hxxps://www[.]revouninstaller[.]com/start-freeware-download-portable/

Analysis

max time kernel
184s
max time network
259s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
17-03-2023 20:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.revouninstaller.com/start-freeware-download-portable/

Score

10^/10

adware persistence stealer

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.

Processes:

iexplore.exe

description pid pid_target process target process

Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5784 1280 iexplore.exe

description	pid	pid_target	process	target process
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	5784	1280	iexplore.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe

Executes dropped EXE 1 IoCs

Processes:

Uninst.exe

pid process

752 Uninst.exe

pid	process
752	Uninst.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

setup.exeUninst.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	Uninst.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

setup.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wermgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exewermgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 35 IoCs

adware spyware

Modify Registry

T1112

Processes:

iexplore.exeIEXPLORE.EXEsetup.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021324"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 2076113b0c59d901	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{62BF0E4F-C4FF-11ED-8FFF-6E21A4042E2D} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30611b3b0c59d901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "935364749"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "935384830"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b00000000020000000000106600000001000020000000e4098f4e7a119bf099b2d6a9504893f69dcc61e24e963202026c1f85edd1e01e000000000e8000000002000020000000797088fb21e929defab819ae52a43abb44a027b4d9f9dd8a8d501cd6a953977020000000028c09a64ae02f80a88011b0a3203ee52d1bfe804f8e00f57e6cd639d6f2876f400000000d0dcd79071e525be98dae0a998be68281a6e077f7d8878bb69c26b488d4786c500984bc2f57e383e069aced1598a495973e8a1987f9b5d1b838487d5e0f0227	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31021324"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000010d3bb75b0ea114e9ca1233a5a090b7b000000000200000000001066000000010000200000008eb1396a5b0b837fdacfb5a09c5e37a6c954add63c196821f8e544d37d6eaf00000000000e800000000200002000000094c7c56760206ade0dbc643e124471e4a04b4125c50a4447f826f6ba748bbd0f20000000906b85075985b81cef7e30f8b3f46d7d43521a57cfe0567e98b53d489ba65ae1400000008d6d5f561aa4754078044d1dfc7b4d4cfc4d596b5d5791f225a44c237e6e5ba9bc6acba947dcd1d2fc0eedff8e80fc3ff47fbf8f97ae723cede4dd98804a4244	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133235571798539907"	chrome.exe

Modifies registry class 64 IoCs

Processes:

chrome.exesetup.exeUninst.exechrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-144354903-2550862337-1367551827-1000\{556ABDD2-2695-468C-9616-96FCD2BB914D}	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\TYPELIB	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LOCALSERVER32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\TypeLib	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO.1\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INTERFACE\{C9C2B807-7731-4F34-81B7-44FF7779522B}\PROXYSTUBCLSID32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\TYPELIB\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0\0\WIN64	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ie_to_edge_bho.IEToEdgeBHO\CurVer	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ie_to_edge_bho.dll	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\CONTEXTMENUHANDLERS\7-ZIP	Uninst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\SHELL\OPEN\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgePDF\shell\runas	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEMHT\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{31575964-95F7-414B-85E4-0E9A93699E13}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	Uninst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\DRIVE\SHELLEX\DRAGDROPHANDLERS\7-ZIP	Uninst.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	chrome.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\DEFAULTICON	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\open	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{23170F69-40C1-278A-1000-000100020000}	Uninst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FCBE96C-1697-43AF-9140-2897C7C69767}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\shell\open\command	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge\shell	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C9C2B807-7731-4F34-81B7-44FF7779522B}\1.0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEHTM\APPLICATION	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{23170F69-40C1-278A-1000-000100020000}	Uninst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\FOLDER\SHELLEX\CONTEXTMENUHANDLERS\7-ZIP	Uninst.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\MSEDGEPDF\SHELL\RUNAS\COMMAND	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	setup.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

chrome.exemsedge.exemsedge.exesetup.exechrome.exe

pid	process
2144	chrome.exe
2144	chrome.exe
2920	msedge.exe
2920	msedge.exe
984	msedge.exe
984	msedge.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
3132	setup.exe
1220	chrome.exe
1220	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

2144 chrome.exe
2144 chrome.exe
2144 chrome.exe
2144 chrome.exe
2144 chrome.exe
2144 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exeAUDIODG.EXE

description	pid	process
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: 33	4292	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4292	AUDIODG.EXE
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe
Token: SeShutdownPrivilege	2144	chrome.exe
Token: SeCreatePagefilePrivilege	2144	chrome.exe

