Overview

overview

8

Static

static

1

Revo Unins....8.exe

windows7-x64

8

Revo Unins....8.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    130s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29-10-2024 12:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Revo Uninstaller Pro 3.1.8.exe

  • Size

    11.0MB

  • MD5

    77ee834405bfecc0df121ac3453e8fa8

  • SHA1

    3fa8ac41e93ea2305c8460c6aab6ea35a841ceb4

  • SHA256

    b5092827faa342368419da2d7b4400a0c7c9409c7b55f578fa0219750770a9ed

  • SHA512

    601331aaa32c3435d1a593427ae3e2a46082dff9c4d3a9880e1c93cf2f7ab504738dbfe6ca713732b912b36d4dae7bc808577cb40a969e55b135c37950026e2e

  • SSDEEP

    196608:pw+KyuQ5hy4VkzLP4hIgB4N4eyidL7Eui+KDwOtvqMd4a2K5VfdjlS0LSr9:pjvlyF4hIVNJfL2wOtS5a2AVlj80LS5

Score
8/10
discoverypersistenceprivilege_escalation

Malware Config

Signatures

  • Drops file in Drivers directory 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 57 IoCs
  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies system executable filetype association 2 TTPs 2 IoCs
    persistence
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of FindShellTrayWindow 31 IoCs
  • Suspicious use of SendNotifyMessage 29 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 3.1.8.exe
    "C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 3.1.8.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4920
    • C:\Users\Admin\AppData\Local\Temp\is-L6T6M.tmp\Revo Uninstaller Pro 3.1.8.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-L6T6M.tmp\Revo Uninstaller Pro 3.1.8.tmp" /SL5="$70242,10937662,200704,C:\Users\Admin\AppData\Local\Temp\Revo Uninstaller Pro 3.1.8.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3036
      • C:\Windows\system32\regsvr32.exe
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"
        3⤵
        • Loads dropped DLL
        • Modifies system executable filetype association
        • Modifies registry class
        PID:2436
      • C:\Windows\system32\rundll32.exe
        "rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
        3⤵
        • Drops file in Drivers directory
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:3628
        • C:\Windows\system32\runonce.exe
          "C:\Windows\system32\runonce.exe" -r
          4⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:3908
          • C:\Windows\System32\grpconv.exe
            "C:\Windows\System32\grpconv.exe" -o
            5⤵
              PID:3624
        • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
          "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3760
        • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
          "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:2056
        • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
          "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          PID:4764
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.revouninstaller.com/proinstall_thankyou.html
          3⤵
          • Enumerates system info in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:2792
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee4bc46f8,0x7ffee4bc4708,0x7ffee4bc4718
            4⤵
              PID:2724
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
              4⤵
                PID:3152
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3524
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
                4⤵
                  PID:840
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
                  4⤵
                    PID:1212
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
                    4⤵
                      PID:1148
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
                      4⤵
                        PID:5040
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3668 /prefetch:1
                        4⤵
                          PID:4900
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
                          4⤵
                            PID:2168
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,14237505262524848633,7868597374733857545,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
                            4⤵
                              PID:1568
                      • C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe
                        C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding
                        1⤵
                        • Executes dropped EXE
                        • System Location Discovery: System Language Discovery
                        PID:3396
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3624
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3212

                          Network

                          MITRE ATT&CK Enterprise v15

                          Reconnaissance

                          Resource Development

                          Initial Access

                          Execution

                          Persistence

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          2
                          T1546

                          Change Default File Association

                          1
                          T1546.001

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Privilege Escalation

                          Boot or Logon Autostart Execution

                          1
                          T1547

                          Registry Run Keys / Startup Folder

                          1
                          T1547.001

                          Event Triggered Execution

                          2
                          T1546

                          Change Default File Association

                          1
                          T1546.001

                          Component Object Model Hijacking

                          1
                          T1546.015

                          Defense Evasion

                          Modify Registry

                          2
                          T1112

                          Credential Access

                          Discovery

                          Browser Information Discovery

                          1
                          T1217

                          Query Registry

                          3
                          T1012

                          System Information Discovery

                          3
                          T1082

                          System Location Discovery

                          1
                          T1614

                          System Language Discovery

                          1
                          T1614.001

                          Lateral Movement

                          Collection

                          Command and Control

                          Exfiltration

                          Impact

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
                            Filesize

