Overview
overview
8Static
static
3Revo.Unins...le.cmd
windows10-2004-x64
7Revo.Unins...le.cmd
windows11-21h2-x64
7Revo.Unins....5.exe
windows10-2004-x64
8Revo.Unins....5.exe
windows11-21h2-x64
8$EXEDIR/Re...xt.dll
windows10-2004-x64
7$EXEDIR/Re...xt.dll
windows11-21h2-x64
7$EXEDIR/Re...re.cmd
windows10-2004-x64
1$EXEDIR/Re...re.cmd
windows11-21h2-x64
1$EXEDIR/Re...ar.exe
windows10-2004-x64
1$EXEDIR/Re...ar.exe
windows11-21h2-x64
1$EXEDIR/Re...md.exe
windows10-2004-x64
6$EXEDIR/Re...md.exe
windows11-21h2-x64
6$EXEDIR/Re...rp.exe
windows10-2004-x64
1$EXEDIR/Re...rp.exe
windows11-21h2-x64
1$EXEDIR/Re...ro.exe
windows10-2004-x64
6$EXEDIR/Re...ro.exe
windows11-21h2-x64
6$EXEDIR/Re...lt.sys
windows10-2004-x64
1$EXEDIR/Re...lt.sys
windows11-21h2-x64
1$EXEDIR/Re...lt.sys
windows10-2004-x64
1$EXEDIR/Re...lt.sys
windows10-2004-x64
1$EXEDIR/Re...re.cmd
windows10-2004-x64
1$EXEDIR/Re...re.cmd
windows11-21h2-x64
1$PLUGINSDIR/INetC.dll
windows10-2004-x64
3$PLUGINSDIR/INetC.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows11-21h2-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-21h2-x64
3RUExt.dll
windows10-2004-x64
7RUExt.dll
windows11-21h2-x64
7Analysis
- max time kernel
148s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/04/2026, 10:06
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Revo.Uninstaller.Pro.v5.4.5/Crear_portable.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Revo.Uninstaller.Pro.v5.4.5/Crear_portable.cmd
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
Revo.Uninstaller.Pro.v5.4.5/Revo.Uninstaller.Pro.v5.4.5.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral4
Sample
Revo.Uninstaller.Pro.v5.4.5/Revo.Uninstaller.Pro.v5.4.5.exe
Resource
win11-20260130-en
windows11-21h2-x64
16 signatures
150 seconds
Behavioral task
behavioral5
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RUExt.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RUExt.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RUPPrestore.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RUPPrestore.cmd
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoAppBar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoAppBar.exe
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoCmd.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoCmd.exe
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoSrp.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoSrp.exe
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoUnPro.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral16
Sample
$EXEDIR/RevoUninstallerProPortable/x64/RevoUnPro.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
$EXEDIR/RevoUninstallerProPortable/x64/Vista/revoflt.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
$EXEDIR/RevoUninstallerProPortable/x64/Vista/revoflt.sys
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
$EXEDIR/RevoUninstallerProPortable/x64/Win10/revoflt.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
$EXEDIR/RevoUninstallerProPortable/x64/revoflt.sys
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
$EXEDIR/RevoUninstallerProPortable/x86/RUPPrestore.cmd
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
$EXEDIR/RevoUninstallerProPortable/x86/RUPPrestore.cmd
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
$PLUGINSDIR/INetC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral24
Sample
$PLUGINSDIR/INetC.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral27
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral28
Sample
$PLUGINSDIR/nsExec.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
Behavioral task
behavioral31
Sample
RUExt.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral32
Sample
RUExt.dll
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
150 seconds
General
- Target Revo.Uninstaller.Pro.v5.4.5/Revo.Uninstaller.Pro.v5.4.5.exe
- Size 21.1MB
- Sample260429-l4869aev9k
- SHA256 e5d67f902f50caaf4b0fc60d765ae7dce2d2b87ade0e63fe740291b1ad25d298
- MD5 f0fe78ee5bdbae4d7da362c7c1d23d5c
- SHA1 d4270a0b1c39c3dc510d1257a6b30a72caacc31c
- SHA512 72aa4ce8754c1f8f13408fc921e0ee2a332a7fe1cb3079cb698152f948d90af3897c0dd99a1ba6f9ff2e5e3426eea23b72054c8292d232f6c4f630e6154dbf21
- SSDEEP 393216:fOk0MJB2EaIz4T+Qewub3SZ2YlIsUBsbRK9wMvw+RVxZoVi6T20T8kIzOcJOrg16:fX0MD0ItQenbk/dFvMY0roriUkOrg1lA
