bddb3790c81a2f91d30658b1ba27e1d4d3b9125a3f088ef3c0a111712b665369

Analysis

max time kernel
207s
max time network
216s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
28-12-2022 16:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ukeyforandroid_pfnet.exe
Size

63.7MB
MD5

1db98087e77fc77d634378bd664664c0
SHA1

18c2c1261a855eda13c103152382856c83bfea49
SHA256

1a543ff46b91b18902c824961b4f8254abdcfae16b88307ef6f18cc1c3c853bc
SHA512

aea641f6cc25e0f7be120212ddcc382e6d7900fb408b268cc00b818101975b05e667554fffe63d936c11c725140f4f699773f26fbeb6ccf6ccebc47c4790eb50
SSDEEP

1572864:VYPX1r0D2kpjbxEmKKX5LtICj8UdOoKhb+kHnKDty9+ea:VQjmKKViEMlHKU9+ea

Score

8^/10

discovery vmprotect

Malware Config

Signatures

Executes dropped EXE 10 IoCs

pid	Process
1472	4ukeyforandroid_pfnet.tmp
1084	Start.exe
556	PassFabAndroidUnlocker.exe
1964	Monitor.exe
1812	certutil.exe
1680	certutil.exe
696	InstallAndDriver.exe
1660	repair.exe
240	DPInst64.exe
2804	adb.exe

VMProtect packed file 4 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/556-135-0x000000006E760000-0x000000006F27C000-memory.dmp	vmprotect
behavioral1/memory/556-143-0x000000006E760000-0x000000006F27C000-memory.dmp	vmprotect
behavioral1/memory/556-176-0x000000006E760000-0x000000006F27C000-memory.dmp	vmprotect
behavioral1/memory/556-216-0x000000006E760000-0x000000006F27C000-memory.dmp	vmprotect

Loads dropped DLL 64 IoCs

pid	Process
1388	4ukeyforandroid_pfnet.exe
1472	4ukeyforandroid_pfnet.tmp
1472	4ukeyforandroid_pfnet.tmp
1472	4ukeyforandroid_pfnet.tmp
1084	Start.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64\WdfCoInstaller01007.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\SET2CFB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\SET2CFC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\SET8603.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64\WinUSBCoInstaller.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\ssudbus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}\SET93C9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\WinUSBCoInstaller.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\SET8602.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\ssudqcfilter.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}\amd64\SET93CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\android_general.inf_amd64_neutral_ba6d6c70048ad29d\android_general.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ssudadb.inf_amd64_neutral_55cf1c442f8c934e\ssudadb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\SET2CFC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64\SET8614.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64\SET8615.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_neutral_d0ba75672dc1a380\ssudbus.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}\SET93B8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\amd64\SETB7EB.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\amd64\WdfCoInstaller01009.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\amd64\SETB7EC.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\SET91D8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\SET91C5.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\SETB7FD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\SET2D1D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\SET91C6.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\SET91D7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infpub.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\ssudAdb.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ssudadb.inf_amd64_neutral_55cf1c442f8c934e\ssudadb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\android_winusb.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\SET91D8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_neutral_d0ba75672dc1a380\ssudbus.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}\ssudmdm.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\amd64\WinUSBCoInstaller2.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\SETB7FC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\SET2D1E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64\SET8615.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\INFCACHE.0	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\SET91C6.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\amd64\WdfCoInstaller01009.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\android_winusb.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\android_winusb.inf_amd64_neutral_671962066e71f056\android_winusb.PNF	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\SET91D7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{26a05b40-67a7-70e6-9ae2-3c1bf50ae45e}\amd64\ssudbus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{60faf700-9cd3-7839-3286-6f11cc3aad0c}\amd64\SET93CA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstor.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\amd64\SETB7EC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\infstrng.dat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{3818abca-f844-0270-6a02-c1012b692276}\amd64	DrvInst.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
556	PassFabAndroidUnlocker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\x64\SQLite.Interop.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\SoftwareLog.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-0H6TK.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-JDQ3D.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\db\is-DQRM5.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-8JHKH.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\mobiledrv\is-JHIV3.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-core-memory-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-DRS16.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\drivers\amd64\is-G2SN4.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\DPInst64.exe	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\drivers\amd64\winusbcoinstaller2.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-58KUS.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Languages\is-V94J3.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-TFUJS.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\adb\is-2NC1I.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\adb\is-RFN27.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\drivers\x86\is-A1LHO.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-BIIDH.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\mobiledrv\is-HV0EK.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\lib_adb_communcation.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\adk\drivers\amd64\libusbK_x86.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\CommonModule.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-GEJG6.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-OS07M.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-A4QD0.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-5C08V.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\mobiledrv\i386\winusbcoinstaller2.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\adb\AdbWinUsbApi.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-crt-locale-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-processenvironment-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Microsoft.Expression.Drawing.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-1KO53.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-NCB1H.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\drivers\is-663JN.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\galog.json	PassFabAndroidUnlocker.exe
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\msvcp90.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\ucrtbase.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-3FI4P.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\mobiledrv\i386\is-I2QCM.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\DownloadDemo.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\adk\drivers\license\WinUSB\is-7KARC.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\drivers\amd64\is-LHHKP.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\drivers\x86\is-G5I2V.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-6FCVP.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-core-util-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-core-libraryloader-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-GQNJQ.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\CalcHashAB.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-3B1VL.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\mobiledrv\is-KPMHJ.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-localization-l1-2-0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-core-console-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\api-ms-win-core-synch-l1-1-0.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-8F5ME.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-CNMM8.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-B2UUO.tmp	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\drivers\amd64\libusb0.dll	4ukeyforandroid_pfnet.tmp
File opened for modification	C:\Program Files (x86)\PassFab Android Unlocker\adk\drivers\amd64\libusb0_x86.dll	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-687MP.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\Monitor\is-T2A3S.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-3NGD8.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\is-ENU32.tmp	4ukeyforandroid_pfnet.tmp
File created	C:\Program Files (x86)\PassFab Android Unlocker\adk\drivers\x86\is-E1SJP.tmp	4ukeyforandroid_pfnet.tmp

Drops file in Windows directory 25 IoCs

description	ioc	Process
File opened for modification	C:\Windows\certutil.log	certutil.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem6.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DPInst64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem6.inf	DrvInst.exe
File opened for modification	C:\Windows\certutil.log	certutil.exe
File opened for modification	C:\Windows\DPINST.LOG	DPInst64.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\INF\oem5.inf	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
992	NETSTAT.EXE
2760	NETSTAT.EXE
2120	NETSTAT.EXE
1284	NETSTAT.EXE

