top title background image
flash

HDTFFrAXui.exe

Status: finished
Submission Time: 2024-02-20 20:36:08 +01:00
Malicious
Trojan
Spyware
Exploiter
Evader
Glupteba, LummaC Stealer, SmokeLoader, S

Comments

Tags

  • exe
  • Stealc

Details

  • Analysis ID:
    1395624
  • API (Web) ID:
    1395624
  • Original Filename:
    631538d00e2bc894672cbf1bfd02e292.exe
  • Analysis Started:
    2024-02-20 20:36:09 +01:00
  • Analysis Finished:
    2024-02-20 20:53:33 +01:00
  • MD5:
    631538d00e2bc894672cbf1bfd02e292
  • SHA1:
    f1d9860603f0f3ae45af4a8918ca592926f0aa7b
  • SHA256:
    f05c41871e8fddaa793a8ed2f53e8591f236d1a1ca953a759ae702f58a6ae2ae
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 100
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 23/24

IPs

IP Country Detection
104.21.90.246
United States
172.67.200.107
United States
154.41.225.67
United States
Click to see the 97 hidden entries
162.254.39.103
United States
162.254.39.97
United States
188.166.228.84
Netherlands
185.172.128.145
Russian Federation
137.184.188.98
United States
91.184.0.24
Netherlands
173.236.137.240
United States
104.21.51.61
United States
65.181.111.9
United States
5.181.216.223
Germany
154.26.137.109
United States
172.67.160.24
United States
183.111.183.105
Korea Republic of
159.89.39.180
United States
54.248.120.204
United States
144.48.141.48
Hong Kong
195.35.39.46
Germany
77.111.241.68
Denmark
108.167.188.242
United States
162.254.39.114
United States
104.21.36.170
United States
104.21.65.124
United States
89.117.139.172
Lithuania
81.169.186.16
Germany
195.35.39.28
Germany
162.254.39.99
United States
178.33.161.194
France
89.117.157.45
Lithuania
45.132.157.192
Germany
119.18.49.24
India
85.187.128.7
United States
162.241.216.203
United States
162.0.209.203
Canada
103.57.221.26
Viet Nam
192.185.153.237
United States
149.100.151.24
United States
192.232.219.77
United States
168.235.117.42
United States
142.250.72.115
United States
154.41.250.69
United States
104.140.233.6
United States
172.67.158.65
United States
85.209.157.3
Netherlands
3.33.130.190
United States
104.243.32.71
United States
195.179.236.97
Germany
159.65.102.98
United States
173.252.167.20
United States
154.41.250.38
United States
50.87.228.230
United States
103.6.196.50
Malaysia
104.247.165.146
United States
94.73.146.150
Turkey
31.25.91.4
Iran (ISLAMIC Republic Of)
89.117.157.83
Lithuania
217.144.105.212
Iran (ISLAMIC Republic Of)
177.11.54.203
Brazil
106.0.62.81
Bangladesh
109.234.164.188
France
172.67.192.179
United States
172.67.151.105
United States
103.27.132.106
Australia
108.167.172.115
United States
82.180.175.170
Denmark
217.195.207.207
Turkey
50.116.112.43
United States
66.235.200.112
United States
154.49.247.98
United States
103.200.23.98
Viet Nam
192.254.234.101
United States
154.49.142.133
United States
185.213.81.236
Germany
149.100.151.63
United States
208.113.160.168
United States
104.21.33.205
United States
68.178.145.128
United States
162.241.63.91
United States
162.241.216.89
United States
172.67.167.118
United States
163.44.242.9
Japan
217.144.105.207
Iran (ISLAMIC Republic Of)
209.209.113.209
Reserved
94.130.223.106
Germany
217.196.55.115
Norway
174.138.33.236
United States
89.117.169.166
Lithuania
91.203.133.60
Poland
104.21.87.18
United States
104.21.1.122
United States
152.44.37.160
United States
162.241.217.24
United States
104.21.2.55
United States
162.0.209.137
Canada
108.167.156.230
United States
192.249.116.245
United States
185.249.224.85
Germany
103.247.10.93
Indonesia