Suspicious use of FindShellTrayWindow 40 IoCs

Processes:

chrome.exeRevoUn.exeiexplore.exe

pid	process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
5784	iexplore.exe

Suspicious use of SendNotifyMessage 29 IoCs

Processes:

chrome.exeRevoUn.exe

pid	process
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
2144	chrome.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe

Suspicious use of SetWindowsHookEx 28 IoCs

Processes:

RevoUn.exeiexplore.exeIEXPLORE.EXEUninstall.exeUninst.exe

pid	process
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
5784	iexplore.exe
5784	iexplore.exe
5892	IEXPLORE.EXE
5892	IEXPLORE.EXE
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe
5624	Uninstall.exe
752	Uninst.exe
1656	RevoUn.exe
1656	RevoUn.exe
1656	RevoUn.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2144 wrote to memory of 1208	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1208	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3592	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3996	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 3996	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe
PID 2144 wrote to memory of 1240	2144	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.revouninstaller.com/start-freeware-download-portable/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb0b619758,0x7ffb0b619768,0x7ffb0b619778
2⤵
PID:1208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:2
2⤵
PID:3592

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:3996

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:1240

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:3708

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3224 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:1248

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:3584

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3200 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:1704

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5056 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:4716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5336 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:1
2⤵
PID:432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3348 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:1748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
- Modifies registry class
PID:2192

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:3412

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6308 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:3892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3264 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:8
2⤵
PID:60

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5780 --field-trial-handle=1816,i,9140783547923201696,10209494498408077155,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1220

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:4392

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x408 0x4b0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4292

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3940

C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\x64\RevoUn.exe
"C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\x64\RevoUn.exe"
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --uninstall --msedge --system-level --verbose-logging
2⤵
- Modifies Installed Components in the registry
- Registers COM server for autorun
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff734195460,0x7ff734195470,0x7ff734195480
3⤵
PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --suspend-background-mode
3⤵
PID:816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf0,0x120,0x7ffb0acc46f8,0x7ffb0acc4708,0x7ffb0acc4718
4⤵
PID:880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1976,11541147022193766794,17639447747558465580,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1976,11541147022193766794,17639447747558465580,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
4⤵
PID:2936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --uninstall
3⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x114,0x118,0x11c,0xf8,0x120,0x7ffb0acc46f8,0x7ffb0acc4708,0x7ffb0acc4718
4⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13445288655397807974,2322596341477169456,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
4⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13445288655397807974,2322596341477169456,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:984

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3132" "2240" "1716" "2244" "0" "0" "0" "0" "0" "0" "0" "0"
3⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5812

C:\Program Files\7-Zip\Uninstall.exe
"C:\Program Files\7-Zip\Uninstall.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:5624

C:\Users\Admin\AppData\Local\Temp\7z82AC85F8\Uninst.exe
C:\Users\Admin\AppData\Local\Temp\7z82AC85F8\Uninst.exe /N /D="C:\Program Files\7-Zip\"
3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\System32\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Delete /TN "Revo Uninstaller Hunter Mode" /F
2⤵
PID:5272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:752

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://go.microsoft.com/fwlink/?linkid=2108824&hl=en&version=92.0.902.67&osVer=10.0.19041&ch=stable&deviceId=s:46CAA714-52CC-4AB9-A019-1AE3E3C36027
1⤵
- Process spawned unexpected child process
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5784

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5784 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5892

C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\x64\RevoUn.exe
"C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\x64\RevoUn.exe"
1⤵
PID:4396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000015
Filesize
160KB

MD5
f22f07ee02fbeed3958345c90b52b818

SHA1
2aa44ea19d580589c06c2170103b4d0505e18cdb

SHA256
dc1eadf37f70bef92766d0c316d1da7af283b84e5c309a4732d8ed35d7bbfb84

SHA512
8473f7cef3e9289f355047689f5a2b82aafc49501c65f118e5b0632a6a690e542eeae45644e77fa5b869df17b05ed138b4183cc93364935b1fa7d89e32fe5d5d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017
Filesize
35KB