Kills process with taskkill 8 IoCs

evasion

pid	Process
2496	taskkill.exe
1096	taskkill.exe
2384	taskkill.exe
1544	taskkill.exe
2064	taskkill.exe
1588	taskkill.exe
1168	taskkill.exe
2304	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{437F2E81-86D2-11ED-B51C-6E705F4A26E5} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\PassFabAndroidUnlocker.exe = "1"	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PassFabAndroidUnlocker.exe = "11000"	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\PassFabAndroidUnlocker.exe = "1"	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main	PassFabAndroidUnlocker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION	PassFabAndroidUnlocker.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl	PassFabAndroidUnlocker.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D4DF4A8A5BB991C556072F3113BEBE10A35583E0	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D4DF4A8A5BB991C556072F3113BEBE10A35583E0\Blob = 030000000100000014000000d4df4a8a5bb991c556072f3113bebe10a35583e0200000000100000001020000308201fd3082016aa0030201020210a186c913e087ee9f43699f28bf2137cc300906052b0e03021d05003019311730150603550403130e54656e6f7273686172652e636f6d301e170d3133303731313032343031335a170d3339313233313233353935395a3019311730150603550403130e54656e6f7273686172652e636f6d30819f300d06092a864886f70d010101050003818d00308189028181008f6a7bd58b69fb43f16d70db0fb0cee5f90974b0103a5587e4d6711890611b2b412d20c6911a78774ed0fe8c982ac8ce88c804fc4e37a16921dcd3f2f36b5c73be33225a37134fb1c2685e75bb57ee38bc624e63cef76847cbd3b39764ea3758b29b7ef8ce7918747510cdf65c1e982643ff8490e19749d32e5c976e0976d0030203010001a34e304c304a0603551d010443304180107cdf0b9962a719e978a7f13dfbc01600a11b3019311730150603550403130e54656e6f7273686172652e636f6d8210a186c913e087ee9f43699f28bf2137cc300906052b0e03021d050003818100019ec7e4c8c1c730bea1f326306278bcc03f5eb71d6b498b5cf319af02ec3c7d4ae3aba722a47bc815dda1c5354ea45e432b677d956b0204c819867779b53c8334794d099296e07f11e1e1aafe148773ad043edacebaf91fe6970082828409776aad64588b21417753fbde3cbe9948a7ccd376150107d9dd6db5b07f3e125e10	certutil.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DF4A8A5BB991C556072F3113BEBE10A35583E0	certutil.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\D4DF4A8A5BB991C556072F3113BEBE10A35583E0\Blob = 030000000100000014000000d4df4a8a5bb991c556072f3113bebe10a35583e0200000000100000001020000308201fd3082016aa0030201020210a186c913e087ee9f43699f28bf2137cc300906052b0e03021d05003019311730150603550403130e54656e6f7273686172652e636f6d301e170d3133303731313032343031335a170d3339313233313233353935395a3019311730150603550403130e54656e6f7273686172652e636f6d30819f300d06092a864886f70d010101050003818d00308189028181008f6a7bd58b69fb43f16d70db0fb0cee5f90974b0103a5587e4d6711890611b2b412d20c6911a78774ed0fe8c982ac8ce88c804fc4e37a16921dcd3f2f36b5c73be33225a37134fb1c2685e75bb57ee38bc624e63cef76847cbd3b39764ea3758b29b7ef8ce7918747510cdf65c1e982643ff8490e19749d32e5c976e0976d0030203010001a34e304c304a0603551d010443304180107cdf0b9962a719e978a7f13dfbc01600a11b3019311730150603550403130e54656e6f7273686172652e636f6d8210a186c913e087ee9f43699f28bf2137cc300906052b0e03021d050003818100019ec7e4c8c1c730bea1f326306278bcc03f5eb71d6b498b5cf319af02ec3c7d4ae3aba722a47bc815dda1c5354ea45e432b677d956b0204c819867779b53c8334794d099296e07f11e1e1aafe148773ad043edacebaf91fe6970082828409776aad64588b21417753fbde3cbe9948a7ccd376150107d9dd6db5b07f3e125e10	certutil.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1472	4ukeyforandroid_pfnet.tmp
1472	4ukeyforandroid_pfnet.tmp
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
696	InstallAndDriver.exe
556	PassFabAndroidUnlocker.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe
696	InstallAndDriver.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	1768	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1768	AUDIODG.EXE
Token: 33	1768	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1768	AUDIODG.EXE
Token: SeDebugPrivilege	556	PassFabAndroidUnlocker.exe
Token: SeDebugPrivilege	992	NETSTAT.EXE
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	240	DPInst64.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeRestorePrivilege	1692	rundll32.exe
Token: SeBackupPrivilege	1996	vssvc.exe
Token: SeRestorePrivilege	1996	vssvc.exe
Token: SeAuditPrivilege	1996	vssvc.exe
Token: SeBackupPrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2012	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2220	DrvInst.exe
Token: SeLoadDriverPrivilege	2220	DrvInst.exe
Token: SeLoadDriverPrivilege	2220	DrvInst.exe
Token: SeLoadDriverPrivilege	2220	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2368	DrvInst.exe
Token: SeRestorePrivilege	2388	rundll32.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1472	4ukeyforandroid_pfnet.tmp
1616	iexplore.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe
556	PassFabAndroidUnlocker.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1084	Start.exe
1660	repair.exe
1660	repair.exe
1616	iexplore.exe
1616	iexplore.exe
1128	IEXPLORE.EXE
1128	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1388 wrote to memory of 1472	1388	4ukeyforandroid_pfnet.exe	26
PID 1084 wrote to memory of 556	1084	Start.exe	34
PID 1084 wrote to memory of 556	1084	Start.exe	34
PID 1084 wrote to memory of 556	1084	Start.exe	34
PID 1084 wrote to memory of 556	1084	Start.exe	34
PID 556 wrote to memory of 1964	556	PassFabAndroidUnlocker.exe	35
PID 556 wrote to memory of 1964	556	PassFabAndroidUnlocker.exe	35
PID 556 wrote to memory of 1964	556	PassFabAndroidUnlocker.exe	35
PID 556 wrote to memory of 1964	556	PassFabAndroidUnlocker.exe	35
PID 556 wrote to memory of 1180	556	PassFabAndroidUnlocker.exe	37
PID 556 wrote to memory of 1180	556	PassFabAndroidUnlocker.exe	37
PID 556 wrote to memory of 1180	556	PassFabAndroidUnlocker.exe	37
PID 556 wrote to memory of 1180	556	PassFabAndroidUnlocker.exe	37
PID 1180 wrote to memory of 992	1180	cmd.exe	39
PID 1180 wrote to memory of 992	1180	cmd.exe	39
PID 1180 wrote to memory of 992	1180	cmd.exe	39
PID 1180 wrote to memory of 992	1180	cmd.exe	39
PID 1180 wrote to memory of 956	1180	cmd.exe	40
PID 1180 wrote to memory of 956	1180	cmd.exe	40
PID 1180 wrote to memory of 956	1180	cmd.exe	40
PID 1180 wrote to memory of 956	1180	cmd.exe	40
PID 1180 wrote to memory of 1544	1180	cmd.exe	41
PID 1180 wrote to memory of 1544	1180	cmd.exe	41
PID 1180 wrote to memory of 1544	1180	cmd.exe	41
PID 1180 wrote to memory of 1544	1180	cmd.exe	41
PID 556 wrote to memory of 1812	556	PassFabAndroidUnlocker.exe	42
PID 556 wrote to memory of 1812	556	PassFabAndroidUnlocker.exe	42
PID 556 wrote to memory of 1812	556	PassFabAndroidUnlocker.exe	42
PID 556 wrote to memory of 1812	556	PassFabAndroidUnlocker.exe	42
PID 556 wrote to memory of 1680	556	PassFabAndroidUnlocker.exe	44
PID 556 wrote to memory of 1680	556	PassFabAndroidUnlocker.exe	44
PID 556 wrote to memory of 1680	556	PassFabAndroidUnlocker.exe	44
PID 556 wrote to memory of 1680	556	PassFabAndroidUnlocker.exe	44
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 696	556	PassFabAndroidUnlocker.exe	46
PID 556 wrote to memory of 1616	556	PassFabAndroidUnlocker.exe	48
PID 556 wrote to memory of 1616	556	PassFabAndroidUnlocker.exe	48
PID 556 wrote to memory of 1616	556	PassFabAndroidUnlocker.exe	48
PID 556 wrote to memory of 1616	556	PassFabAndroidUnlocker.exe	48
PID 556 wrote to memory of 1660	556	PassFabAndroidUnlocker.exe	49
PID 556 wrote to memory of 1660	556	PassFabAndroidUnlocker.exe	49
PID 556 wrote to memory of 1660	556	PassFabAndroidUnlocker.exe	49
PID 556 wrote to memory of 1660	556	PassFabAndroidUnlocker.exe	49
PID 1616 wrote to memory of 1128	1616	iexplore.exe	51
PID 1616 wrote to memory of 1128	1616	iexplore.exe	51
PID 1616 wrote to memory of 1128	1616	iexplore.exe	51
PID 1616 wrote to memory of 1128	1616	iexplore.exe	51
PID 556 wrote to memory of 240	556	PassFabAndroidUnlocker.exe	52
PID 556 wrote to memory of 240	556	PassFabAndroidUnlocker.exe	52
PID 556 wrote to memory of 240	556	PassFabAndroidUnlocker.exe	52
PID 556 wrote to memory of 240	556	PassFabAndroidUnlocker.exe	52
PID 2012 wrote to memory of 1692	2012	DrvInst.exe	54
PID 2012 wrote to memory of 1692	2012	DrvInst.exe	54