- TLSH T1F32733624DC4BB9FFE525EFB8F5B5F08B64D1FA88012F627614906E2B012562C93D43B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\SETCBB7.tmp RUNDLL32.EXE File created C:\Windows\system32\DRIVERS\SETCBB7.tmp RUNDLL32.EXE File opened for modification C:\Windows\system32\DRIVERS\revoflt.sys RUNDLL32.EXE File opened for modification C:\Windows\system32\DRIVERS\revoflt.sys RUNDLL32.EXE - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000\Control Panel\International\Geo\Nation ruplp.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 4 IoCs
pid Process 548 RevoUninPro.exe 1912 ruplp.exe 5072 RevoUninPro.exe 1380 ruplp.exe - Loads dropped DLL 14 IoCs
pid Process 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4496 regsvr32.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 2104 regsvr32.exe 1892 regsvr32.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe 4812 Revo.Uninstaller.Pro.v5.4.5.exe - Modifies system executable filetype association 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
flow ioc 19 pastebin.com 20 pastebin.com - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\german.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\russian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovak.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\traditionalchinese.ini Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Revo Uninstaller Pro Help.pdf Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\gujarati.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hellenic.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\japanese.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Uninstall.exe Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoSrp.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\Estonian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\arabic.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoSrp.exe Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bengali.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hrvatski.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\spanish.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUPrestore.cmd Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\finnish.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hungarian.ini Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoAppBar.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\armenian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguesebrazil.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\romanian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoCmd.exe Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\bulgarian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbianLatin.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\License.txt Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUPPrestore.cmd Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\rupilogs.rupldb Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\dutch.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\french.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\korean.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\serbian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\persian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\simplifiedchinese.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\slovenian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\ukrainian.ini Revo.Uninstaller.Pro.v5.4.5.exe File opened for modification C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.del1 Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.inf Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Vista\revoflt.sys Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\azerbaijani.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\norwegian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\reg_lp.bat Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\czech.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\danish.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\hindi.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\italiano.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\polish.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\albanian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\indonesian.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\portuguese_standard.ini Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.sys Revo.Uninstaller.Pro.v5.4.5.exe File created C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUnPro.exe Revo.Uninstaller.Pro.v5.4.5.