                            125KB

                            MD5

                            6566d185d44afe96c7629e3616d24dcf

                            SHA1

                            3e2bba2d9b53429f28445aaea9d117bb7a896ef9

                            SHA256

                            ad6a370794cced41b61d892b61f265a52c0eaef10e36dd4461795eb92982fad0

                            SHA512

                            2aa16d57247cfc1dda2c661671d40d7d1bbb95372f196655949608ca5022df578942cbd232f6b442a40cd48b4461f1745cc844111fe81e8ea0120262f2d8197f

                            Download Submit

                          • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
                            Filesize

                            15.7MB

                            MD5

                            bd21a3621749f9fdab6d2f5f0ef5f0de

                            SHA1

                            63103c5c5513bb84a9752b9ddc56616e810416c7

                            SHA256

                            abbf602a55c0b4d72b0ad33f8cb2da736dd4df4c8310c63e872b1b48cf3a646b

                            SHA512

                            206a349dd73cb62d398e9c6acc2feb950e2fc977ad354381619e2bc2a13976bafa2f4eb54a43c31dcde6a42df1888704d400063d9b06ebac6ee3f6223188ba25

                            Download Submit

                          • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
                            Filesize

                            99KB

                            MD5

                            771a7c024bff66114b135835437ba542

                            SHA1

                            aebaf5524ac44afbbfc613a9625ccfaee57983ad

                            SHA256

                            1977c458cc71a9858b6cc01fe49b927f8caf7ab7b45931862be0aa8ace5f0b02

                            SHA512

                            c7cca68400469a0edf9b9711bfff8829d381ba15a432d8533fd2f177a31125074aa0fa562ddf57fb57e5ef45107ba8e8c8005a1597da336a0031a53412be85e8

                            Download Submit

                          • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf
                            Filesize

                            2KB

                            MD5

                            5187ac55870310aff60ed802a729a31a

                            SHA1

                            cea83a2959cfac57c75df6bd9618e71fe9f481ca

                            SHA256

                            084309301ca31fc8384e97b30f0867559fbd20c38772e1ff7573d24bbc1a0833

                            SHA512

                            70d1c28d87f223ecd93196aeb1c96591095b6a5c41ade2cf11c08182fe872986206706f7bf2f72f44d16803dcf593249872add4724af13ef7bb328a48c6cdb73

                            Download Submit

                          • C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
                            Filesize

                            6.8MB

                            MD5

                            e826f596ad587788a61430733e27fa4d

                            SHA1

                            a1082de5220d4d7266e484f44f9e7701763031ba

                            SHA256

                            77ae8e8e01347dd5d89663a8b812a5516709cfb7e325a196053047aa5c64e892

                            SHA512

                            6afd7315aca463cfff7a7a1c4f37e7093ea451d1900ee53269af7f163028469634979809e797cd00abf5f301de6765433de2b0fbb528ae47eced7958a0cbe261

                            Download Submit

                          • C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro.lic
                            Filesize

                            1KB

                            MD5

                            de004f19a86041cc0e533282703bccca

                            SHA1

                            b6758ee838e072830bdab8aa25800b62cf812bcb

                            SHA256

                            3721e70700c6f25da4150f5ba9614a42eb16d948a223b9ae27d8b62d946c157c

                            SHA512

                            c8a6f97c372e41065b56cfb2cdb5ecc80a0191d3d1ec61e79159751a77466480a185ca3b63447631544e03b5ad165b48a54b51302c55dab08099953484da7319