C:\Users\Admin\AppData\Local\Temp\4ukeyforandroid_pfnet.exe
"C:\Users\Admin\AppData\Local\Temp\4ukeyforandroid_pfnet.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\is-QPVDG.tmp\4ukeyforandroid_pfnet.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QPVDG.tmp\4ukeyforandroid_pfnet.tmp" /SL5="$60120,66268897,575488,C:\Users\Admin\AppData\Local\Temp\4ukeyforandroid_pfnet.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:1472

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Program Files (x86)\PassFab Android Unlocker\Start.exe
"C:\Program Files (x86)\PassFab Android Unlocker\Start.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1084
- C:\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe
  "C:\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:556
- - C:\Program Files (x86)\PassFab Android Unlocker\Monitor\Monitor.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\Monitor\Monitor.exe" 556(#-+)UA-116569081-3(#-+)PassFab Android Unlocker(#-+)2.5.3.2(#-+)&cd1=2.5.3.2&cd2=0&cd3=passfabnet(#-+)1
    3⤵
    - Executes dropped EXE
    PID:1964
- - C:\Windows\SysWOW64\cmd.exe
    /c netstat -ano | findstr "5037" | findstr LISTENING
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1180
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:992
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "5037"
      4⤵
      PID:956
  - - C:\Windows\SysWOW64\findstr.exe
      findstr LISTENING
      4⤵
      PID:1544
- - C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\cert\certutil.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\cert\certutil.exe" -addstore TrustedPublisher TenorshareKey.cer
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:1812
- - C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\cert\certutil.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\cert\certutil.exe" -addstore root TenorshareKey.cer
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Modifies system certificate store
    PID:1680
- - C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\InstallAndDriver.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\InstallAndDriver.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:696
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://cbs.passfab.com/go?pid=2096&a=i&v=2.5.3
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1616 CREDAT:275457 /prefetch:2
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:1128
- - C:\Program Files (x86)\PassFab Android Unlocker\repair.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\repair.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
- - C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\DPInst64.exe
    "C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\DPInst64.exe" /F /D /SW /PATH mobiledrv
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:240
- - C:\Windows\SysWOW64\cmd.exe
    /c netstat -ano | findstr "5037" | findstr LISTENING
    3⤵
    PID:2732
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:2760
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "5037"
      4⤵
      PID:2772
  - - C:\Windows\SysWOW64\findstr.exe
      findstr LISTENING
      4⤵
      PID:2784
- - C:\Program Files (x86)\PassFab Android Unlocker\TS_Android\adb\adb.exe
    adb -L tcp:5037 fork-server server --reply-fd 2204
    3⤵
    - Executes dropped EXE
    PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    /c netstat -ano | findstr "5037" | findstr LISTENING
    3⤵
    PID:3068
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:2120
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "5037"
      4⤵
      PID:1704
  - - C:\Windows\SysWOW64\findstr.exe
      findstr LISTENING
      4⤵
      PID:992
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM fastboot.exe /T
    3⤵
    PID:1184
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM fastboot.exe /T
      4⤵
      Kills process with taskkill
      PID:1544
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM adb.exe /T
    3⤵
    PID:2084
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM adb.exe /T
      4⤵
      Kills process with taskkill
      PID:2064
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM repair.exe /T
    3⤵
    PID:2164
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM repair.exe /T
      4⤵
      Kills process with taskkill
      PID:1588
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM InstallAndDriver.exe /T
    3⤵
    PID:1224
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM InstallAndDriver.exe /T
      4⤵
      Kills process with taskkill
      PID:1168
- - C:\Windows\SysWOW64\cmd.exe
    /c netstat -ano | findstr "5037" | findstr LISTENING
    3⤵
    PID:1100
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      PID:1284
  - - C:\Windows\SysWOW64\findstr.exe
      findstr LISTENING
      4⤵
      PID:2060
  - - C:\Windows\SysWOW64\findstr.exe
      findstr "5037"
      4⤵
      PID:692
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM fastboot.exe /T
    3⤵
    PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM fastboot.exe /T
      4⤵
      Kills process with taskkill
      PID:2304
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM adb.exe /T
    3⤵
    PID:2404
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM adb.exe /T
      4⤵
      Kills process with taskkill
      PID:2496
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM repair.exe /T
    3⤵
    PID:2524
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM repair.exe /T
      4⤵
      Kills process with taskkill
      PID:1096
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C TASKKILL /F /IM InstallAndDriver.exe /T
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /F /IM InstallAndDriver.exe /T
      4⤵
      Kills process with taskkill
      PID:2384

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{6e920e03-1900-7f51-25ef-d90a0e2e706d}\android_general.inf" "9" "6082609b7" "0000000000000540" "WinSta0\Default" "00000000000003D4" "208" "c:\program files (x86)\passfab android unlocker\ts_android\mobiledrv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{7f59ab2c-0540-17e4-3276-6b72a1fa7615} Global\{7eab4ebb-0dd7-7929-3324-fa6d720a9c22} C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\android_general.inf C:\Windows\System32\DriverStore\Temp\{7b9f8974-c978-0d8a-3445-af6782c6c152}\android_general.cat
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1692

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C8" "00000000000005CC"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{667839bf-a58d-6ed3-75bd-1a069d2bc55a}\android_winusb.inf" "9" "6f6be7213" "00000000000003D4" "WinSta0\Default" "0000000000000570" "208" "c:\program files (x86)\passfab android unlocker\ts_android\mobiledrv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2368
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 10 Global\{60bba3d0-50d1-41a7-f896-4f1b3ccac048} Global\{4d53cc54-c102-25fe-e44a-6c1647d49b7c} C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\android_winusb.inf C:\Windows\System32\DriverStore\Temp\{1a0c7c52-b3be-4ff6-c58f-290c60e9d053}\android_winusb.cat
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2388

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot20" "" "" "65dbac317" "0000000000000000" "00000000000005DC" "00000000000003D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2508

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{733235aa-7b15-0d30-61e2-dd367e634d4c}\ssudadb.inf" "9" "6000822cf" "0000000000000570" "WinSta0\Default" "0000000000000318" "208" "c:\program files (x86)\passfab android unlocker\ts_android\mobiledrv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2620

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{05779b75-f047-4b8b-ade5-83144dda2802}\ssudbus.inf" "9" "6798accdb" "0000000000000318" "WinSta0\Default" "0000000000000540" "208" "c:\program files (x86)\passfab android unlocker\ts_android\mobiledrv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2664

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0cde1efb-c0df-70d9-b1ca-5b3189ad1e12}\ssudmdm.inf" "9" "6019b1a4f" "0000000000000540" "WinSta0\Default" "00000000000003D4" "208" "c:\program files (x86)\passfab android unlocker\ts_android\mobiledrv"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PassFab Android Unlocker\AppService.dll

Filesize
221KB

MD5
dbdecbcc732092552b06119b1ce64cea

SHA1
21b61b07a871bae94028b5d94e294a5a3a0a7c6a

SHA256
cc50a3ebac39aab601970c5c1b5f45833bde2ce1b915796e60112024fb9a5edd

SHA512
40086e09309ca1bf34c01703f83e291b3ad96bdd08fa77404749b8c3ec0899d40b22e2ca327c1d39b39ef90f6a654bb4d06771f4f7c1f1cca2e6a8d3d773a203

