Uninstall request carries an identifier matching local registry state
A signed uninstaller sent an uninstall-start request with an identifier that matched a registry value recorded in the same sandbox analysis. The match helps explain the destination as a product-event reporting endpoint, though the evidence does not establish how the identifier was obtained or show a command-and-control exchange.
A signed uninst.exe sent an HTTP request announcing type=uninstall&action=start&app=c_disk_clean. The request also carried an opaque identifier that exactly matched a value recorded in the Windows registry during the same sandbox analysis. That combination raises a more useful question than whether the executable contacted the internet: what local state was being represented in the uninstall report, and how does that help explain the destination’s role?
Members-only article
This story is members-only. Sign in to read the full body, indicators of compromise, and VirusTotal context.
Sign in to read