Domains

Name IP Detection
koidodo.com
172.67.150.182
eimatra.com
104.21.51.61
vizspatial.com
84.32.84.171
Click to see the 97 hidden entries
whasite.xyz
204.93.224.54
maoeigo.com
157.7.107.148
hakansamencicekevi.com
104.247.162.35
www.knightflare.com
104.21.31.224
oobraph.com
185.98.131.198
dclub28.com
109.234.165.186
anzilab.com
129.154.63.25
mobile.sunaviat.com
172.67.221.35
isotrimorphicnongrasse.shop
172.67.189.12
calapco.org
107.180.50.169
jokersl88.com
27.254.86.114
pepereloaded.xyz
154.56.37.26
tomtoyshop.com
172.67.222.96
buyspot.org
104.21.77.203
orosangre.shop
162.254.39.97
adventuregetaway.net
54.36.227.24
lyriclore.com
5.181.216.223
mein-kraeutergarten.de
85.13.137.227
careers-browardhealth.org
104.248.235.107
looh-e-sana.xyz
192.250.239.85
tummyguide.com
103.110.127.102
themakeinc.com
104.21.36.138
sub.teachsteps.com
185.166.188.230
buydict.com
188.166.228.84
theperfectflow.net
172.67.162.47
bsgligman.com
216.246.46.22
homensnobre.site
89.116.58.127
newshd1.xyz
65.181.111.32
toostorage.com
172.67.200.107
simonecosinadvocacia.site
154.41.225.67
betflixox.xyz
128.199.209.98
haven-studios-interiors.com
156.67.72.237
www.imhealthyvending.net
45.32.66.72
www.eventson61.com
173.236.137.240
wearprotec.com
188.208.36.80
sinarbarucanopy.net
156.67.213.58
www.ccigeneraciondeexito.org
208.113.188.134
conuvive.xyz
45.148.121.68
regeneredrops-original.site
154.49.247.5
hcbchem.com
104.21.29.84
belezatotal.site
45.152.44.108
shimido.com
159.69.139.225
chrioimpactministries.org
82.180.153.27
krcarrental.com
45.84.204.223
sxmforever.com
62.210.89.172
mypills.org
154.38.160.122
digitaldesignlabs.net
108.163.242.106
rabestromonline.site
62.72.48.29
friendsofthecaissons.org
137.184.188.98
therajnews.com
89.117.157.230
tinavictor.com
91.184.0.24
dff-pillow.com
65.181.111.9
fantasyfootballnames.org
50.16.223.119
ncommunication.net
83.166.133.58
progressiveslotwins.info
104.21.36.37
kaidao789.xyz
209.97.163.156
futureforwardtech.site
162.254.39.103
sistemah2o.site
154.49.247.249
ssgames350.xyz
178.128.29.232
mon5ter.com
208.109.25.227
bumbber.com
66.97.40.43
www.yatingbest.com
104.21.90.246
triunehubs.com
195.179.236.164
estudiarenelexterior.site
217.21.77.196
homestaythaonguyen.com
103.77.162.18
onthebit.xyz
50.116.112.109
kingkong89.xyz
172.67.191.12
lulamam.com
172.67.195.25
ihighpi.com
159.223.186.51
theromama.com
162.241.24.212
tomato7.com
183.111.183.105
elaroze.com
185.216.140.190
deonwrites.com
67.225.140.197
eposist.com
3.33.130.190
servicescarteidentite.site
185.135.132.53
enzagop.com
93.89.224.212
tabandfab.com
50.87.216.177
thekourage.com
104.21.46.155
lookhaa.com
84.32.84.210
ahdesignercollection.com
66.29.141.57
alarbda.com
172.67.68.73
ventehills.com
104.21.1.122
al1sbot.com
172.67.212.11
referral2u.com
63.142.250.31
booksfor5.com
108.167.181.158
claimys.com
103.193.72.22
loftp14.com
185.201.65.149
chuvanz.com
104.21.49.180
nakamura-medical.net
133.18.79.58
horizonhive.site
104.21.59.35
capsulasdevida.online
84.32.84.32
apollocbdgummies.net
108.167.142.89
mtnpack.com
154.49.245.143
avaliadordepremio.site
154.49.247.75
slickpapers.blog
192.185.36.124
haideko.com
103.131.51.22
cheapestholiday.net
15.197.204.56