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\MSVCP140.dll

Filesize
448KB

MD5
21a63075035e3b4f6d409f0523c2342f

SHA1
806c8a556ed67ee47bd8f14b63a31ca5940e7e0b

SHA256
d71ddce485b041881ecce881536da3ac61ae06c2fd233208acae5314f11f0f53

SHA512
3f7aeec57630aebb17cd4f454ed7a0507a8095b88519e0e7a8b9f056daa605da03a89b24d8a664530607cdc3ca352a702a372bfbba441b6b26b63bf619c96d94

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\NetFrameCheck.db

Filesize
10KB

MD5
e7d71bde50dd9d25d6a4bf7a5cdfbae8

SHA1
7ac7951a9094d557740463ff4333e4b46bebb896

SHA256
f05b9b909a7cd15e7a77587b91c6222ef0d086c587c1340456b9feb8082da654

SHA512
177366332b4a70cb4ef1ea43979edd8d5a01fa09f8aa2c1585d3c7dc6d073d1729f48d6cb3b2b27fe767e2cdc966db57b0c42e1ea493394dc08484dd1a92f9cd

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe

Filesize
17.5MB

MD5
1beae9b50210a9ef0a5dc7414d742bdb

SHA1
84496692e6e76fea74f5bf4f7bcc9d74c3a28190

SHA256
07c440fd9ea3662433b46ee22e993600252fd9cdd64733aafbb7266c99b075ed

SHA512
7c425e8ad8e79820f841eb04a49a0fc4e09997115a825e94722bbf223df6fa60b980ff43306734a3c07b2e459505f17fd9d70c759be08f42859c7b574c3e4309

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe

Filesize
17.5MB

MD5
1beae9b50210a9ef0a5dc7414d742bdb

SHA1
84496692e6e76fea74f5bf4f7bcc9d74c3a28190

SHA256
07c440fd9ea3662433b46ee22e993600252fd9cdd64733aafbb7266c99b075ed

SHA512
7c425e8ad8e79820f841eb04a49a0fc4e09997115a825e94722bbf223df6fa60b980ff43306734a3c07b2e459505f17fd9d70c759be08f42859c7b574c3e4309

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe.config

Filesize
3KB

MD5
4a73ace0eb8089ac390dfd9f15244ce7

SHA1
8b86c209eb0192adb61915636cee27f3e65c8cd6

SHA256
60c84c835694ca792bd94115998effa536ab044ccf0ebe3240ebfaff8f648593

SHA512
d5f55ccb3bbbf2900f81dcdd3aff5f312c06558c8fc970cb365435174d65438762cf24b38c560989624bde6126b0e6b15221ddd785ce47c427a8af8f9369bf05

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\RegisterAndLog.dll

Filesize
705KB

MD5
f579cbd456fcf2c80cd02faa42d19979

SHA1
6cf16b71c203333f2ae9bb99ca5d8e7141fef874

SHA256
7639a5d963a6db5462684ee4fb0c8dec315048b01573e8dd8ff1b84822baf4aa

SHA512
5c3c61cfde4e63663484cc44e2e61109573a0dfa77b61f28131c0526cebc7180d16e9fe1e0c8df89cc5d84ba34a6a66bb48408579e41b91ec332492949a103aa

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\Start.exe

Filesize
5.0MB

MD5
6345e59fd03e9473711496209b9e7af6

SHA1
20dd386e8881178a08f8f5337e37774b41a39814

SHA256
59635f9dc0cf52931b6e3cd629da9d292c8e149441850e997159734271a648ed

SHA512
ef43965f12f08c77184f17c2e3d7718db8de21c0f522ad34679175a82124ca39d93cbd9f2f5dadf57637b7fdb42085bbd6dc089f58b25a2cb03cc7c2e2b08e21

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\TS.UI.dll

Filesize
351KB

MD5
abdab48c954afca185adbc44f3e1488d

SHA1
c8d790a1e28edb45e7d0aa44ca8a419c3d56fa4b

SHA256
ae0a44e7d425ef4700958506358aa483667bace2f78a3a5eed87fd34234fc627

SHA512
6c85806f1a039f0589e67c810aafb01167e8eecbb530e712973d463cebabac742dd5323cd369b2078a7ab6f4893edf4bd4141f0b543bf7e189924db09b18a053

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\VCRUNTIME140.dll

Filesize
82KB

MD5
fc4ed7d94cce5f2e7380d9f2bf5a639b

SHA1
21b4b34e7bb0b44c8b868981d183d38aad9a02cd

SHA256
c3cc8cb7528c2b1a245934a0faf9bf161b5c97e8da304113e6ad9b698a3fb29e

SHA512
e62f49127b741870477c384c81b3627283a76c63f9b495d122fc3d3c6ff25b91fd0e57d1fdf7f1502322279bc1232f21a9f63dd27445e4ea571b614785b7cdf8

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
4173f77ed30076fe455d52f074ed5247

SHA1
c4a6645d45bcd7eaf26925c9659b115dac616f9d

SHA256
e1296ec4968e528781d62ed34a8d6154a9ea92d64ddc0014bcdab1d177c2abea

SHA512
30a87b8af89d8bbd034786407b6fd7517585fb7f2d1418bb1574afa64f5f30ef7b380132fc0c00e8f367e3974f02316ee737f0a2c3ae0d3fe38b231eb4f5c4a2

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
1fa9356c2108ff18d32f9684993b9a76

SHA1
152332de7cb7d9e1f465fe71590fff9a13bce01c

SHA256
63bb3b7b067cd3f805731491d4340cb9d4305e243ea084969181d64afea240e6

SHA512
f9f75804df621d53a562849d72b508400df1855c495020c3d8c9cf55a112e486534f0ca131c13a757e0b3c46b79826d810d8e888e3402134c6a7af52cbc286fd

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-localization-l1-2-0.dll

Filesize
22KB

MD5
c8d743baeebc92c8e10b201551d9867f

SHA1
6617e28575e1e32935937a230f1e121c1686025d

SHA256
9d4184fc729364f3f2409923827d3ad997349198ce305f5eec7b8c6e25a4251d

SHA512
c93bba3bdf3843ce9226c8a92a1d58fe6ebdea79fd7c369ce94783a2d995cf73bf70666180e3f5147a9280540ac35c6eeeeaab26e3ef9553602c85ae49f2caa5

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
b81477c7ff3270a928a353aa882ae95d

SHA1
bf44a53739b4896fac1cc2be89a424d6c312b4e6

SHA256
2e984a772007109856c212ad142a1f2ef53cf7223bf94aa89ad56a67b425bf72

SHA512
6f6ce4683836947f65b7eba9902a97a0413fdcb2033cb041808150f76e8f442c70f0b87e24cd8b3c861f3d7f2e1e5a4404f5e6737d3233fbd8a861222f6939cf

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
12ddce6821a32d9f292d974b1b6905b7

SHA1
670ec61423adcff158567b07415ca1725c3220a3

SHA256
dc78ecdf0007316c141cd7cc105784097ea699d8318760e0ffe1173137058c03

SHA512
b32e81a7aa66995dc8dbe09e2deb537b16efae5daff12f206c2b6f29ff19cc1d7be91d647c3fb81aa35714e4822403c8271bb25acd0ed76b7f87925a330db456

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
5d50ed8b1e9f10e3423c4077fa908c77

SHA1
f358acb9036b4dc20cad97da42fffa68a2df4362

SHA256
179fb27191452560141bd8056c3456084c53afe3fd1b16ffa826ebfe64b1f4f3

SHA512
3b623268f629512360017399d7b87471e2cbfea3ef5b4d7a37de5a206ded7146c6f1562363531a28c4a9a8e66b8a1aeb51bc56f03f5f21c5714fc62cd979197c

