bc4e220b7539888116beeb5b74bb51cff311d7e1eb859f92ca7f778d605031a1

Analysis

max time kernel
210s
max time network
187s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 17:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4kvideodownloaderplus_1.4.3_x64_online.exe
Size

912KB
MD5

7d976b0df489feb93c55810c5912c266
SHA1

8a0be0a217324ff559ec3c46a400af401f91dccf
SHA256

bc4e220b7539888116beeb5b74bb51cff311d7e1eb859f92ca7f778d605031a1
SHA512

859167c3c78812b3cf97629fdf34a2774ff5412baaa0f118898e5cfc9657fdbd510442d92898d9022dc5d6ae073bb488363d88187c772a56e9756e238b669213
SSDEEP

24576:uNsfiTdYSuVzZH9tH1v1J3W3ZtxEVFxu5Bi5:eT2pZ1J3WpHEV4M

Score

6^/10

discovery persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25} = "\"C:\\ProgramData\\Package Cache\\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\\4kvideodownloaderplus_1.4.3_x64_online.exe\" /burn.runonce"	4kvideodownloaderplus_1.4.3_x64_online.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
11	2732	msiexec.exe
13	2732	msiexec.exe
15	2732	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\private\FastMaskedBlur.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Desktop\ScrollViewStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\BasicTableViewStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\spinner_medium.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQml\Models.2\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWinExtras\JumpListLink.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\[email protected]	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\ta.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\kn.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Switch.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\RadialGradient.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\BusyIndicator.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt\labs\platform\qtlabsplatformplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5QmlModels.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\fil.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Qml.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5Concurrent.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\imageformats\qgif.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Calendar.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\TextField.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt\labs\platform\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\el.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\MenuItem.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\scrollbar-handle-transient.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\SwipeView.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\tab.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\thirdparty.txt	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\ButtonGroup.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\PromptDialog.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\crashpad_handler.exe	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5WinExtras.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\ScrollBar.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\te.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\Menu.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtGraphicalEffects\plugins.qmltypes	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Action.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\RadioButton.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\AuthenticationDialog.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\ComboBoxStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5QuickWidgets.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls2Delegates\question.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\th.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Container.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\HandleStyle.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Flat\qtquickextrasflatplugin.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\ToolButton.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\ScrollViewHelper.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\TextInputWithHandles.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWebEngine\Controls1Delegates\ConfirmDialog.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\scrollbar-handle-horizontal.png	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\Qt5WebEngineWidgets.dll	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_locales\am.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\images\[email protected]	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\ProgressBar.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\ColumnMenuContent.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Private\CalendarHeaderModel.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\Control.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\qtwebengine_resources.pak	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\SpinBox.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtWinExtras\qmldir	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\TextField.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls.2\AbstractButton.qml	msiexec.exe
File created	C:\Program Files\4KDownload\4kvideodownloaderplus\QtQuick\Controls\Styles\Base\CircularButtonStyle.qml	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f77559f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA138.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7228.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI79D9.tmp	msiexec.exe
File opened for modification	C:\Windows\WindowsUpdate.log	4kvideodownloaderplus_1.4.3_x64_online.exe
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f77559f.msi	msiexec.exe
File created	C:\Windows\Installer\f7755a2.ipi	msiexec.exe
File created	C:\Windows\Installer\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\f7755a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI72A6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f7755a2.ipi	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2200	4kvideodownloaderplus_1.4.3_x64_online.exe
2564	4kvideodownloaderplus_1.4.3_x64_online.exe