URLs

Name Detection
https://fsbling.com/wp-login.php
https://tdhwelfarefoundation.org/wp-login.php
https://enduragolf.com/wp-login.php
Click to see the 97 hidden entries
https://vassglobal.com/wp-login.php
https://www.eamareg.com/wp-login.php
https://bruttsport.com/wp-login.php
https://woodlandstream.net/wp-login.php
https://tilakpurup.com/wp-login.php
https://www.philbillymemorial.info/wp-login.php?redirect_to=https%3A%2F%2Fwww.philbillymemorial.info%2Fwp-admin%2F&reauth=1
https://tojjot.com/wp-login.php
https://100self.com/wp-login.php
https://vietnamcrypto.info/wp-login.php
https://craftodeco.com/wp-login.php
https://newshd1.xyz/wp-login.php
https://www.gloleap.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.gloleap.com%2Fwp-admin%2F&reauth=1
https://formaab.com/wp-login.php
https://bogurabroadband.net/wp-login.php?redirect_to=https%3A%2F%2Fbogurabroadband.net%2Fwp-admin%2F&reauth=1
https://dbvibes.com/wp-login.php
https://noderpa.com/wp-login.php
https://aulia99.com/wp-login.php
https://abnonjakartaolahraga.com/wp-login.php
https://sportz360.xyz/wp-login.php
http://taylorfang.com/wp-login.php
https://techthakur.com/wp-login.php
https://bumbber.com/wp-login.php
https://medicalfinancial.net/wp-login.php
https://crystalgpt.site/wp-login.php
https://eidomod.com/wp-login.php
https://bloomerscreativestudio.com/wp-login.php
https://universityneighbors.org/wp-login.php
https://bukasachiv.com/wp-login.php
http://zenwon.com/wp-login.php
https://dgproducts.site/wp-login.php
https://secnaut.com/wp-login.php
http://maxking195.xyz/wp-login.php
https://www.lrthcanle.shop/wp-login.php?redirect_to=https%3A%2F%2Flrthcanle.shop%2Fwp-admin%2F&reaut
https://djthenoise.com/cgi-sys/suspendedpage.cgi
https://luckyslots777.info/wp-login.phpl
https://puchas.shop/wp-login.phpwp-login.php
https://urbangent-tr.com/wp-login.php
https://taurusd-sign.com/wp-login.php
https://alquilerchaletsalamanca.com/wp-login.php
https://usmaproject.com/wp-login.phpY
https://onthebit.xyz/wp-login.php
https://sashimi-sp.com/wp-admin/css/forms.min.css?ver=6.4.3
http://bahama888.xyz/wp-login.php
https://vietnamcrypto.info/wp-includes/js/dist/vendor/wp-polyfill.min.js?ver=3.15.0
http://185.172.128.127/syncUpd.exe
http://vcyclemetal.com/wp-login.php
https://ultimatesalefinder.site/wp-login.php
https://www.rhinonepal.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.rhinonepal.com%2Fwp-admin%2F&r
http://angipop.com/wp-login.php7D
https://al1sbot.com/wp-login.php?redirect_to=https%3A%2F%2Fal1sbot.com%2Fwp-admin%2F&reauth=11
https://imunify-alert.com/compromised.html?SN=audiolibro.vip&SP=443&RFR=https://audiolibro.vip/wp-login.php&URI=/wp-login.php&cms_name=wordpress&content_title_type=weak_password&version=1
https://vietnamcrypto.info/wp-login.phpp
https://urielhurtado.com/wp-login.php
http://calapco.org/wp-includes/js/dist/vendor/regenerator-runtime.min.js
https://eidomod.com/wp-admin/
https://ssulman.com/wp-login.php?redirect_to=https%3A%2F%2Fssulman.com%2Fwp-admin%2F&reauth=1
https://healthpathwv.com/wp-login.php
https://ccde-ci.com/wp-admin/hCN0
https://ihighpi.com/wp-login.php
https://costurando.site/wp-login.phpta
http://calapco.org/wp-admin/js/user-profile.min.js
http://calapco.org/wp-admin/css/l10n.min.css
https://justundoitx.com/wp-login.php
https://lil5ith.com/wp-login.php
https://www.vincecuffe.com/wp-login.php
http://tnllifestyle.com/wp-login.php
https://tuinge.com/wp-login.phpeD
https://luckyslots777.info/wp-login.phpn.php
http://alliter.top/admin/$90910
https://blaholand.com/wp-login.php
http://ttaviation.info/wp-login.php
https://drly.site/wp-login.php3
https://pogchan.com/wp-login.php
https://d3signplus.com/wp-login.php
https://imunify-alert.com/compromised.html?SN=bukasachiv.com&SP=443&RFR=https://bukasachiv.com/wp-login.php&URI=/wp-login.php&cms_name=wordpress&content_title_type=weak_password&version=1
http://www.imjjmgz.com/administUB
https://tawusacademy.com/wp-login.php
http://ehrcoop.org/wp-login.php
https://humanbackend.com/wp-login.php
https://tomsexcel.com/wp-login.php
https://thebeachcityplace.com/wp-login.php
https://serverkelasluar.info/wp-login.php
https://alarbda.com/wp-admin/css/forms-rtl.min.css?ver=6.4.3
https://audiolibro.vip/wp-login.php&URI=/wp-login.php&cms_name=wordpress&con.
https://imunify-alert.com/compromised.html?SN=master-10.com&SP=443&RFR=https://master-10.com/wp-login.php&URI=/wp-login.php&cms_name=wordpress&content_title_type=weak_password&version=1
https://tamimiksa.com/wp-login.phpp-login.php
https://magictouchmassages.site/wp-login.php
https://propacaaos.site/wp-admin/css/login.min.css?ver=6.4.3
https://theebrook.com/wp-login.php-login.php
https://kfmegastore.com/wp-login.php
https://vietnamcrypto.info/wp-login.php?action=lostpassword
https://weconcernfoundation.org/wp-login.php
https://platinumpages.io/wp-content/uploads/2023/02/cropped-logosm.png
http://footslot7.xyz/wp-login.php
https://newstody.xyz/wp-includes/js/zxcvbn-async.min.js?ver=1.0
https://imunify-alert.com/compromised.html?SN=caffesigns.com&SP=443&RFR=https://caffesigns.com/wp-login.php&URI=/wp-login.php&cms_name=wordpress&content_title_type=weak_password&version=1
https://www.rhinonepal.com/wp-login.php?redirect_to=https%3A%2F%2Fwww.rhinonepal.com%2Fwp-admin%2F&reauth=1