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\security\logs\scecomp.log RUNDLL32.EXE - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Revo.Uninstaller.Pro.v5.4.5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ruplp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe - Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 runonce.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz runonce.exe - Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1 ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\FLAGS ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\0 ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\HELPDIR ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1D928D64-60D3-4FAC-B810-C4D9D8A680CF}\ = "RUExt" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RUExt.DLL\AppID = "{1D928D64-60D3-4FAC-B810-C4D9D8A680CF}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F} ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\0\win32 ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LicProtector.LicProtectorEXE510\Clsid\ = "{DD72B942-27D2-4A3C-9353-FA0441FBABA0}" ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib\ = "{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\ = "LicProtector Object" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\ProgID\ = "LicProtector.LicProtectorEXE510" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\TypeLib\ = "{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\RUShellExt\ = "{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0} ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LicProtector.LicProtectorEXE510\Clsid ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}\ = "RUShellExt Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\LicProtector.LicProtectorEXE510 ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\HELPDIR\ = "C:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4} ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4} ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\TypeLib ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\ = "LicProtector Library" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib\Version = "5.1" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\LocalServer32 ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\0\win32\ = "C:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\ruplp.exe" ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1D928D64-60D3-4FAC-B810-C4D9D8A680CF} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}\InprocServer32\ = "C:\\Program Files\\VS Revo Group\\Revo Uninstaller Pro\\RUExt.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ = "ILicProtectorEXE510" ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Msi.Package\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ProxyStubClsid32 ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\Version ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RUExt.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1D928D64-60D3-4FAC-B810-C4D9D8A680CF} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}\5.1\FLAGS\ = "0" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ = "ILicProtectorEXE510" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib\ = "{37B86290-9C1A-453F-BFA7-CB6EC9CEC00F}" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\TypeLib\Version = "5.1" ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\LocalServer32\ = "C:\\PROGRA~1\\VSREVO~1\\REVOUN~1\\ruplp.exe" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\RUExt.DLL regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DF91C9-795D-4356-9568-7F149ED299B4}\ProxyStubClsid32 ruplp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\Version\ = "5.1" ruplp.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\RUShellExt regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2C5515DC-2A7E-4BFD-B813-CACC2B685EB7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\LicProtector.LicProtectorEXE510\ = "LicProtector Object" ruplp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD72B942-27D2-4A3C-9353-FA0441FBABA0}\ProgID ruplp.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 548 RevoUninPro.exe 548 RevoUninPro.exe 5072 RevoUninPro.exe 5072 RevoUninPro.exe 5072 RevoUninPro.exe 5072 RevoUninPro.