Loads dropped DLL 12 IoCs

pid	Process
1932	4kvideodownloaderplus_1.4.3_x64_online.exe
2200	4kvideodownloaderplus_1.4.3_x64_online.exe
2200	4kvideodownloaderplus_1.4.3_x64_online.exe
888	MsiExec.exe
2656	MsiExec.exe
2732	msiexec.exe
2732	msiexec.exe
1224	Process not Found
1224	Process not Found
1224	Process not Found
1224	Process not Found
888	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\ = "{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\PackageCode = "8C7BA36928FAB6D48B67791AA73B215D"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A0DD6B5535352E4082B644C603BE688\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}v1.4.3.0060\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\Dependents	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\ProductName = "4K Video Downloader+"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\ProductIcon = "C:\\Windows\\Installer\\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\\icon.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\PackageName = "4kvideodownloaderplus_1.4.3_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media\2 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}	4kvideodownloaderplus_1.4.3_x64_online.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\ = "{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\Version = "1.4.3.60"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5C8A82B669AA6C54A92A7EEAC55C70F7\Complete	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\DisplayName = "4K Video Downloader+"	4kvideodownloaderplus_1.4.3_x64_online.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Version = "17039363"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}v1.4.3.0060\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\Dependents\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A0DD6B5535352E4082B644C603BE688	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\Dependents\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}	4kvideodownloaderplus_1.4.3_x64_online.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{7d3c6ff9-c3c5-4635-a48d-a8f29700cc25}\Dependents	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\Version = "1.4.3.0060"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{6B28A8C5-AA96-45C6-9AA2-E7AE5CC5077F}\DisplayName = "4K Video Downloader+"	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5C8A82B669AA6C54A92A7EEAC55C70F7\SourceList\Media	msiexec.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	4kvideodownloaderplus_1.4.3_x64_online.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	4kvideodownloaderplus_1.4.3_x64_online.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2732	msiexec.exe
2732	msiexec.exe
888	MsiExec.exe
888	MsiExec.exe
2656	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeBackupPrivilege	2940	vssvc.exe
Token: SeRestorePrivilege	2940	vssvc.exe
Token: SeAuditPrivilege	2940	vssvc.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeRestorePrivilege	1496	DrvInst.exe
Token: SeLoadDriverPrivilege	1496	DrvInst.exe
Token: SeLoadDriverPrivilege	1496	DrvInst.exe
Token: SeLoadDriverPrivilege	1496	DrvInst.exe
Token: SeShutdownPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncreaseQuotaPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeSecurityPrivilege	2732	msiexec.exe
Token: SeCreateTokenPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeAssignPrimaryTokenPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeLockMemoryPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncreaseQuotaPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeMachineAccountPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeTcbPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSecurityPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeTakeOwnershipPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeLoadDriverPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemProfilePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemtimePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeProfSingleProcessPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeIncBasePriorityPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreatePagefilePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreatePermanentPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeBackupPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRestorePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeShutdownPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeDebugPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeAuditPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSystemEnvironmentPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeChangeNotifyPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRemoteShutdownPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeUndockPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeSyncAgentPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeEnableDelegationPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeManageVolumePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeImpersonatePrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeCreateGlobalPrivilege	2564	4kvideodownloaderplus_1.4.3_x64_online.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe
Token: SeTakeOwnershipPrivilege	2732	msiexec.exe
Token: SeRestorePrivilege	2732	msiexec.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2200	4kvideodownloaderplus_1.4.3_x64_online.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 1932 wrote to memory of 2200	1932	4kvideodownloaderplus_1.4.3_x64_online.exe	28
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2200 wrote to memory of 2564	2200	4kvideodownloaderplus_1.4.3_x64_online.exe	29
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 888	2732	msiexec.exe	39
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40
PID 2732 wrote to memory of 2656	2732	msiexec.exe	40

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe
"C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932
- C:\Windows\Temp\{D116567B-FDCA-4CC7-8879-34A3A102BC46}\.cr\4kvideodownloaderplus_1.4.3_x64_online.exe
  "C:\Windows\Temp\{D116567B-FDCA-4CC7-8879-34A3A102BC46}\.cr\4kvideodownloaderplus_1.4.3_x64_online.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\4kvideodownloaderplus_1.4.3_x64_online.exe" -burn.filehandle.attached=180 -burn.filehandle.self=188
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies system certificate store
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\Temp\{77D6DB75-5133-4925-BFAB-9231828EC3C5}\.be\4kvideodownloaderplus_1.4.3_x64_online.exe
    "C:\Windows\Temp\{77D6DB75-5133-4925-BFAB-9231828EC3C5}\.be\4kvideodownloaderplus_1.4.3_x64_online.exe" -q -burn.elevated BurnPipe.{3A7519DA-0572-4CF2-BA3F-D584C383CBFF} {A504C407-CF0A-46D4-95FD-421BE43E8B90} 2200
    3⤵
    - Adds Run key to start application
    - Drops file in Windows directory
    - Executes dropped EXE
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2564