Dropped files

Name File Type Hashes Detection
C:\Users\user\AppData\Local\Temp\E17C.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\freebl3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\mozglue[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
Click to see the 57 hidden entries
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\nss3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\softokn3[1].dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\syncUpd[1].exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\180E.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\256D.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\29F9.exe
PE32 executable (console) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\BC6B.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\BroomSetup.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\C0A2.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\C362.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\D44C.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\zlib1.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\Temp\F34F.exe
PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
#
C:\Users\user\AppData\Local\Temp\FourthX.exe
PE32+ executable (GUI) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\InstallSetup4.exe
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
#
C:\Users\user\AppData\Local\Temp\Protect544cd51a.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-R974I.tmp\_isetup\_iscrypt.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-R974I.tmp\_isetup\_isdecmp.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-R974I.tmp\_isetup\_setup64.tmp
PE32+ executable (console) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-SE0CO.tmp\256D.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\is-TQVCL.tmp\256D.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\nshC33.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\Temp\nsu627.tmp\INetC.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\dgursst
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Roaming\dgursst:Zone.Identifier
ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Roaming\hgursst
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-MKBB6.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\ProgramData\PowerGo 65.0 Build 2191 Essential\PowerGo 65.0 Build 2191 Essential.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\freebl3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\mozglue.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\nss3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\softokn3.dll
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
#
C:\ProgramData\xcfonrchdkar\vueqjgslwynd.exe
PE32+ executable (GUI) x86-64, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\avutil-56.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\cdromemulator.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-0S0HD.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-34PU8.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-5P38V.tmp
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-6EQGA.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-7GVU5.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-HNEPD.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\ProgramData\Drivers\csrss.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-REVVN.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-S2TAF.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-S74SF.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-UAN0R.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\is-VG7RN.tmp
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libbz2-1.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libgcc_s_dw2-1.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libiconv-2.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libogg-0.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libvorbis-0.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libvorbisenc-2.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\libwinpthread-1.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\swresample-3.dll (copy)
PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
#
C:\Users\user\AppData\Local\CD-ROM Emulator\unins000.exe (copy)
PE32 executable (GUI) Intel 80386, for MS Windows
#