MD5
0d9540f51d158b383cfcd6a191acac3e

SHA1
d0ef132652b7185bfa73c3daf251ac9c184816a0

SHA256
ea6a4b9eff251baa13177bda965107ee5746a04e53b3d6f89b7d69d5fa5d3957

SHA512
1df8b62e9dacd28c84075e76a5447f790c0e588dcce491a992bf24670be7fd75bdbb4451fc6eabc8b49702c56bac8ad19ad7718a053c6298380235e51b979405

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
ad1063b6f4452dd5f11bed1921fbc76b

SHA1
2af9fde3555797eccfc4fcf30f0feb7afbda0e43

SHA256
7b24644d297f8b830574f57c8c228131de324e7faf47eff4f546fefe6f530a0e

SHA512
051935f132518bed10a117de2ca5e0620a6686c9c2d4e0393e7c62fb1044e997d423e3a98fb27ea67f80ca3fec42594ae734bdddd50e8b8243db24ebc7131fa6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
6KB

MD5
dc040afa7693646577b28e01f52355e6

SHA1
acb189332128bad5c26b92e186817016f5538b02

SHA256
c043eb27673d3e333e9d8b6455f7c4ca486958474f5889cb075c1fe4769ccc0c

SHA512
a43d3c278ec887f554cf0de100a3cf694d672446db71f0f55c3302cdaabc60a21434f8ac6efb236a9ac0a97e007bccaaf9097a33732a3990567b1084bb67e17e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
2KB

MD5
0323a84db0c1ad3a76268d486c603b87

SHA1
d6543973288be7b319f8697e22ac35a1354d557e

SHA256
2e393f1abd56e9240e9c83139bda13d08bbba7ef495c245338ad1f6f259bf190

SHA512
e735228bc6ac8634524943f6b05e16ae31f7295f3b98bac4e685a7ba3f878777b7cb466833e230f99b2d33f9fd0f71f8c707bd18d6a844f4c45e3e940a562393

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
e22c35acc277146de34feb9bfc7e276b

SHA1
368ebda3c308b0f5c1ee86026536d5c532c88ec8

SHA256
1a6d9e3a591ee9461a2739f06e2cbaa63216b96e55e780feeed20ec875e46766

SHA512
e9b93c6eba0fbe4db28208dbcd0adb270f20022af415b7df8d539c5e2c2c00b82636f8a60253fde00acc5c53a0da95c34367c7a839abc5afbbe6068f34c6eb27

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
a09a331e65ab27d9b426021a57e9d536

SHA1
3a1feee4d82f571b7b5174e09de42d6bae41f38c

SHA256
5ac9cb75dab272da66114cd7ce897c9b4291d584f5d985a12c4a647d084b2c0d

SHA512
64c9c7f1cb87896d20d31cd8a182d6187ce9962d817b1e0447c196dfff89b0e62594fc8c760b1efb14116c4021c17302bd3ff4d06f71a90ae3357d327e6547c0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
c236007b31b03fa01ac7f591562e75ce

SHA1
7b845ac90ab1126d23c1ae8d3a7db0661aaacd6b

SHA256
64a79c7da8f84a9f7b3b719ac59157ce5555684fd1753064ff9fe5ef3ecabe39

SHA512
8982540a0985763ce44374d55cdae7e2c7ca6dc64441c6e887091225b0833a1c6f95de636a18da47212cb958440675f0dbbc519d9cbe8ad2d16ab6a1675e89b0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
5KB

MD5
8d53c6cba99b95bc999f12970fa75f6a

SHA1
5f34b863234c05116e8968da4d80bd30afef8617

SHA256
0a0da4504bce917c4ccee96e3fc2b02ca7ee992dde99c42ae089aa65a850ece4

SHA512
06506710b81c0467c71609f584c606af6985899b26b7d7c0504e49468f2b4ba8305320e209d2f5b8cec62533c27ea19af0837ce68103b6457719dba9b13216c1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
56B

MD5
ae1bccd6831ebfe5ad03b482ee266e4f

SHA1
01f4179f48f1af383b275d7ee338dd160b6f558a

SHA256
1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

SHA512
baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize
120B

MD5
904cb00a3ce7e018759fc8e0a6efd331

SHA1
d9169373f733485969532cbbd5d3f26f0c0efe84

SHA256
43ca2c849c19c8c15d412c95753bddc144c5c486d365f58e468f6218febd6e8a

SHA512
ac960cef7e96b05533d543988ba03bce340f8e3ec6d2a1a6e921bbddf291e6e1242fc622c92d07ecec8f02a9d0711af33f4ae337a1be825294e2d121a3536195

