52d7f28c5232df64d629a8c

SHA256
addd846ee0dfca4a2b8ca2b2b5f72294568a8016d67ce5769d108fd6dc9e905a

SHA512
d5b2223d5f9e8d6a0de20e979bd0c78910f9b3810dad1e620cb1d151aebe4c64bce88211693dc6b56c37f4bbafebbe928f32f8ee0d679b87c5008026d723f823

Download Submit
memory/284-124-0x00000000069F0000-0x00000000069F1000-memory.dmp

Filesize
4KB

Download
memory/284-122-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-544-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-645-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-478-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-80-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/284-638-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-652-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-83-0x0000000003C90000-0x0000000003CD0000-memory.dmp

Filesize
256KB

Download
memory/284-81-0x0000000003C40000-0x0000000003C41000-memory.dmp

Filesize
4KB

Download
memory/284-110-0x0000000003C90000-0x0000000003CD0000-memory.dmp

Filesize
256KB

Download
memory/284-109-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/284-108-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/284-82-0x0000000003C50000-0x0000000003C51000-memory.dmp

Filesize
4KB

Download
memory/284-101-0x0000000000400000-0x0000000000A1A000-memory.dmp

Filesize
6.1MB

Download
memory/576-592-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/576-597-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/576-598-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/576-595-0x0000000050310000-0x0000000050349000-memory.dmp

Filesize
228KB

Download
memory/576-594-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/576-593-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/576-599-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/576-596-0x0000000000300000-0x0000000000301000-memory.dmp

Filesize
4KB

Download
memory/576-591-0x0000000000400000-0x0000000000545000-memory.dmp

Filesize
1.3MB

Download
memory/756-535-0x0000000001E90000-0x00000000020F8000-memory.dmp

Filesize
2.4MB

Download
memory/788-627-0x0000000000BD0000-0x0000000000FC6000-memory.dmp

Filesize
4.0MB

Download
memory/788-609-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/840-631-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/840-479-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/840-117-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1000-577-0x0000000004AC0000-0x0000000004C97000-memory.dmp

Filesize
1.8MB

Download
memory/1000-580-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1000-581-0x0000000003B20000-0x0000000003C20000-memory.dmp

Filesize
1024KB

Download
memory/1000-582-0x0000000004AC0000-0x0000000004C97000-memory.dmp

Filesize
1.8MB

Download
memory/1000-576-0x0000000003B20000-0x0000000003C20000-memory.dmp

Filesize
1024KB

Download
memory/1000-575-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1000-507-0x0000000004AC0000-0x0000000004C97000-memory.dmp

Filesize
1.8MB

Download
memory/1000-498-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/1000-512-0x0000000002440000-0x0000000002441000-memory.dmp

Filesize
4KB

Download
memory/1000-500-0x0000000003B20000-0x0000000003C20000-memory.dmp

Filesize
1024KB

Download
memory/1252-637-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/1252-539-0x0000000000B60000-0x0000000000B61000-memory.dmp

Filesize
4KB

Download
memory/1252-632-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1252-634-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/1252-636-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/1252-635-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/1252-537-0x00000000004C0000-0x00000000004C1000-memory.dmp

Filesize
4KB

Download
memory/1252-538-0x0000000000950000-0x0000000000951000-memory.dmp

Filesize
4KB

Download
memory/1252-633-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/1256-608-0x0000000057800000-0x0000000057812000-memory.dmp

Filesize
72KB

Download
memory/1256-607-0x0000000050120000-0x000000005030D000-memory.dmp

Filesize
1.9MB

Download
memory/1256-606-0x0000000057000000-0x000000005703F000-memory.dmp

Filesize
252KB

Download
memory/1256-605-0x0000000059800000-0x000000005986E000-memory.dmp

Filesize
440KB

Download
memory/1256-604-0x0000000050000000-0x0000000050116000-memory.dmp

Filesize
1.1MB

Download
memory/1256-578-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1256-600-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1392-76-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1392-62-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1516-54-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1516-79-0x0000000000400000-0x000000000042C000-memory.dmp

Filesize
176KB

Download
memory/1564-630-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1564-495-0x0000000000400000-0x0000000000532000-memory.dmp

Filesize
1.2MB

Download
memory/1564-130-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1804-726-0x0000000007210000-0x0000000007211000-memory.dmp

Filesize
4KB

Download
memory/1804-720-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1804-728-0x0000000007BF0000-0x0000000007BF1000-memory.dmp

Filesize
4KB

Download
memory/1804-727-0x0000000007820000-0x0000000007821000-memory.dmp

Filesize
4KB

Download
memory/1804-716-0x00000000002B0000-0x00000000002B1000-memory.dmp

Filesize
4KB

Download
memory/1804-725-0x0000000006F70000-0x0000000006F71000-memory.dmp

Filesize
4KB

Download
memory/1804-724-0x00000000070C0000-0x00000000070C1000-memory.dmp

Filesize
4KB

Download
memory/1804-723-0x0000000005060000-0x0000000005061000-memory.dmp

Filesize
4KB

Download
memory/1804-722-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download
memory/1804-721-0x0000000004950000-0x0000000004951000-memory.dmp

Filesize
4KB

Download
memory/1804-717-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download
memory/1804-719-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/1804-718-0x0000000002100000-0x0000000002101000-memory.dmp

Filesize
4KB

Download
memory/1892-156-0x0000000000400000-0x000000000096B000-memory.dmp

Filesize
5.4MB

Download
memory/1892-148-0x0000000004720000-0x00000000047AA000-memory.dmp

Filesize
552KB

Download