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4812 wrote to memory of 4608 4812 Revo.Uninstaller.Pro.v5.4.5.exe 87 PID 4608 wrote to memory of 2260 4608 RUNDLL32.EXE 88 PID 2260 wrote to memory of 2068 2260 runonce.exe 93 PID 4812 wrote to memory of 4496 4812 Revo.Uninstaller.Pro.v5.4.5.exe 96 PID 4812 wrote to memory of 548 4812 Revo.Uninstaller.Pro.v5.4.5.exe 97 PID 4812 wrote to memory of 1912 4812 Revo.Uninstaller.Pro.v5.4.5.exe 98 PID 4812 wrote to memory of 5072 4812 Revo.Uninstaller.Pro.v5.4.5.exe 100 PID 4812 wrote to memory of 2104 4812 Revo.Uninstaller.Pro.v5.4.5.exe 102 PID 2104 wrote to memory of 1892 2104 regsvr32.exe 103 PID 4812 wrote to memory of 1332 4812 Revo.Uninstaller.Pro.v5.4.5.exe 104 PID 1332 wrote to memory of 1672 1332 RUNDLL32.EXE 105 PID 1672 wrote to memory of 2780 1672 runonce.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\Revo.Uninstaller.Pro.v5.4.5\Revo.Uninstaller.Pro.v5.4.5.exe"C:\Users\Admin\AppData\Local\Temp\Revo.Uninstaller.Pro.v5.4.5\Revo.Uninstaller.Pro.v5.4.5.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Windows\SYSTEM32\RUNDLL32.EXERUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:2068
-
-
-
-
C:\Windows\SYSTEM32\regsvr32.exeregsvr32.exe /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"2⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:4496
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:548
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1912
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s /u "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\system32\regsvr32.exe/s /u "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"3⤵
- Loads dropped DLL
- Modifies system executable filetype association
- Modifies registry class
PID:1892
-
-
-
C:\Windows\SYSTEM32\RUNDLL32.EXERUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf2⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r3⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o4⤵PID:2780
-
-
-
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵PID:1968
-
C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exeC:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1380
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll
- Size 187KB
- SHA256 bda04b693bfdea86a7a3b47f2e4ceae9cd9475c4e81b0aa73b70fd244a65f70f
- MD5 8b9964e06195fd375d126b424e236f03
- SHA1 6f1741cfeb9fb70c34857dbba3e063c88c3c32fa
- SHA512 741019523b4c5f4ef9a7952172309b2d304a84cbd98fff99a719105cc1938157edb1691554a21b9dcd2b523c0f1ab0d37879deefc3b2fa5579c0d8c76cade483
- SSDEEP 3072:7G5lIaj6Zx5+hKTTn6115xx/Nl19oyUBlBN0AZHVf+3S484:7uSDXb67bPng1G1
- TLSH T1D8142857B6A404B7E17B8635C8634A09E7727C912B208BDB0364537A1F733D1AE3BB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe
- Size 24.4MB
- SHA256 401161d26f0cc80e677d9371983df1de283170fc2b9d639b5b023a3b72552a7e
- MD5 c2af1770d7adf7264256ffd6a62618c8
- SHA1 96aa64386a50845f6dae8d7e1026c876c131de3e
- SHA512 e8bc41d49d96933729831114da592619680017d9b3bd6c0fa684663d564330e5e4c0139465700f85f917365e7a4a1c5bacf43ea3d850cb8d8b48d7ef5bfa6802
- SSDEEP 196608:ImACRFnhDErYP61Fw5yd/MYufhvuPTehbmWqPWpyR1pOIIIIIIIIIIIIIIIIIIIo:IaZhDErww0yzqhlqPWpyR1pV2
- TLSH T1C04749B2ED5184CCD92896B5CE1D49FDDEB27C26AFA089AF40143C11EDB32D0AD3D259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\Win10\revoflt.inf
- Size 2KB
- SHA256 084309301ca31fc8384e97b30f0867559fbd20c38772e1ff7573d24bbc1a0833
- MD5 5187ac55870310aff60ed802a729a31a
- SHA1 cea83a2959cfac57c75df6bd9618e71fe9f481ca
- SHA512 70d1c28d87f223ecd93196aeb1c96591095b6a5c41ade2cf11c08182fe872986206706f7bf2f72f44d16803dcf593249872add4724af13ef7bb328a48c6cdb73
- TLSH T10C51BC98CB9795746A8B32535F133CC3BA212004D1F6300836EE85D8D785A5E87B5BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\lang\english.ini
- Size 123KB
- SHA256 e1b61b5502bec66a0bd2a7ec9380bc5ced015537a82ce71c8f791057dac0b0fa
- MD5 004b6d186f14b35532883c6cb191b37f
- SHA1 866ebb8196293cde356f2d080a3cc025062d0903
- SHA512 0ec83ed1624679d985f4bfd51a57c1fa9fbfd4b0f09c2a50f52d496abc8986ac5348e1a6901f06476f20d702beecb8232600cccaa3e57d0874be7ba7928f9ef8
- SSDEEP 1536:QG/KyyIrUp+ihmoqVl4hF7bWwlBB9YK3zZ1lvh:QGiybrVCmoqVlcF2yB0KjX
- TLSH T152C3AC5267F80119F6F77F54AEB506714E77BC9AAD38D64C0280058E2AF1E40E8B277B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.sys
- Size 37KB
- SHA256 25667717bf4691957f07a6363585e2c7eaf22e5fd7229bf32c91ea59ef4a2edd
- MD5 ec8e58e6b58b4fcde77431cda3a24c0e
- SHA1 ebb474009b2a2fbce648adff4b8b797fcd00c997
- SHA512 e2c667ebe97973ff27c1edf3e45ebf7950bc8d7aad1126da25290a2f590b21808654694cbe6a0ad1d3649566ec7645eb6b3379c7d7c0a650d5381a69e9cdade4
- SSDEEP 768:A1uOPkxgu01UuLjQL1nHSSdW7W0fz1Qp33u43gf:AQqk7HL1nO/Qtrgf
- TLSH T1B8037D1B97A410E9D96A85B4CAB5D653BA78F3425720A2CF02B4C1621F73BC0BF3D359
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe
- Size 9.6MB