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe56cf7a.TMP
Filesize
120B

MD5
2190f71490058742ab2486fa8915f568

SHA1
3733272e3f750cd2a0acfd77535e99aac6672580

SHA256
0cdfd9d7f6d618fbc60d295bf28372268a6b88069e951f777f014975c1449e1b

SHA512
7d233a92aafb548f39e142fbf04ee58cba01a0bbaa61d3a33ac0b8d34a23cc1c3cd744f0f188f781badc5779a6cd0723a3fe83fb0f4f0eebfdd28523a3db89ec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
143KB

MD5
714c5ed154d09332fbbec4191cfacf1f

SHA1
165095061995eb3863d9324ce6a385190a73905f

SHA256
31788920605e8f1639a41c16dc956ee8b07155dc2d0f31e0dc4cde8764f31741

SHA512
b5cbd16af5ec504923eec920676903c82e6e0c0aa11b6c5f53b23fffc4810185f43dc510288488caa23548c327784f29d9f4da0bc4016e03bc08d4d859ededf0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json
Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
462f3c1360a4b5e319363930bc4806f6

SHA1
9ba5e43d833c284b89519423f6b6dab5a859a8d0

SHA256
fec64069c72a8d223ed89a816501b3950f5e4f5dd88f289a923c5f961d259f85

SHA512
5584ef75dfb8a1907c071a194fa78f56d10d1555948dffb8afcacaaa2645fd9d842a923437d0e94fad1d1919dcef5b25bf065863405c8d2a28216df27c87a417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d2642245b1e4572ba7d7cd13a0675bb8

SHA1
96456510884685146d3fa2e19202fd2035d64833

SHA256
3763676934b31fe2e3078256adb25b01fdf899db6616b6b41dff3062b68e20a1

SHA512
99e35f5eefc1e654ecfcf0493ccc02475ca679d3527293f35c3adea66879e21575ab037bec77775915ec42ac53e30416c3928bc3c57910ce02f3addd880392e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
01df0d66668ed2cf469c6d5b6094cdee

SHA1
ebba7c70dfe076f8d9a00c5b02c9928d49a2014e

SHA256
06ce9e32b115eabfe8e830a7529fe543395223d5b77022156159e9a7fda14271

SHA512
131b081a66ae7276cc9f007bad6a3a75e3cd79c280457590477fc28e228e413f99d490b041e1732eed0668b646844db5774b22d9641f68a4714b1356f2ad9b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ac923041633a1814895191ee0e177a29

SHA1
ec2c76c2d9cee24965787e68a7a7b9da025320c0

SHA256
eeb083cde2404e9d2492551a6f2e31ab419178adabb1b65c49c8a4acf03ade37

SHA512
85ce703b4b176210e643bf694361463878ddb6bfc393b9e06d8071800e3c63576af7e502d96b47111a671e600fcc29c878ce341a0df88500b5afa348cad794ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
01df0d66668ed2cf469c6d5b6094cdee

SHA1
ebba7c70dfe076f8d9a00c5b02c9928d49a2014e

SHA256
06ce9e32b115eabfe8e830a7529fe543395223d5b77022156159e9a7fda14271

SHA512
131b081a66ae7276cc9f007bad6a3a75e3cd79c280457590477fc28e228e413f99d490b041e1732eed0668b646844db5774b22d9641f68a4714b1356f2ad9b8f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
2KB

MD5
ac923041633a1814895191ee0e177a29

SHA1
ec2c76c2d9cee24965787e68a7a7b9da025320c0

SHA256
eeb083cde2404e9d2492551a6f2e31ab419178adabb1b65c49c8a4acf03ade37

SHA512
85ce703b4b176210e643bf694361463878ddb6bfc393b9e06d8071800e3c63576af7e502d96b47111a671e600fcc29c878ce341a0df88500b5afa348cad794ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1
Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\imagestore\phzg4yt\imagestore.dat
Filesize
7KB