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
97cb0d7db6a847465bb1dba6f3a3ceae

SHA1
ebe6291fc9f8bff85e8c531b7ff42e9992ab70b4

SHA256
b7ae3b0423c301db475d137d8d414d903e77602f945c18323c46dc2176e790dd

SHA512
a1de7c3c3a3c8df02e4cf0ab61e8c84ceed039c7874fc5ec33eb2c619a9a4e6e3c3f4c246d998b8c3de4b2555138ea8f7eea11bd69ff1df30f622e7ed8d7c05e

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
bdae8ebc76fe06551e9b8c23f220e0fb

SHA1
f785328a5de295ec5209c098cf8285dad6371880

SHA256
4e2b6257f27f510c96fbbd05d6f67ef8b46789441de6801e35541b03582b8e04

SHA512
e9fccf62b4887665f326fee5c45cb8d22e484909582aca43208cd8bab6b250c2c93c727211a57a3c0b616c72889ae8770cba1f18536fa54b70efb922c35ec851

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
22KB

MD5
dcfe82f9159ae24c1c1c515c4b7040e2

SHA1
b0ea456933ccd135b4134fd7ae749df0982bcf04

SHA256
1024d09da946acec478574f2ec4966878e612e393ce44e6587933e6caf97d778

SHA512
141c00cee2d3f39040bb927dd543bd6be8d89dcac7566ca557cc869feb9a37359351808b00bacc0eaef843aabe3c392793df389a629abdf520069693b813d6a1

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
83212ef605549f717409b98e89ede189

SHA1
d024a54b3da0a5748707b6a9b7557d884c1e2bbb

SHA256
d40c6973b651e5f8656000d431b540116ca39b8621ead0987e4fbd2af9f1bed7

SHA512
a04835563751ebb0ba54fec494a7cb330eb9adb7307929d6b93aab771734efdfca518ad0b06ca819da92fa952e99a3859bf3550cef44f9c4fb5225226845d8af

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
9987fbbf3dbc72de9ca4de44ffafd019

SHA1
b929ca2a19a948625e4b8c7c8968a7612e5785c1

SHA256
cf772203ce8f77c94a40d8b495ac4eb947534e058f29a82121a441f7a77e7469

SHA512
7e64cc7ab778b92a11333d3d709415e8d701ad68813530c235c134db15ff00a9923d7860b6f24f74223f0f8af3313fb1b4a5cb556476045062517ca083c69bd8

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-math-l1-1-0.dll

Filesize
30KB

MD5
d0f2ac4536a138d69cc4e8ad4cfa4b5c

SHA1
d28d1da60faad70872f71baf4166d32a75c78006

SHA256
4dd3e2c85e99b63e771999535ccf9d72e07a92d4c75cb542d5a0848c9ca8b372

SHA512
c0cfff8e807c215d7408cf8433cd8532353668003c43e188701c81f7951797f74087d4086af0e69f40ca953088a3af1f53923faade12375006d164413d3d54b3

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
28KB

MD5
612bf244694cdbab3412677b8288a1d6

SHA1
dc5bfa48a4d88b4e9d7596f97c83669ab0da5d6c

SHA256
a2f208ccba5b3a4a76a2b1139fab985bf3862fea4b492bbd1945fd9863e95ee4

SHA512
2fb3434b8d050fc9b47a9dec162bb0e5f89e016e11013a87bea114a65fdfc4408821c84787577e757aa2aa5ed57bbe4c59c3eae4258ebddd6b2b3b8b767e3e30

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
0ba91194979e5ea1f9a501b1baff6f53

SHA1
872b4eb9130a141001ec10d990e4b4dfc18f316e

SHA256
10db369acda71f452ecd136764223a14ad216d44e50aeb1a497b46bda0270d2e

SHA512
be63236385cef30967cda9e012ff4f632a329b0d61912b357931681f977873de4234bcd9297f7093711a6d552c1d1feb1d973bc75fb350f1a1a079bd464c3374

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
26KB

MD5
7d0bf348c1625be8c11a90e5ed6db1f1

SHA1
5d06bbdd9979130874ad0025679b6a6302b400dc

SHA256
f0ef2d16b185eb2d04c17e004a816730ae716c6110204449c5420e3b90c99a20

SHA512
656b69486984d8383793cd5a076f8af75f14104305165574111b9e5f7174a81aaa301ffb271b9a7aa4809505402e0614822d6b8d8c277a00f555cae69434a195

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-string-l1-1-0.dll

Filesize
26KB

MD5
c64276c8b9d566f9cf469c01b195872a

SHA1
8309e673e3ec1622040941c49c9c0160ab6f3680

SHA256
406d1b87e4d229184742aa02cfab0b8bf92037c71631bf722b14b07929052b96

SHA512
39726e58987eae972c865b9129bc38ab60a408621b88248efc8da2d9094fa3dc9569b3b68fe17489ce84aa5ac1b625bbdc5198fa26c1f934322b2b4fff5bb409

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-time-l1-1-0.dll

Filesize
22KB

MD5
051cbe7c107a1671804ec713cf1212b4

SHA1
5a3c50c180f262728e4f9d8adbf830f0a3b0b5aa

SHA256
294cb1f2fd443d3d90db5c0ae86969f28f12ddbc59d69da210153a01be3aa748

SHA512
ce76f433b4e2d4ba780020ebbe197a31c662aec0a04d481fe3f9aa4989f0602b9efbc7f323c2e370808241d31b10f5e2cc5ab77a9ddbe6146917435551454df2

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
09ede3305c24eb7ef66a7ba4728518b7

SHA1
092f4aada7a768f6527c8936c8d63442f34c53f9

SHA256
c1939bb5aece8833a11b4b0f33f51efba525a727b061c878034e86ef80f26fdc

SHA512
ca4e3ac756bdc4a4ef28715965a618a215965204fef5fde98346b86d4b53dd70139fe9a225c9368b2d3d9a68edef860e537d6d4c6820b1ea91a641c980dea2d9

Download Submit
C:\Program Files (x86)\PassFab Android Unlocker\ucrtbase.DLL

Filesize
1.1MB

MD5
cb0d8a420d9cae20846c78a117abfc05

SHA1
59a6c04cbb3931310189a2821a5cdade26ca72c0

SHA256
542f161ba0f77e2de86cd6aee55e05ffd90f5eafaa7f45707a629cb8149de54a

SHA512
0484cc3b1c9cbe882f5a88385b14312ef134f75e61d6ae705248c864697b439de8c31a92602032ccd1d7143cd7f07bb856f72d9f835fa6a05194c9fae7550b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QPVDG.tmp\4ukeyforandroid_pfnet.tmp

Filesize
1.6MB

MD5
a51730585f1f185cf19545624721e4ff

SHA1
e2ca237ab5e7159a742584496310852fdc343864

SHA256
016269baa38d6d9b7076abfb4a6186ab7c1e30dc234daa76d42f181bf36acf1a

SHA512
3e82bbec6698f177ab6b88491e1631163d7ff5c9ab5a0b6c1313428464c30411fcb40d45e7c742a14507cef3c18e7370bff459214bbb37fceff0d77c6fa96f23

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-QPVDG.tmp\4ukeyforandroid_pfnet.tmp

Filesize
1.6MB

MD5
a51730585f1f185cf19545624721e4ff

SHA1
e2ca237ab5e7159a742584496310852fdc343864

SHA256
016269baa38d6d9b7076abfb4a6186ab7c1e30dc234daa76d42f181bf36acf1a

SHA512
3e82bbec6698f177ab6b88491e1631163d7ff5c9ab5a0b6c1313428464c30411fcb40d45e7c742a14507cef3c18e7370bff459214bbb37fceff0d77c6fa96f23