- SHA256 c6d97857b3b9f26c8e93d7b6e6481f93a16db75cbf9d1756cb29fba0fd9e240e
- MD5 216b49b7eb7be44d7ed7367f3725285f
- SHA1 cf0776ecbc163c738fd43767bedcc2a67acef423
- SHA512 060fb76d91bee1b421f133cae17726a68adc97ddce76a67196d10e735e216d032bee939c905b847c50f29e859dca43cdf1b19e4ae349e00efe88147224d665cb
- SSDEEP 196608:TqWbk1lXrMI8h9rGe2DvwfaycAE9kspvCJ6UkXzp91IIH91IL91I0:Tq2OiI8h8rBx91IW91IL91I0
- TLSH T19BA66E02F3DA503AE0BB5B3A793F96A4593BBE217D36880E26F41D4C0F35780A915767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\VS Revo Group\Revo Uninstaller Pro\revouninstallerpro5.lic
- Size 64KB
- SHA256 fe4bcb4251f77375119a936c80fb36221af0c5105e840e2e115d47f96cb437c8
- MD5 8462a9b69c76a9603a4143d51fbc201e
- SHA1 4473590f93f94f22c340a354516191c3c0ba6532
- SHA512 2f02ecdb06760a093f4d8e6f04c97138695b064db8cb2dcc4af9b47c829852f38b77be9425eb2f3e3e36f85da181c116c829921fa35ae68afc57c728d5393570
- SSDEEP 1536:wg8dvQaFp4zqjLCzkCYlnXMEbnxbiHgsWtXTiKE6AXutI0b:6dvPFHLCzYlnXBUg3TibT+5
- TLSH T170530228A9A1C54FBA5162777E49B42F48BD108D53186CA0C5333BFFE96012272E677E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
- Size 8KB
- SHA256 426a34d8ba9f9e679291623c5fffdc9aae8730855f6384ec8cb56c738978c560
- MD5 d6b5d66c274a29b4153daecaf9197b54
- SHA1 1312cbd477f93683524cf73e601f5d420fed34ef
- SHA512 f541d6f6f91148fe92c14c9dd4481555b263706ed4c135e1353e2fb67317e0faaeb7b26a68abaa5a43d715937c30b9a7477e828ed25fe8616a772d1fa4bc5f79
- SSDEEP 12:MG33RIzX6q0znyiiMM+Q1olfW+oMwiMMIiH:MIAX6ByiiMMfizoMwiMMD
- TLSH T1EAF1E510BBE6040EF7B7A731ACB2C348A77BBC542AB2D24D0111312C1C36A506D10772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse5B0E.tmp\INetC.dll
- Size 238KB
- SHA256 83005624a3c515e8e4454a416693ba0fbf384ff5ea0e1471f520dfae790d4ab7
- MD5 38f2b22967573a872426d05bdc1a1a70
- SHA1 ecae471eb4e515e1006fce645a82b70c8acda451
- SHA512 31bc78bb4efc7c178c2c489b77d890b8806073180fbdd58156907c187cb73b0860701a9a2648da1da4930a8934c9a86b60ea5550315afebe833a681bcb4368e0
- SSDEEP 3072:NFf2FNF6iQraqoDDfbrH6ZgxkzStPpwGxqeujXj5Bif/Pa0A:NFfYCaqoDfb6mxk2LqHXj3if/Pa
- TLSH T14834BF457EA8D80BE65402F87A71CFBA1669EC20AC61C103E7E1BE5F3D79B56BD01381
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse5B0E.tmp\LangDLL.dll
- Size 5KB
- SHA256 4cf25411f28f639f72156c24b0f66ea42f5aee5973f6c137d901da6ae42d5b7e
- MD5 4b8a750993567ac9a350ba9768fabfa0
- SHA1 7ee7a8c313b292d62561b085c9d490c0f8065624
- SHA512 c2a06e352815a2f5340e8244cf2c5a4a5cd7e7848ea67e454ab207262cb33130008491e83d053c778bea97720f7387de737bf15355db3cd5477b94f3571107bb
- SSDEEP 48:S46+/TTKYKxbWsptIp5tCZ0iVEAWyMEv9v/ft2O2B8mkGofjLl:zxuPbO5tCZBVEAWyMEFv2CmqL
- TLSH T171C1A370B3D248B9D591413778AB33D36612AE746784500FDB6311AA3820AE7AD3EBC2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse5B0E.tmp\System.dll
- Size 12KB
- SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
- MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
- SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
- SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
- SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
- TLSH T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse5B0E.tmp\nsDialogs.dll
- Size 9KB
- SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
- MD5 8f0e7415f33843431df308bb8e06af81
- SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
- SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
- SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
- TLSH T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nse5B0E.tmp\nsExec.dll
- Size 7KB
- SHA256 b121689861b506dbc9c3797b49bc8a90d555cb7db58cb959165cc758391c00bb
- MD5 8fe362ffdfa66269b8a64e3a87f68e52
- SHA1 b5daaa60a6b8591a670da9fc3a2d6f896d55f568
- SHA512 8f2904e01b0835683a0f11114a09da291ba527d867e73db2765185f780f2278debd9c5fc4281a42a6065c5ef5947bdc6239ae4c5835df62c71e1fce80d8bf942
- SSDEEP 96:JXzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHnDQ:JgQHDb2vSuOc41ZfUNQZGdHD
- TLSH T1F8E1193571C02DF7E08D89707816BD2F83F4D43627BA05A04A771AD579D0AF6EE28B42
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\VS Revo Group\Revo Uninstaller Pro\logFile.vslog
- Size 322B
- SHA256 f1369a0032a1c259f5f011e7cc6195b5f46abefe265ea9dbaa573b22b656d33e
- MD5 c10a2360222ecdd9d9ff1248766a2e0e
- SHA1 a466eb4ba4a51ce927c14b5514de9cc93b9641ae
- SHA512 513d7fc07798f5ff1f0b63144ec71d849b1b7ad8b02b2a40c7fdf4322b3c861a6406a31688b69d10de6f4036b660518704005f42295dcdb641d84329f4b62256
- TLSH T141E08651C91483B1BBA7630B37405C68EB02102D669B183E18BAC79671AA20D716D6A2
- MD5 SHA1 SHA512 TLSH