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            443a627d539ca4eab732bad0cbe7332b

                            SHA1

                            86b18b906a1acd2a22f4b2c78ac3564c394a9569

                            SHA256

                            1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

                            SHA512

                            923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                            Filesize

                            152B

                            MD5

                            99afa4934d1e3c56bbce114b356e8a99

                            SHA1

                            3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

                            SHA256

                            08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

                            SHA512

                            76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                            Filesize

                            672B

                            MD5

                            d0edcba55d0134811c65152bb0ec2d55

                            SHA1

                            619ef9cffbc09cab38f31975b4b4465c2103432a

                            SHA256

                            d157e914dc180ba01c8a2871bfc44be0977f7402c4d9c6967bfe78201601e1bd

                            SHA512

                            0b8366040346657bc439d23550ecfda3ec89ee675b9770d94a67271b3a0693abff0c89874fe9d1edeb3bc5f70ca855bcfc4f00438e19b78304536c2dd14be994

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                            Filesize

                            3KB

                            MD5

                            964459ae70128eee3806112a227f7f95

                            SHA1

                            7930174a0fb8ca20ae7bcfc1b18d38362a514406

                            SHA256

                            f91e689cb925f6a2fb7e538f85925c790f3aef0a6f7caf3eedd5de36f68dd4db

                            SHA512

                            affac72edf0c6e7836d96917f2c5ddd8a2cf2540f21f42372cf5e9e5e8bcca66ed24392d10d6458aba194947b4abfa0db4d242430ce5492f9c669c593d627d5c

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            7KB

                            MD5

                            05e12e9cafee6b4b3cea23d4f9e27291

                            SHA1

                            e492fbf320643861d716092c78866e60ae47e0d5

                            SHA256

                            57484e50f10fc64c83b85128f95ab8af748d7d85cf9ddb9b4f6d4213ecdb8462

                            SHA512

                            626a7c96ad045231ac51926287ffca27503eb9f6255b67ebf6a0034e5689ceaf460ddb14e4f7d5257f4137a2d7bda02decf3382667615644f9dc18f3af67a81a

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                            Filesize

                            5KB

                            MD5

                            448574dee73b17dc9799a1815d12081a

                            SHA1

                            8654d037f4b8230b8696fb9314358b7bcb2feb1c

                            SHA256

                            66a366958472f6604b9ee8152b5edf7d3716439b480c37cc4e44a1e7c3ddca87

                            SHA512

                            e5e055ad8959ebf0c9776c38d8e6c2eb870874759ee2969961b9561b9e33be8c1544b8f460add1f134017c12c52a435d7093f00566e52a867f11509015ba46b3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                            Filesize

                            72B

                            MD5

                            3bba738f10b8af0b10eb3e3ab8c21f9d

                            SHA1

                            6c971e2a1e01539315fe802add66f1132d559318

                            SHA256

                            83000e14c86e29d0954749385a495679bb4b1be13d0dcc99c7146ccacb617c54

                            SHA512

                            e213169cb692caf64ed9cdadd70afab9cfe3f2f4d79e0f8785951197e6fd60454ab37bb6287a35c065d936c721d3836da9223c6d62e61fc8934f9eda468b2a14

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b263.TMP
                            Filesize

                            48B

                            MD5

                            7973d77c04f00897c3415accd89e11d9

                            SHA1

                            63685dc919a5eeeb9ab95f18c6841332d186bc5e

                            SHA256

                            91e6967ca9c525c3ea3edf338e61f6454fbe505b241172075106b6f1c88adb14

                            SHA512

                            7e314fe3cc7a13b3408823093b5259cb2b8611831684232807d6e2d02f6a2f6239fb40a948914c0520dbed402c9b3bb330e3d7111b57da63319269ccd51fe498

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                            Filesize

                            10KB

                            MD5

                            4b21542f1d3ca8585811d90dfba7d8ee

                            SHA1

                            32acb959a42705b1b9754ab35c2703dc0f6c4cbe

                            SHA256

                            cf8342c8a4c13892651e794b294af745cce4157f74850edf7cfb145358aa475d

                            SHA512

                            8508a78977e4522462622c12785533a0cee45fbd841655f4b29fb125024839a1c4d54397a77f25e2b9182c2980b154152d5abc3d9ea1525e70b5df2005acaee3

                            Download Submit

                          • C:\Users\Admin\AppData\Local\Temp\is-L6T6M.tmp\Revo Uninstaller Pro 3.1.8.tmp
                            Filesize

                            1.2MB

                            MD5

                            66ceba2f4211538b839d592920729789

                            SHA1

                            53f3fc1787280e9f2a06859c1cd2500edd86ea3c

                            SHA256

                            26b6dfa36b45d707691af15bd1af22a252f17a357c8a6bd0c2c6077e4ca1d365

                            SHA512

                            5832cc25faa9cf1ddc89731cf7935956631511a38b3f26c19de7178ca1c97cd4ac366fd8c72c89b1b540522866022d9f5972020311a26f29469fd910a2ce5abb

                            Download Submit

                          • C:\Users\Admin\AppData\Local\VS Revo Group\Revo Uninstaller Pro\data\cachedata.dat
                            Filesize

                            42KB

                            MD5

                            bf8d18b7e279e22bdce4615d7d152fc6

                            SHA1

                            cd6fc1aaa055b2ca630b91cd30b5205f46281f5b

                            SHA256

                            9acbee61b670b9abfb643e1bf1ca125fb480bd84dd361b33ebd0a85b0c3d0b4f

                            SHA512

                            9a162fb1c9aa97661095f84efa79da79071b85ea7856fda5ae2a83b4180e035d40bb8a19518dfbed6a7b5371c0dfedfa2f2ec890277d36bca221338e83aea825

                            Download Submit

                          • C:\Windows\System32\drivers\revoflt.sys
                            Filesize

                            39KB

                            MD5

                            498c3d4d44382a96812a0e0ff28d575b

                            SHA1

                            c34586b789ca5fe4336ab23ad6ff6eeb991c9612

                            SHA256

                            23cb784547268cf775636b07cac4c00b962fd10a7f9144d5d5886a9166919bba

                            SHA512

                            ce450128e9ca1675eab8aa734dc907dfc55f3dacd62503339080d6bd47b2523d063786dbe28e6833db041f1d5869670be2411a39c7b8d93d05a98b4c09cad1a1

                            Download Submit

                          • \??\pipe\LOCAL\crashpad_2792_UWFGMOWJCLXGFLKR
                            MD5

                            d41d8cd98f00b204e9800998ecf8427e

                            SHA1

                            da39a3ee5e6b4b0d3255bfef95601890afd80709

                            SHA256

                            e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                            SHA512

                            cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                            Download Submit

                          • memory/3036-171-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3036-161-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3036-13-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3036-11-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3036-9-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3036-6-0x0000000000400000-0x0000000000540000-memory.dmp

                            Filesize

                            1.2MB

                            Download

                          • memory/3396-167-0x0000000000400000-0x0000000000AE2000-memory.dmp

                            Filesize

                            6.9MB

                            Download

                          • memory/3760-154-0x0000000000400000-0x0000000000AE2000-memory.dmp

                            Filesize

                            6.9MB

                            Download

                          • memory/4920-172-0x0000000000400000-0x000000000043B000-memory.dmp

                            Filesize

                            236KB

                            Download

                          • memory/4920-2-0x0000000000401000-0x0000000000412000-memory.dmp

                            Filesize

                            68KB

                            Download

                          • memory/4920-8-0x0000000000400000-0x000000000043B000-memory.dmp

                            Filesize

                            236KB

                            Download

                          • memory/4920-0-0x0000000000400000-0x000000000043B000-memory.dmp

                            Filesize

                            236KB

                            Download