Download Submit
\Program Files (x86)\PassFab Android Unlocker\AppService.dll

Filesize
221KB

MD5
dbdecbcc732092552b06119b1ce64cea

SHA1
21b61b07a871bae94028b5d94e294a5a3a0a7c6a

SHA256
cc50a3ebac39aab601970c5c1b5f45833bde2ce1b915796e60112024fb9a5edd

SHA512
40086e09309ca1bf34c01703f83e291b3ad96bdd08fa77404749b8c3ec0899d40b22e2ca327c1d39b39ef90f6a654bb4d06771f4f7c1f1cca2e6a8d3d773a203

Download Submit
\Program Files (x86)\PassFab Android Unlocker\AppService.dll

Filesize
221KB

MD5
dbdecbcc732092552b06119b1ce64cea

SHA1
21b61b07a871bae94028b5d94e294a5a3a0a7c6a

SHA256
cc50a3ebac39aab601970c5c1b5f45833bde2ce1b915796e60112024fb9a5edd

SHA512
40086e09309ca1bf34c01703f83e291b3ad96bdd08fa77404749b8c3ec0899d40b22e2ca327c1d39b39ef90f6a654bb4d06771f4f7c1f1cca2e6a8d3d773a203

Download Submit
\Program Files (x86)\PassFab Android Unlocker\PassFabAndroidUnlocker.exe

Filesize
17.5MB

MD5
1beae9b50210a9ef0a5dc7414d742bdb

SHA1
84496692e6e76fea74f5bf4f7bcc9d74c3a28190

SHA256
07c440fd9ea3662433b46ee22e993600252fd9cdd64733aafbb7266c99b075ed

SHA512
7c425e8ad8e79820f841eb04a49a0fc4e09997115a825e94722bbf223df6fa60b980ff43306734a3c07b2e459505f17fd9d70c759be08f42859c7b574c3e4309

Download Submit
\Program Files (x86)\PassFab Android Unlocker\RegisterAndLog.dll

Filesize
705KB

MD5
f579cbd456fcf2c80cd02faa42d19979

SHA1
6cf16b71c203333f2ae9bb99ca5d8e7141fef874

SHA256
7639a5d963a6db5462684ee4fb0c8dec315048b01573e8dd8ff1b84822baf4aa

SHA512
5c3c61cfde4e63663484cc44e2e61109573a0dfa77b61f28131c0526cebc7180d16e9fe1e0c8df89cc5d84ba34a6a66bb48408579e41b91ec332492949a103aa

Download Submit
\Program Files (x86)\PassFab Android Unlocker\RegisterAndLog.dll

Filesize
705KB

MD5
f579cbd456fcf2c80cd02faa42d19979

SHA1
6cf16b71c203333f2ae9bb99ca5d8e7141fef874

SHA256
7639a5d963a6db5462684ee4fb0c8dec315048b01573e8dd8ff1b84822baf4aa

SHA512
5c3c61cfde4e63663484cc44e2e61109573a0dfa77b61f28131c0526cebc7180d16e9fe1e0c8df89cc5d84ba34a6a66bb48408579e41b91ec332492949a103aa

Download Submit
\Program Files (x86)\PassFab Android Unlocker\RegisterAndLog.dll

Filesize
705KB

MD5
f579cbd456fcf2c80cd02faa42d19979

SHA1
6cf16b71c203333f2ae9bb99ca5d8e7141fef874

SHA256
7639a5d963a6db5462684ee4fb0c8dec315048b01573e8dd8ff1b84822baf4aa

SHA512
5c3c61cfde4e63663484cc44e2e61109573a0dfa77b61f28131c0526cebc7180d16e9fe1e0c8df89cc5d84ba34a6a66bb48408579e41b91ec332492949a103aa

Download Submit
\Program Files (x86)\PassFab Android Unlocker\Start.exe

Filesize
5.0MB

MD5
6345e59fd03e9473711496209b9e7af6

SHA1
20dd386e8881178a08f8f5337e37774b41a39814

SHA256
59635f9dc0cf52931b6e3cd629da9d292c8e149441850e997159734271a648ed

SHA512
ef43965f12f08c77184f17c2e3d7718db8de21c0f522ad34679175a82124ca39d93cbd9f2f5dadf57637b7fdb42085bbd6dc089f58b25a2cb03cc7c2e2b08e21

Download Submit
\Program Files (x86)\PassFab Android Unlocker\Start.exe

Filesize
5.0MB

MD5
6345e59fd03e9473711496209b9e7af6

SHA1
20dd386e8881178a08f8f5337e37774b41a39814

SHA256
59635f9dc0cf52931b6e3cd629da9d292c8e149441850e997159734271a648ed

SHA512
ef43965f12f08c77184f17c2e3d7718db8de21c0f522ad34679175a82124ca39d93cbd9f2f5dadf57637b7fdb42085bbd6dc089f58b25a2cb03cc7c2e2b08e21

Download Submit
\Program Files (x86)\PassFab Android Unlocker\TS.UI.dll

Filesize
351KB

MD5
abdab48c954afca185adbc44f3e1488d

SHA1
c8d790a1e28edb45e7d0aa44ca8a419c3d56fa4b

SHA256
ae0a44e7d425ef4700958506358aa483667bace2f78a3a5eed87fd34234fc627

SHA512
6c85806f1a039f0589e67c810aafb01167e8eecbb530e712973d463cebabac742dd5323cd369b2078a7ab6f4893edf4bd4141f0b543bf7e189924db09b18a053

Download Submit
\Program Files (x86)\PassFab Android Unlocker\TS.UI.dll

Filesize
351KB

MD5
abdab48c954afca185adbc44f3e1488d

SHA1
c8d790a1e28edb45e7d0aa44ca8a419c3d56fa4b

SHA256
ae0a44e7d425ef4700958506358aa483667bace2f78a3a5eed87fd34234fc627

SHA512
6c85806f1a039f0589e67c810aafb01167e8eecbb530e712973d463cebabac742dd5323cd369b2078a7ab6f4893edf4bd4141f0b543bf7e189924db09b18a053

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-file-l1-2-0.dll

Filesize
20KB

MD5
4173f77ed30076fe455d52f074ed5247

SHA1
c4a6645d45bcd7eaf26925c9659b115dac616f9d

SHA256
e1296ec4968e528781d62ed34a8d6154a9ea92d64ddc0014bcdab1d177c2abea

SHA512
30a87b8af89d8bbd034786407b6fd7517585fb7f2d1418bb1574afa64f5f30ef7b380132fc0c00e8f367e3974f02316ee737f0a2c3ae0d3fe38b231eb4f5c4a2

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-file-l2-1-0.dll

Filesize
20KB

MD5
1fa9356c2108ff18d32f9684993b9a76

SHA1
152332de7cb7d9e1f465fe71590fff9a13bce01c

SHA256
63bb3b7b067cd3f805731491d4340cb9d4305e243ea084969181d64afea240e6

SHA512
f9f75804df621d53a562849d72b508400df1855c495020c3d8c9cf55a112e486534f0ca131c13a757e0b3c46b79826d810d8e888e3402134c6a7af52cbc286fd

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-localization-l1-2-0.dll

Filesize
22KB

MD5
c8d743baeebc92c8e10b201551d9867f

SHA1
6617e28575e1e32935937a230f1e121c1686025d

SHA256
9d4184fc729364f3f2409923827d3ad997349198ce305f5eec7b8c6e25a4251d

SHA512
c93bba3bdf3843ce9226c8a92a1d58fe6ebdea79fd7c369ce94783a2d995cf73bf70666180e3f5147a9280540ac35c6eeeeaab26e3ef9553602c85ae49f2caa5

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-processthreads-l1-1-1.dll

Filesize
20KB

MD5
b81477c7ff3270a928a353aa882ae95d

SHA1
bf44a53739b4896fac1cc2be89a424d6c312b4e6

SHA256
2e984a772007109856c212ad142a1f2ef53cf7223bf94aa89ad56a67b425bf72

SHA512
6f6ce4683836947f65b7eba9902a97a0413fdcb2033cb041808150f76e8f442c70f0b87e24cd8b3c861f3d7f2e1e5a4404f5e6737d3233fbd8a861222f6939cf