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2940

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005C4" "0000000000000334"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A5A48599B6C405179124F320DD337DA0
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:888
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C7CF63D5CFEDADA8FCE9DBFC84B55152 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f7755a3.rbs

Filesize
124KB

MD5
f6eb0b3a7ea70be1d10647f5e50a98d6

SHA1
0254bb9c47fc0d9bab135b00fd32d1a3bb31bdf9

SHA256
4b2bd4fdfffb1be016ee229c69c0d01b5c89804234ebb82ffd1146923e4443e2

SHA512
4971b7bcc50d74b12e502f8222bb796bd8998f9d0aaf25c1d8de756c6bc808efdcefe4a93c99872cce476dfe50a16cddd003c1c52d27482440602ad3a619d830

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
0a4cb840474a09394121173cfe093c57

SHA1
280f16d176d891bc6cf263543627a9757626a05e

SHA256
bda841472848c14315d81138327a9f06016c7be562b91628615251bc2bb60acf

SHA512
965cd6101099cd6305b59559c0342371a8e7525360bad8d9cad65183bdc5741babbc953737cede97454b72f7790316588cd7ff160dadf44899431d5d3bafc269

Download Submit
C:\Users\Admin\AppData\Local\Temp\4K_Video_Downloader+_20240502174845_001_application_msi.log

Filesize
2KB

MD5
c6614f9a0e91160440439cdf5812296e

SHA1
1237e65f787a636914f32cd48de9a6809c23e847

SHA256
5418d4f99f8101bbcac465fd558baedcde70753a351d4be359e9694949a44c0c

SHA512
9f46cd6033f44e9fb2fd54ad8606dd6027f0a80993348d353c22e15da3cc8f81f204065b849c1e090cd5683227350e361c1664def5c1ada3efa49dd634ca1d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5A60.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5D34.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
C:\Windows\Installer\MSI72A6.tmp

Filesize
211KB

MD5
a3ae5d86ecf38db9427359ea37a5f646

SHA1
eb4cb5ff520717038adadcc5e1ef8f7c24b27a90

SHA256
c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74

SHA512
96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0

Download Submit
C:\Windows\Temp\{77D6DB75-5133-4925-BFAB-9231828EC3C5}\.ba\logo.png

Filesize
4KB

MD5
20986fecad1c10339e192993e72bbc4e

SHA1
ca627fc0a6e96c2021da63e71d5d05d45b9894b9

SHA256
2fab77079c0e9e6bae57c3f783936243a6f43550d08cab690c09b4409d4ea669

SHA512
4cbe6c6cfef20a770e6cb9303ceddf1f0b53a5c1a8a26a9c769fe72735a36a9646f6937c6f8af26d42b0bf9860638af80cb201e6551d41fd2c813bbda39d5990

Download Submit
\Windows\Temp\{77D6DB75-5133-4925-BFAB-9231828EC3C5}\.ba\wixstdba.dll

Filesize
184KB

MD5
fe7e0bd53f52e6630473c31299a49fdd

SHA1
f706f45768bfb95f4c96dfa0be36df57aa863898

SHA256
2bea14d70943a42d344e09b7c9de5562fa7e109946e1c615dd584da30d06cc80

SHA512
feed48286b1e182996a3664f0facdf42aae3692d3d938ea004350c85764db7a0bea996dfddf7a77149c0d4b8b776fb544e8b1ce5e9944086a5b1ed6a8a239a3c

Download Submit
\Windows\Temp\{D116567B-FDCA-4CC7-8879-34A3A102BC46}\.cr\4kvideodownloaderplus_1.4.3_x64_online.exe

Filesize
912KB

MD5
7d976b0df489feb93c55810c5912c266

SHA1
8a0be0a217324ff559ec3c46a400af401f91dccf

SHA256
bc4e220b7539888116beeb5b74bb51cff311d7e1eb859f92ca7f778d605031a1

SHA512
859167c3c78812b3cf97629fdf34a2774ff5412baaa0f118898e5cfc9657fdbd510442d92898d9022dc5d6ae073bb488363d88187c772a56e9756e238b669213

Download Submit