MD5
b1717907172fbf20b90a79bf03f1340e

SHA1
0cf883907f071c98cea5c92f8029c707ec4f921a

SHA256
d937a208b9c165c79d3bb3e7dfa7b2128cb907ef4558bddf91c4ce559a9fdc8e

SHA512
65cc3643ea52a0bc196c072950e32b0e34b3ee15d95025ee433920dc8c4b970545c46f2ceb07b84c8607017559bef995ada232e5e034a2f8e9807a68d801735c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\39K1WZBJ\favicon[1].png
Filesize
7KB

MD5
9e3fe8db4c9f34d785a3064c7123a480

SHA1
0f77f9aa982c19665c642fa9b56b9b20c44983b6

SHA256
4d755ac02a070a1b4bb1b6f1c88ab493440109a8ac1e314aaced92f94cdc98e9

SHA512
20d8b416bd34f3d80a77305c6fcd597e9c2d92ab1db3f46ec5ac84f5cc6fb55dfcdccd03ffdc5d5de146d0add6d19064662ac3c83a852f3be8b8f650998828d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z82AC85F8\Uninst.exe
Filesize
15KB

MD5
b0cec9f342bf95700b602ee376446577

SHA1
b955b1b64280bb0ea873538029cf5ea44081501b

SHA256
24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088

SHA512
05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7z82AC85F8\Uninst.exe
Filesize
15KB

MD5
b0cec9f342bf95700b602ee376446577

SHA1
b955b1b64280bb0ea873538029cf5ea44081501b

SHA256
24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088

SHA512
05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable.zip.crdownload
Filesize
8.6MB

MD5
1cbe2cea347120e691d8947b7920827d

SHA1
2a54fca6e60c469b5907f8c5733f85b6a08c458f

SHA256
e4c9cfe9bf22a90648892a4dea0706970595545b47f1c88231f62037253e92a3

SHA512
e2f880a4efdcc7065059846fe875a5477852702ec89a8af8a41f4cc6064c7ec67f3509f16ed39f2e9c1c8fe40148efe2da4a9e1b4468ecba835ff237365f156c

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
448de37845882c419e8f824684597d87

SHA1
ed8f5c4e8dcfb2f0ed23e0a0310897b345400830

SHA256
cd5a4d75aa558bc8ea55557def0fc132ebb8ccdbb5b4cf9fdeecfd766582c343

SHA512
e873df1a95f7cf6720a355d982948ea73b192ead3833838ee5af374d5bf1f090f3350d36c3cc26e7e38d0feb2f0aaeb2ff6de91467f50b93cfc61f6ec8212d99

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
cd5091360c3da4dc3abcc2c661de1caa

SHA1
45c2933c5dba50d6a51693e8efa53873a5e1c0d7

SHA256
069973b4238b2557a3a765e592ace806b269fa45990a3458b3e02c78a95a6e7e

SHA512
cc1f180d247ae1ab155938d8bd882d67aeba2275dbce9bb51812a7ece7da95922d432e413487b59ecf3de185ab74d8e74e17526359ae85626483a7436adb990b

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
cd5091360c3da4dc3abcc2c661de1caa

SHA1
45c2933c5dba50d6a51693e8efa53873a5e1c0d7

SHA256
069973b4238b2557a3a765e592ace806b269fa45990a3458b3e02c78a95a6e7e

SHA512
cc1f180d247ae1ab155938d8bd882d67aeba2275dbce9bb51812a7ece7da95922d432e413487b59ecf3de185ab74d8e74e17526359ae85626483a7436adb990b

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
3c135d3a8d29fc5fb1695e1aff6d83aa

SHA1
fd49fbd00b04431f0a394827473514468acda27b

SHA256
44b64a074e625c0fbcbd91d2c24f865d667806e5b850c04e893dd62ef061c896

SHA512
4631dfb21a12d97f4b5f5ab8b9694bfe47072e4b02fb44855a3161755badd9705da55d0da5acc9472c89793d203dfc3a90555e5772fd9cdca60dc04056533c3c

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
9ed65cb3dc7d102a871bd0f42d7196ad

SHA1
5c59813658494b28a484ad0d9ae443c5d7d0bbb5

SHA256
2dcb7266afccc57b94c4b81c375f83c20c045180d880eb16152e83fad4619e9b

SHA512
3dad9acd74d8e79b47f154fe8607dacc3a5b4c7c31942ddfbc9f91f2b107c202e9c6d8031d3c1c96cda01617dbf59ee8d4d7e66560b4737869980fe93b0b34d3