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-synch-l1-2-0.dll

Filesize
20KB

MD5
12ddce6821a32d9f292d974b1b6905b7

SHA1
670ec61423adcff158567b07415ca1725c3220a3

SHA256
dc78ecdf0007316c141cd7cc105784097ea699d8318760e0ffe1173137058c03

SHA512
b32e81a7aa66995dc8dbe09e2deb537b16efae5daff12f206c2b6f29ff19cc1d7be91d647c3fb81aa35714e4822403c8271bb25acd0ed76b7f87925a330db456

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-core-timezone-l1-1-0.dll

Filesize
20KB

MD5
5d50ed8b1e9f10e3423c4077fa908c77

SHA1
f358acb9036b4dc20cad97da42fffa68a2df4362

SHA256
179fb27191452560141bd8056c3456084c53afe3fd1b16ffa826ebfe64b1f4f3

SHA512
3b623268f629512360017399d7b87471e2cbfea3ef5b4d7a37de5a206ded7146c6f1562363531a28c4a9a8e66b8a1aeb51bc56f03f5f21c5714fc62cd979197c

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-convert-l1-1-0.dll

Filesize
24KB

MD5
97cb0d7db6a847465bb1dba6f3a3ceae

SHA1
ebe6291fc9f8bff85e8c531b7ff42e9992ab70b4

SHA256
b7ae3b0423c301db475d137d8d414d903e77602f945c18323c46dc2176e790dd

SHA512
a1de7c3c3a3c8df02e4cf0ab61e8c84ceed039c7874fc5ec33eb2c619a9a4e6e3c3f4c246d998b8c3de4b2555138ea8f7eea11bd69ff1df30f622e7ed8d7c05e

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-environment-l1-1-0.dll

Filesize
20KB

MD5
bdae8ebc76fe06551e9b8c23f220e0fb

SHA1
f785328a5de295ec5209c098cf8285dad6371880

SHA256
4e2b6257f27f510c96fbbd05d6f67ef8b46789441de6801e35541b03582b8e04

SHA512
e9fccf62b4887665f326fee5c45cb8d22e484909582aca43208cd8bab6b250c2c93c727211a57a3c0b616c72889ae8770cba1f18536fa54b70efb922c35ec851

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-filesystem-l1-1-0.dll

Filesize
22KB

MD5
dcfe82f9159ae24c1c1c515c4b7040e2

SHA1
b0ea456933ccd135b4134fd7ae749df0982bcf04

SHA256
1024d09da946acec478574f2ec4966878e612e393ce44e6587933e6caf97d778

SHA512
141c00cee2d3f39040bb927dd543bd6be8d89dcac7566ca557cc869feb9a37359351808b00bacc0eaef843aabe3c392793df389a629abdf520069693b813d6a1

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-heap-l1-1-0.dll

Filesize
21KB

MD5
83212ef605549f717409b98e89ede189

SHA1
d024a54b3da0a5748707b6a9b7557d884c1e2bbb

SHA256
d40c6973b651e5f8656000d431b540116ca39b8621ead0987e4fbd2af9f1bed7

SHA512
a04835563751ebb0ba54fec494a7cb330eb9adb7307929d6b93aab771734efdfca518ad0b06ca819da92fa952e99a3859bf3550cef44f9c4fb5225226845d8af

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-locale-l1-1-0.dll

Filesize
20KB

MD5
9987fbbf3dbc72de9ca4de44ffafd019

SHA1
b929ca2a19a948625e4b8c7c8968a7612e5785c1

SHA256
cf772203ce8f77c94a40d8b495ac4eb947534e058f29a82121a441f7a77e7469

SHA512
7e64cc7ab778b92a11333d3d709415e8d701ad68813530c235c134db15ff00a9923d7860b6f24f74223f0f8af3313fb1b4a5cb556476045062517ca083c69bd8

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-math-l1-1-0.dll

Filesize
30KB

MD5
d0f2ac4536a138d69cc4e8ad4cfa4b5c

SHA1
d28d1da60faad70872f71baf4166d32a75c78006

SHA256
4dd3e2c85e99b63e771999535ccf9d72e07a92d4c75cb542d5a0848c9ca8b372

SHA512
c0cfff8e807c215d7408cf8433cd8532353668003c43e188701c81f7951797f74087d4086af0e69f40ca953088a3af1f53923faade12375006d164413d3d54b3

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-multibyte-l1-1-0.dll

Filesize
28KB

MD5
612bf244694cdbab3412677b8288a1d6

SHA1
dc5bfa48a4d88b4e9d7596f97c83669ab0da5d6c

SHA256
a2f208ccba5b3a4a76a2b1139fab985bf3862fea4b492bbd1945fd9863e95ee4

SHA512
2fb3434b8d050fc9b47a9dec162bb0e5f89e016e11013a87bea114a65fdfc4408821c84787577e757aa2aa5ed57bbe4c59c3eae4258ebddd6b2b3b8b767e3e30

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-runtime-l1-1-0.dll

Filesize
24KB

MD5
0ba91194979e5ea1f9a501b1baff6f53

SHA1
872b4eb9130a141001ec10d990e4b4dfc18f316e

SHA256
10db369acda71f452ecd136764223a14ad216d44e50aeb1a497b46bda0270d2e

SHA512
be63236385cef30967cda9e012ff4f632a329b0d61912b357931681f977873de4234bcd9297f7093711a6d552c1d1feb1d973bc75fb350f1a1a079bd464c3374

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-stdio-l1-1-0.dll

Filesize
26KB

MD5
7d0bf348c1625be8c11a90e5ed6db1f1

SHA1
5d06bbdd9979130874ad0025679b6a6302b400dc

SHA256
f0ef2d16b185eb2d04c17e004a816730ae716c6110204449c5420e3b90c99a20

SHA512
656b69486984d8383793cd5a076f8af75f14104305165574111b9e5f7174a81aaa301ffb271b9a7aa4809505402e0614822d6b8d8c277a00f555cae69434a195

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-string-l1-1-0.dll

Filesize
26KB

MD5
c64276c8b9d566f9cf469c01b195872a

SHA1
8309e673e3ec1622040941c49c9c0160ab6f3680

SHA256
406d1b87e4d229184742aa02cfab0b8bf92037c71631bf722b14b07929052b96

SHA512
39726e58987eae972c865b9129bc38ab60a408621b88248efc8da2d9094fa3dc9569b3b68fe17489ce84aa5ac1b625bbdc5198fa26c1f934322b2b4fff5bb409

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-time-l1-1-0.dll

Filesize
22KB

MD5
051cbe7c107a1671804ec713cf1212b4

SHA1
5a3c50c180f262728e4f9d8adbf830f0a3b0b5aa

SHA256
294cb1f2fd443d3d90db5c0ae86969f28f12ddbc59d69da210153a01be3aa748

SHA512
ce76f433b4e2d4ba780020ebbe197a31c662aec0a04d481fe3f9aa4989f0602b9efbc7f323c2e370808241d31b10f5e2cc5ab77a9ddbe6146917435551454df2

Download Submit
\Program Files (x86)\PassFab Android Unlocker\api-ms-win-crt-utility-l1-1-0.dll

Filesize
20KB

MD5
09ede3305c24eb7ef66a7ba4728518b7

SHA1
092f4aada7a768f6527c8936c8d63442f34c53f9

SHA256
c1939bb5aece8833a11b4b0f33f51efba525a727b061c878034e86ef80f26fdc

SHA512
ca4e3ac756bdc4a4ef28715965a618a215965204fef5fde98346b86d4b53dd70139fe9a225c9368b2d3d9a68edef860e537d6d4c6820b1ea91a641c980dea2d9

Download Submit
\Program Files (x86)\PassFab Android Unlocker\msvcp140.dll

Filesize
448KB

MD5
21a63075035e3b4f6d409f0523c2342f

SHA1
806c8a556ed67ee47bd8f14b63a31ca5940e7e0b

SHA256
d71ddce485b041881ecce881536da3ac61ae06c2fd233208acae5314f11f0f53

SHA512
3f7aeec57630aebb17cd4f454ed7a0507a8095b88519e0e7a8b9f056daa605da03a89b24d8a664530607cdc3ca352a702a372bfbba441b6b26b63bf619c96d94

Download Submit
\Program Files (x86)\PassFab Android Unlocker\ucrtbase.dll

Filesize
1.1MB

MD5
cb0d8a420d9cae20846c78a117abfc05

SHA1
59a6c04cbb3931310189a2821a5cdade26ca72c0

SHA256
542f161ba0f77e2de86cd6aee55e05ffd90f5eafaa7f45707a629cb8149de54a

SHA512
0484cc3b1c9cbe882f5a88385b14312ef134f75e61d6ae705248c864697b439de8c31a92602032ccd1d7143cd7f07bb856f72d9f835fa6a05194c9fae7550b6a

Download Submit
\Program Files (x86)\PassFab Android Unlocker\unins000.exe

Filesize
1.6MB

MD5
a51730585f1f185cf19545624721e4ff

SHA1
e2ca237ab5e7159a742584496310852fdc343864

SHA256
016269baa38d6d9b7076abfb4a6186ab7c1e30dc234daa76d42f181bf36acf1a

SHA512
3e82bbec6698f177ab6b88491e1631163d7ff5c9ab5a0b6c1313428464c30411fcb40d45e7c742a14507cef3c18e7370bff459214bbb37fceff0d77c6fa96f23

Download Submit
\Program Files (x86)\PassFab Android Unlocker\vcruntime140.dll

Filesize
82KB

MD5
fc4ed7d94cce5f2e7380d9f2bf5a639b

SHA1
21b4b34e7bb0b44c8b868981d183d38aad9a02cd

SHA256
c3cc8cb7528c2b1a245934a0faf9bf161b5c97e8da304113e6ad9b698a3fb29e

SHA512
e62f49127b741870477c384c81b3627283a76c63f9b495d122fc3d3c6ff25b91fd0e57d1fdf7f1502322279bc1232f21a9f63dd27445e4ea571b614785b7cdf8

Download Submit
\Users\Admin\AppData\Local\Temp\is-QPVDG.tmp\4ukeyforandroid_pfnet.tmp

Filesize
1.6MB

MD5
a51730585f1f185cf19545624721e4ff

SHA1
e2ca237ab5e7159a742584496310852fdc343864

SHA256
016269baa38d6d9b7076abfb4a6186ab7c1e30dc234daa76d42f181bf36acf1a

SHA512
3e82bbec6698f177ab6b88491e1631163d7ff5c9ab5a0b6c1313428464c30411fcb40d45e7c742a14507cef3c18e7370bff459214bbb37fceff0d77c6fa96f23

Download Submit
memory/556-166-0x000000000AC80000-0x000000000AF68000-memory.dmp

Filesize
2.9MB

Download
memory/556-150-0x0000000005B10000-0x0000000005B1A000-memory.dmp

Filesize
40KB

Download
memory/556-219-0x0000000005C29000-0x0000000005C2E000-memory.dmp

Filesize
20KB

Download
memory/556-217-0x0000000005C09000-0x0000000005C11000-memory.dmp

Filesize
32KB

Download
memory/556-78-0x0000000001310000-0x0000000002498000-memory.dmp

Filesize
17.5MB

Download
memory/556-216-0x000000006E760000-0x000000006F27C000-memory.dmp

Filesize
11.1MB

Download
memory/556-191-0x0000000007990000-0x00000000079BE000-memory.dmp

Filesize
184KB

Download
memory/556-182-0x0000000005C29000-0x0000000005C2E000-memory.dmp

Filesize
20KB

Download
memory/556-181-0x0000000005DE0000-0x0000000005DEA000-memory.dmp

Filesize
40KB

Download
memory/556-79-0x000000000C550000-0x000000000D79C000-memory.dmp

Filesize
18.3MB

Download
memory/556-83-0x0000000000310000-0x000000000034C000-memory.dmp

Filesize
240KB

Download
memory/556-180-0x0000000005C15000-0x0000000005C26000-memory.dmp

Filesize
68KB

Download
memory/556-179-0x0000000005C09000-0x0000000005C11000-memory.dmp

Filesize
32KB

Download
memory/556-135-0x000000006E760000-0x000000006F27C000-memory.dmp

Filesize
11.1MB

Download
memory/556-139-0x0000000000BF0000-0x0000000000C03000-memory.dmp

Filesize
76KB

Download
memory/556-138-0x0000000000B70000-0x0000000000B82000-memory.dmp

Filesize
72KB

Download
memory/556-141-0x000000000DCF0000-0x000000000DD99000-memory.dmp

Filesize
676KB

Download
memory/556-142-0x00000000058A0000-0x00000000058B0000-memory.dmp

Filesize
64KB

Download
memory/556-143-0x000000006E760000-0x000000006F27C000-memory.dmp

Filesize
11.1MB

Download
memory/556-170-0x0000000005C29000-0x0000000005C2E000-memory.dmp

Filesize
20KB

Download
memory/556-145-0x0000000005900000-0x0000000005946000-memory.dmp

Filesize
280KB

Download
memory/556-146-0x000000000D7E0000-0x000000000D81E000-memory.dmp

Filesize
248KB

Download
memory/556-148-0x0000000005C15000-0x0000000005C26000-memory.dmp

Filesize
68KB

Download
memory/556-147-0x0000000005C09000-0x0000000005C11000-memory.dmp

Filesize
32KB

Download
memory/556-149-0x0000000005A50000-0x0000000005AA4000-memory.dmp

Filesize
336KB

Download
memory/556-91-0x0000000007C40000-0x0000000007CF0000-memory.dmp

Filesize
704KB

Download
memory/556-151-0x0000000005B30000-0x0000000005B59000-memory.dmp

Filesize
164KB

Download
memory/556-178-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Filesize
64KB

Download
memory/556-153-0x0000000005EF0000-0x0000000005F84000-memory.dmp

Filesize
592KB

Download
memory/556-154-0x0000000007890000-0x0000000007936000-memory.dmp

Filesize
664KB

Download
memory/556-155-0x0000000008230000-0x00000000082E0000-memory.dmp

Filesize
704KB

Download
memory/556-156-0x0000000005DE0000-0x0000000005DEA000-memory.dmp

Filesize
40KB

Download
memory/556-177-0x0000000007A80000-0x0000000007AA0000-memory.dmp

Filesize
128KB

Download
memory/556-176-0x000000006E760000-0x000000006F27C000-memory.dmp

Filesize
11.1MB

Download
memory/556-175-0x0000000009D40000-0x0000000009DA2000-memory.dmp

Filesize
392KB

Download
memory/556-218-0x0000000005C15000-0x0000000005C26000-memory.dmp

Filesize
68KB

Download
memory/556-144-0x00000000058F0000-0x00000000058F6000-memory.dmp

Filesize
24KB

Download
memory/556-164-0x00000000060F0000-0x0000000006106000-memory.dmp

Filesize
88KB

Download
memory/556-87-0x00000000006E0000-0x000000000073A000-memory.dmp

Filesize
360KB

Download
memory/960-69-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1388-61-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1388-54-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1388-55-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1388-68-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1388-64-0x0000000000400000-0x0000000000496000-memory.dmp

Filesize
600KB

Download
memory/1472-62-0x0000000074CD1000-0x0000000074CD3000-memory.dmp

Filesize
8KB

Download