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
2KB

MD5
867e11d5df107637040fb279db0d5909

SHA1
e148bb2a1c94b5184090e2c6b5f235fa701e0ac0

SHA256
20882665f3754cafa8bace9c4f5b24b912e9085b1be0d4f191c1cffc3c50234a

SHA512
c6491289389dc6739317d205f5e62266c08278545732cd870de15da49cbe772cdf847fe2776e05a2655485a2743939cfab62a466f4ac979840a07a9d1328aad0

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
3KB

MD5
2077391283123516e347a467fb65b75f

SHA1
9656576f897046bb1965133ae98e4f08d888870d

SHA256
a31719ec878194f828755536c070f9efea36ba2402df4f943141dfd425bf8439

SHA512
0a7f04f35bbdb136fea23a178ddae67d9b304c39a7dc0d695047357fb743fb2714c8639bc0b147c9800ec5a2bdecc8130b2230a5a234feae9156d88b48e338f8

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
3KB

MD5
773cfe01ab4d2c2ccf87efd948a493fa

SHA1
afd7acf605ceedf29c7578b503db6dac7596016d

SHA256
c74df64a57b7cc603d24ec40994cb38ae5c315d0d19f2aca19509b18e1af3c28

SHA512
25043cedee8ba48d3e9201e34863b1cbb8f2170dbdc58aa46b7668567c5dd49935cd46102b39bba3b3b785facc494e63b82b6cfe383d20374066d4358a63ff10

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
310B

MD5
6ecaab031111fcce0ff2731ab3c8a9e0

SHA1
c61ccbb6d71347c9e1673f4aa6210a0b0b11a6fb

SHA256
b12344b2457877b2942e0ad4e47fd260a0f1b15451317122ecbc7a36ea0f65b6

SHA512
b98053578cea8ab36fff704a403ebf18a438d96c941d48fa7a1326b08552e8b5a275eaf4d4d08e5bbbbde1eabdbb41e987269903949377544ad185971106ebbf

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
860B

MD5
be0a819279589bdadf841c1dea2553c3

SHA1
2e703cc9aa1a2f0c34c43020b9c21049e3fd02a5

SHA256
f963d0ccbcfab5fb945f73ebbfeab2c28724be1ee9807bf38e852af04b7a8aa5

SHA512
dd49e60930f956221937326a7d0e4143cf23a1dca114bf73c9faaa2145c4b0155c59201d34dfa1cb903a28eaff7e5538d5db7e5e89955671f57ef82b9ecaa729

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
998B

MD5
84ae3a25bec1460e91d0f3a74fbf02aa

SHA1
503ac1a725d7b108ca82659ea61ed11a2735b6ec

SHA256
cd15c1aa73ca66d7615c29091bbeadf16acf9967369c51548b7822ea7d539c96

SHA512
02161fc33d31c9a8447b9f949ec2bb48f6f47dde4417f5963f426ab60dbb1d4e8b0129ded1870a1844695a95aa8d25f8f1a2c49572d73c2c534a264d8cc73def

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
37fe93563ffd8b2d304dd0c2ef0ad220

SHA1
21cefbf4e1b86041ff49e2557f911a12a2818a90

SHA256
1edc91bd85ff7004993e2ced7bb0162a07783d1115ee65f3036055ac4193da88

SHA512
89e03e17c66346d2001bff7a5540386455fb8696efc92ba7d48b90a9f0fc9016418e024d6c34c617cbb61367044a98e08509f2f7bf16d89ac5860f0508050743

Download Submit
C:\Users\Admin\Downloads\RevoUninstaller_Portable\RevoUninstaller_Portable\settings.ini
Filesize
1KB

MD5
763e64381c6409251d61656c63bd17b0

SHA1
10aa04d9ada8727b17dfa2cd78da7142c65e0565

SHA256
6a73c883aee65c75fda27688ce2fd95d924124eb7f16ee6a037bd45220931b14

SHA512
42adfe66b72bfb875f3d350daf2898603f0250a92c3102e97b7622e667b66fd5566b0496f3e5624a311d3ef1deff5b2ec6f100694e5c718922c4762f836deac5

Download Submit
\??\pipe\LOCAL\crashpad_3116_BFPXNXTRINTFESOC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_816_KMLALMNCELLTOPAC
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\crashpad_2144_XCNDGUXRRWPZGZKO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit