Overview

overview

7

Static

static

7

4ddig-for-...01.exe

windows10-2004-x64

7

4ddig-for-...01.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    300s
  • max time network
    281s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07/06/2024, 10:13

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ddig-for-windows_11717755071990378901.exe
  • Size 2.0MB
  • Sample240607-l9haqaef7y
  • SHA256 cb81e1a7022cacb4833c635646878d5fc5ff75a027127e6b0652aa2dce50ee9d
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryevasionupx

Malware Config

Signatures

  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies Windows Firewall 2 TTPs 27 IoCs
    evasion
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Executes dropped EXE 15 IoCs
  • Loads dropped DLL 63 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 24 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ddig-for-windows_11717755071990378901.exe
    "C:\Users\Admin\AppData\Local\Temp\4ddig-for-windows_11717755071990378901.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3116
    • C:\Users\Admin\AppData\Local\Temp\AnyDataRecovery_4ddig\AnyDataRecovery_4ddig_10.1.0.exe
      /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\Tenorshare 4DDiG_Setup_20240607101437.log" /sptrack "4ddig-for-windows_11717755071990378901.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Users\Admin\AppData\Local\Temp\is-S6N9P.tmp\AnyDataRecovery_4ddig_10.1.0.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-S6N9P.tmp\AnyDataRecovery_4ddig_10.1.0.tmp" /SL5="$150030,122952407,743424,C:\Users\Admin\AppData\Local\Temp\AnyDataRecovery_4ddig\AnyDataRecovery_4ddig_10.1.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\Tenorshare 4DDiG_Setup_20240607101437.log" /sptrack "4ddig-for-windows_11717755071990378901.exe"
        3⤵
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1468
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im "Tenorshare 4DDiG.exe"&taskkill /f /t /im "ParseRecord.exe"&taskkill /f /t /im "DebugRecord.exe"&taskkill /f /t /im "VideoRepairService.exe"&taskkill /f /t /im "PhotosRepairService.exe"&taskkill /f /t /im "UpdateService.exe"&taskkill /f /t /im "DocumentPreviewService.exe"&taskkill /f /t /im "DocumentPreviewServiceEx.exe"&taskkill /f /t /im "MediaPlayerService.exe"&taskkill /f /t /im "MediaInfoService.exe"&taskkill /f /t /im "TaskbarTest.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1780
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "Tenorshare 4DDiG.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2456
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "ParseRecord.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3960
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DebugRecord.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2784
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "VideoRepairService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1880
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "PhotosRepairService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "UpdateService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:568
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DocumentPreviewService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4636
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DocumentPreviewServiceEx.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2256
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "MediaPlayerService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3896
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "MediaInfoService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3180
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "TaskbarTest.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4968
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im "ffmpeg.exe"&taskkill /f /t /im "DeviceViewerService.exe"&taskkill /f /t /im "docsrepair.exe"&taskkill /f /t /im "doc-repair-office.exe"&taskkill /f /t /im "lib_USBFormatSDK.exe"&taskkill /f /t /im "PhotoPreviewService.exe"&taskkill /f /t /im "PicturePreviewService.exe"&taskkill /f /t /im "DataScanService.exe"&taskkill /f /t /im "DataPreviewService.exe"&taskkill /f /t /im "DataRecoveryService.exe"&taskkill /f /t /im "Mp4FrameScanService.exe"&taskkill /f /t /im "Mp4FrameRecoveryService.exe"&taskkill /f /t /im "MsgSupportService.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2244
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "ffmpeg.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4132
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DeviceViewerService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1084
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "docsrepair.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1720
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "doc-repair-office.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3068
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "lib_USBFormatSDK.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4876
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "PhotoPreviewService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2372
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "PicturePreviewService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2568
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DataScanService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:1928
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DataPreviewService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2152
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "DataRecoveryService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3292
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "Mp4FrameScanService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3324
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "Mp4FrameRecoveryService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4956
          • C:\Windows\SysWOW64\taskkill.exe
            taskkill /f /t /im "MsgSupportService.exe"
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2080
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe"
          4⤵
            PID:2124
            • C:\Windows\SysWOW64\netsh.exe
              netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe"
              5⤵
              • Modifies Windows Firewall
              PID:2448
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe" enable=yes
            4⤵
              PID:1248
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="Tenorshare 4DDiG" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                PID:1500
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe" enable=yes
              4⤵
                PID:3808
                • C:\Windows\System32\Conhost.exe
                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  5⤵
                    PID:1984
                  • C:\Windows\SysWOW64\netsh.exe
                    netsh advfirewall firewall add rule name="Tenorshare 4DDiG" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe" enable=yes
                    5⤵
                    • Modifies Windows Firewall
                    PID:1152
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe"
                  4⤵
                    PID:1572
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe"
                      5⤵
                      • Modifies Windows Firewall
                      PID:4336
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_NetFrameCheck" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe" enable=yes
                    4⤵
                      PID:2192
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh advfirewall firewall add rule name="Tenorshare 4DDiG_NetFrameCheck" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe" enable=yes
                        5⤵
                        • Modifies Windows Firewall
                        PID:3040
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_NetFrameCheck" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe" enable=yes
                      4⤵
                        PID:2020
                        • C:\Windows\SysWOW64\netsh.exe
                          netsh advfirewall firewall add rule name="Tenorshare 4DDiG_NetFrameCheck" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe" enable=yes
                          5⤵
                          • Modifies Windows Firewall
                          PID:3068
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe"
                        4⤵
                          PID:1720
                          • C:\Windows\SysWOW64\netsh.exe
                            netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe"
                            5⤵
                            • Modifies Windows Firewall
                            PID:2796
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_ParseRecord" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe" enable=yes
                          4⤵
                            PID:4896
                            • C:\Windows\SysWOW64\netsh.exe
                              netsh advfirewall firewall add rule name="Tenorshare 4DDiG_ParseRecord" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe" enable=yes
                              5⤵
                              • Modifies Windows Firewall
                              PID:3848
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_ParseRecord" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe" enable=yes
                            4⤵
                              PID:2372
                              • C:\Windows\SysWOW64\netsh.exe
                                netsh advfirewall firewall add rule name="Tenorshare 4DDiG_ParseRecord" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\ParseRecord.exe" enable=yes
                                5⤵
                                • Modifies Windows Firewall
                                PID:1844
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe"
                              4⤵
                                PID:4636
                                • C:\Windows\SysWOW64\netsh.exe
                                  netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe"
                                  5⤵
                                  • Modifies Windows Firewall
                                  PID:3032
                              • C:\Windows\SysWOW64\cmd.exe
                                "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_UpdateService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe" enable=yes
                                4⤵
                                  PID:5056
                                  • C:\Windows\SysWOW64\netsh.exe
                                    netsh advfirewall firewall add rule name="Tenorshare 4DDiG_UpdateService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe" enable=yes
                                    5⤵
                                    • Modifies Windows Firewall
                                    PID:2524
                                • C:\Windows\SysWOW64\cmd.exe
                                  "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_UpdateService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe" enable=yes
                                  4⤵
                                    PID:2624
                                    • C:\Windows\SysWOW64\netsh.exe
                                      netsh advfirewall firewall add rule name="Tenorshare 4DDiG_UpdateService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe" enable=yes
                                      5⤵
                                      • Modifies Windows Firewall
                                      PID:3936
                                  • C:\Windows\SysWOW64\cmd.exe
                                    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe"
                                    4⤵
                                      PID:8
                                      • C:\Windows\SysWOW64\netsh.exe
                                        netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe"
                                        5⤵
                                        • Modifies Windows Firewall
                                        PID:808
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_preuninstall" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe" enable=yes
                                      4⤵
                                        PID:4232
                                        • C:\Windows\SysWOW64\netsh.exe
                                          netsh advfirewall firewall add rule name="Tenorshare 4DDiG_preuninstall" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe" enable=yes
                                          5⤵
                                          • Modifies Windows Firewall
                                          PID:4616
                                      • C:\Windows\SysWOW64\cmd.exe
                                        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_preuninstall" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe" enable=yes
                                        4⤵
                                          PID:4792
                                          • C:\Windows\SysWOW64\netsh.exe
                                            netsh advfirewall firewall add rule name="Tenorshare 4DDiG_preuninstall" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\preuninstall.exe" enable=yes
                                            5⤵
                                            • Modifies Windows Firewall
                                            PID:3016
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe"
                                          4⤵
                                            PID:896
                                            • C:\Windows\SysWOW64\netsh.exe
                                              netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe"
                                              5⤵
                                              • Modifies Windows Firewall
                                              PID:3096
                                          • C:\Windows\SysWOW64\cmd.exe
                                            "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DeviceViewerService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe" enable=yes
                                            4⤵
                                              PID:4828
                                              • C:\Windows\SysWOW64\netsh.exe
                                                netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DeviceViewerService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe" enable=yes
                                                5⤵
                                                • Modifies Windows Firewall
                                                PID:1360
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DeviceViewerService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe" enable=yes
                                              4⤵
                                                PID:3964
                                                • C:\Windows\SysWOW64\netsh.exe
                                                  netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DeviceViewerService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe" enable=yes
                                                  5⤵
                                                  • Modifies Windows Firewall
                                                  PID:4936
                                              • C:\Windows\SysWOW64\cmd.exe
                                                "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe"
                                                4⤵
                                                  PID:2452
                                                  • C:\Windows\SysWOW64\netsh.exe
                                                    netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe"
                                                    5⤵
                                                    • Modifies Windows Firewall
                                                    PID:3208
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataScanService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" enable=yes
                                                  4⤵
                                                    PID:2580
                                                    • C:\Windows\SysWOW64\netsh.exe
                                                      netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataScanService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" enable=yes
                                                      5⤵
                                                      • Modifies Windows Firewall
                                                      PID:1412
                                                  • C:\Windows\SysWOW64\cmd.exe
                                                    "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataScanService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" enable=yes
                                                    4⤵
                                                      PID:4484
                                                      • C:\Windows\SysWOW64\netsh.exe
                                                        netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataScanService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" enable=yes
                                                        5⤵
                                                        • Modifies Windows Firewall
                                                        PID:4100
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe"
                                                      4⤵
                                                        PID:4468
                                                        • C:\Windows\SysWOW64\netsh.exe
                                                          netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe"
                                                          5⤵
                                                          • Modifies Windows Firewall
                                                          PID:4684
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataRecoveryService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe" enable=yes
                                                        4⤵
                                                          PID:4504
                                                          • C:\Windows\System32\Conhost.exe
                                                            \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                            5⤵
                                                              PID:1572
                                                            • C:\Windows\SysWOW64\netsh.exe
                                                              netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataRecoveryService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe" enable=yes
                                                              5⤵
                                                              • Modifies Windows Firewall
                                                              PID:2456
                                                          • C:\Windows\SysWOW64\cmd.exe
                                                            "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataRecoveryService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe" enable=yes
                                                            4⤵
                                                              PID:3408
                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                netsh advfirewall firewall add rule name="Tenorshare 4DDiG_DataRecoveryService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryService.exe" enable=yes
                                                                5⤵
                                                                • Modifies Windows Firewall
                                                                PID:3068
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe"
                                                              4⤵
                                                                PID:2708
                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                  netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe"
                                                                  5⤵
                                                                  • Modifies Windows Firewall
                                                                  PID:3460
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_MsgSupportService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe" enable=yes
                                                                4⤵
                                                                  PID:3548
                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                    netsh advfirewall firewall add rule name="Tenorshare 4DDiG_MsgSupportService" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe" enable=yes
                                                                    5⤵
                                                                    • Modifies Windows Firewall
                                                                    PID:2836
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4DDiG_MsgSupportService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe" enable=yes
                                                                  4⤵
                                                                    PID:1984
                                                                    • C:\Windows\System32\Conhost.exe
                                                                      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                      5⤵
                                                                        PID:2784
                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                        netsh advfirewall firewall add rule name="Tenorshare 4DDiG_MsgSupportService" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe" enable=yes
                                                                        5⤵
                                                                        • Modifies Windows Firewall
                                                                        PID:2064
                                                                • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe
                                                                  "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe"
                                                                  2⤵
                                                                  • Executes dropped EXE
                                                                  • Suspicious use of SetWindowsHookEx
                                                                  PID:4760
                                                                  • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe
                                                                    "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe"
                                                                    3⤵
                                                                    • Drops file in Program Files directory
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • Modifies Internet Explorer settings
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    • Suspicious use of FindShellTrayWindow
                                                                    PID:3504
                                                                    • C:\Windows\system32\cmd.exe
                                                                      "C:\Windows\system32\cmd.exe" /c del /f /q "F:\4DefaultTemp\88ecb21c21674908814a34608d937150.json"&exit
                                                                      4⤵
                                                                        PID:3964
                                                                      • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TaskbarTest.exe
                                                                        "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TaskbarTest.exe"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        PID:3772
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cbs.tenorshare.com/go?pid=2959&a=i&v=10.1.0&cross_end_id=11717755071990378901&rnclid=11717755071990378901
                                                                        4⤵
                                                                        • Enumerates system info in registry
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        PID:1892
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x110,0x114,0x118,0xec,0x11c,0x7fff09163cb8,0x7fff09163cc8,0x7fff09163cd8
                                                                          5⤵
                                                                            PID:2456
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1900 /prefetch:2
                                                                            5⤵
                                                                              PID:4084
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
                                                                              5⤵
                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                              PID:2972
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
                                                                              5⤵
                                                                                PID:3152
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3076 /prefetch:1
                                                                                5⤵
                                                                                  PID:3824
                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
                                                                                  5⤵
                                                                                    PID:3548
                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
                                                                                    5⤵
                                                                                      PID:4452
                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
                                                                                      5⤵
                                                                                        PID:4632
                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
                                                                                        5⤵
                                                                                          PID:1384
                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
                                                                                          5⤵
                                                                                            PID:2772
                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
                                                                                            5⤵
                                                                                              PID:4828
                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,12177194385611955275,15512700901657299901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
                                                                                              5⤵
                                                                                                PID:1520
                                                                                            • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe
                                                                                              "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\MsgSupportService.exe" ga_pipe_3504 QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxUZW5vcnNoYXJlXFRlbm9yc2hhcmUgNEREaUc= 10.1.0.10
                                                                                              4⤵
                                                                                              • Executes dropped EXE
                                                                                              • Loads dropped DLL
                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4876
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              "C:\Windows\system32\cmd.exe" /c del /f /q "F:\4DefaultTemp\71c7bcc97e524f318e75e7c7f4649f29.json"&exit
                                                                                              4⤵
                                                                                                PID:1452
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                "C:\Windows\system32\cmd.exe" /c rmdir /s /q "F:\4DefaultTemp"&exit
                                                                                                4⤵
                                                                                                  PID:2864
                                                                                                • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe
                                                                                                  "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\UpdateService.exe" eyJVcGxvYWRFbiI6MSwiVXBsb2FkVHlwZSI6W10sIlRlbXBQYXRoIjoiRjpcXCJ9
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                  PID:4792
                                                                                                • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe
                                                                                                  "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DeviceViewerService.exe" 4ddig_Win 3504
                                                                                                  4⤵
                                                                                                  • Executes dropped EXE
                                                                                                  • Loads dropped DLL
                                                                                                  PID:2772
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  "C:\Windows\system32\cmd.exe" /c del /f /q "F:\4DefaultTemp\HotUpdateConfig_x64.rar"&exit
                                                                                                  4⤵
                                                                                                    PID:1504
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    "C:\Windows\system32\cmd.exe" /c fsutil behavior set disabledeletenotify 1&exit
                                                                                                    4⤵
                                                                                                      PID:4996
                                                                                                      • C:\Windows\system32\fsutil.exe
                                                                                                        fsutil behavior set disabledeletenotify 1
                                                                                                        5⤵
                                                                                                          PID:2384
                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                        "C:\Windows\system32\cmd.exe" /c rmdir /s /q "F:\4DefaultTemp"&exit
                                                                                                        4⤵
                                                                                                          PID:2740
                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                          "C:\Windows\system32\cmd.exe" /c rmdir /s /q "F:\4DefaultTemp"&exit
                                                                                                          4⤵
                                                                                                            PID:860
                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                            "C:\Windows\system32\cmd.exe" /c "C:\ProgramData\Tenorshare\Service\svcmgr.exe" install&exit
                                                                                                            4⤵
                                                                                                              PID:4336
                                                                                                              • C:\ProgramData\Tenorshare\Service\svcmgr.exe
                                                                                                                C:\ProgramData\Tenorshare\Service\svcmgr.exe install
                                                                                                                5⤵
                                                                                                                • Executes dropped EXE
                                                                                                                PID:1664
                                                                                                            • C:\Windows\SYSTEM32\cmd.exe
                                                                                                              "cmd.exe" /C wmic pagefileset create name='F:\pagefile.sys',initialsize=512,maximumsize=2048
                                                                                                              4⤵
                                                                                                                PID:4784
                                                                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                  wmic pagefileset create name='F:\pagefile.sys',initialsize=512,maximumsize=2048
                                                                                                                  5⤵
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:3208
                                                                                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe
                                                                                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" 3504
                                                                                                                4⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                PID:1448
                                                                                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe
                                                                                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" 3504
                                                                                                                4⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                PID:4484
                                                                                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe
                                                                                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe" 3504
                                                                                                                4⤵
                                                                                                                • Drops file in Program Files directory
                                                                                                                • Executes dropped EXE
                                                                                                                • Loads dropped DLL
                                                                                                                PID:4732
                                                                                                        • C:\Windows\System32\CompPkgSrv.exe
                                                                                                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                          1⤵
                                                                                                            PID:4328
                                                                                                          • C:\Windows\System32\CompPkgSrv.exe
                                                                                                            C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                            1⤵
                                                                                                              PID:3732
                                                                                                            • C:\ProgramData\Tenorshare\Service\TenorshareUpdateAssistantService.exe
                                                                                                              "C:\ProgramData\Tenorshare\Service\TenorshareUpdateAssistantService.exe"
                                                                                                              1⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • Loads dropped DLL
                                                                                                              • Modifies data under HKEY_USERS
                                                                                                              PID:2956
                                                                                                              • C:\Windows\System32\cmd.exe
                                                                                                                "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Tenorshare\Service\TenorshareUpdateAssistant.exe"
                                                                                                                2⤵
                                                                                                                  PID:1536
                                                                                                                  • C:\ProgramData\Tenorshare\Service\TenorshareUpdateAssistant.exe
                                                                                                                    C:\ProgramData\Tenorshare\Service\TenorshareUpdateAssistant.exe
                                                                                                                    3⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    PID:3272
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Tenorshare\Service\svcmgr.exe" auto
                                                                                                                  2⤵
                                                                                                                    PID:2984
                                                                                                                    • C:\ProgramData\Tenorshare\Service\svcmgr.exe
                                                                                                                      C:\ProgramData\Tenorshare\Service\svcmgr.exe auto
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:4236

                                                                                                                Network

                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                      Replay Monitor

                                                                                                                      Loading Replay Monitor...

                                                                                                                      Downloads

                                                                                                                      AgentSupportCLR.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\AgentSupportCLR.dll
                                                                                                                      • Size 1.3MB
                                                                                                                      • SHA256 8e8d4c4208054193c27b4b0006e1202cc86b6ab4cba1a56b1c271d8764a866c7
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      AnyDataRecoverySDK.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\AnyDataRecoverySDK.dll
                                                                                                                      • Size 3.8MB
                                                                                                                      • SHA256 0d2a2fd9c6300735694ab359e70311b98bf4347b8975ece1d030b62274905d56
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      BugSplatDotNet.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\BugSplatDotNet.dll
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 0f2ecc1bc472302fca35c425136fb3d945a3ed682fd75d6ea429eba6ce5e08cc
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      DataRecoveryParser.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataRecoveryParser.dll
                                                                                                                      • Size 136KB
                                                                                                                      • SHA256 6202a5c555bc194d4856d953c6a0dc83c35c347398d998e27a928c51563a87c8
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      DataScanService.exe
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\DataScanService.exe
                                                                                                                      • Size 1.4MB
                                                                                                                      • SHA256 29692a9dd5d7c42840d058050bcdcb3cceac48554ac032852f9a4ec4d538864f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      FileReport.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\FileReport.dll
                                                                                                                      • Size 105KB
                                                                                                                      • SHA256 7b5db936d7af2bb3bbfd6b44310f44806c21391a52a41e365acef4db9a18c8f0
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      ar-AE.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\ar-AE.xaml
                                                                                                                      • Size 161KB
                                                                                                                      • SHA256 eedbf714b4578bac2366d8124d7f94814aa31f4c9719ee027ee6fc6531b06ffb
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      de-DE.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\de-DE.xaml
                                                                                                                      • Size 183KB
                                                                                                                      • SHA256 eb72fb38a9b4e7a25195fc6f7a2779d2250ab6d2e939bda97296a41ab19df1a6
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      en-US.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\en-US.xaml
                                                                                                                      • Size 163KB
                                                                                                                      • SHA256 0113d20848aa86e21c2f291d4d6c57d3303478b199c25cc2cc00c08677a6db2f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      es-ES.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\es-ES.xaml
                                                                                                                      • Size 175KB
                                                                                                                      • SHA256 0c0cd8ae9b70440a736064bd5e6d887a04ae15ac71f9970eb1fd373bbafb50e6
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      fr-FR.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\fr-FR.xaml
                                                                                                                      • Size 179KB
                                                                                                                      • SHA256 50018a39b1a573c5a6b2ffc917bced59fc149c048332b674870c8a9a88ca898f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      id-ID.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\id-ID.xaml
                                                                                                                      • Size 165KB
                                                                                                                      • SHA256 10745f8b824939b8d8042561361cc135d18ccdaf2989bb9a9a24a923b81f17dd
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      it-IT.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\it-IT.xaml
                                                                                                                      • Size 175KB
                                                                                                                      • SHA256 41e0f43b3c4ddf322757d08385d98fa742349ff0191560179752ceea6b4ccb5a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      ja-JP.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\ja-JP.xaml
                                                                                                                      • Size 135KB
                                                                                                                      • SHA256 a2d888604fc8adedf22e46ccc4dade9ad3d3365463da6433ecaa74d8802df242
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      ko-KR.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\ko-KR.xaml
                                                                                                                      • Size 136KB
                                                                                                                      • SHA256 70199bcb85a5e5395d6bdbdf5d626ed3dc4af30fa74bb7ec8bdc604a09269c87
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      ms-MY.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\ms-MY.xaml
                                                                                                                      • Size 166KB
                                                                                                                      • SHA256 69c214963febfc1ea58277f2232018e80fc6926863c99edc8028271f9c4efb92
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      nl-NL.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\nl-NL.xaml
                                                                                                                      • Size 168KB
                                                                                                                      • SHA256 d780cb47bda04bba754ca2f4639c7ffa5566fa5f86f443966c65f6ddd177061c
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      pt-BR.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\pt-BR.xaml
                                                                                                                      • Size 175KB
                                                                                                                      • SHA256 f8f6facd9e5a5521ad0616444bad2ba6624dad0018b4bb3a5d7a5fbb32b5823c
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      ru-RU.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\ru-RU.xaml
                                                                                                                      • Size 175KB
                                                                                                                      • SHA256 9349ab8cb46bbd4478e81febba0def12e3a3bf8d5718a54aef8e2b3bfd05bf8e
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      th-TH.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\th-TH.xaml
                                                                                                                      • Size 154KB
                                                                                                                      • SHA256 9f274cd726b48904aa2be6b2b704cee8530b4688d309314ee2b8ca183317f0b4
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      tr-TR.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\tr-TR.xaml
                                                                                                                      • Size 167KB
                                                                                                                      • SHA256 39d7ee55de90d299d6da4f4b7d2179bef493f4b4acea00a9bfb78bc21c2c6023
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      zh-CN.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\zh-CN.xaml
                                                                                                                      • Size 122KB
                                                                                                                      • SHA256 35c17a4654f01121321a8558e21a23f011554143f249f0537248fc199e58553a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      zh-TW.xaml
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Languages\zh-TW.xaml
                                                                                                                      • Size 122KB
                                                                                                                      • SHA256 54115e88e786b61922a1d8db1a7620397c7cdf1aa3409492a0785e3ab3edd2d3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TSCommunication.log
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Logs\TSCommunication.log
                                                                                                                      • Size 7KB
                                                                                                                      • SHA256 cbd5f92ddd0ba97c1ef9f71c536bc361d610e0057b39c6ac64e10bbfb7479cdd
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      record_0_301_3_241361_device_id.log
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Logs\record_0_301_3_241361_device_id.log
                                                                                                                      • Size 48B
                                                                                                                      • SHA256 8b57cad3f06553dd0bad59713ee6787c3140f67413d470ef83235d5ca49c1f53
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      SoftwareLog.log
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\Logs\SoftwareLog.log
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 a85e641bb524638c210c1448f29002cae2f73c0713516a4667262521824ce62f
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      SoftwareLog.log
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\Logs\SoftwareLog.log
                                                                                                                      • Size 5KB
                                                                                                                      • SHA256 9189feb821798bcb93afb55326faf4595a67ee064d3b666e83281ab3841ad7e2
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      cloud
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\cloud
                                                                                                                      • Size 252B
                                                                                                                      • SHA256 7abf26a25c6e0779dc6eb45608d5f6d75222dc0e7b0c50952143d8cf21413895
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      is-DAHJR.tmp
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\MsgSupport\is-DAHJR.tmp
                                                                                                                      • Size 187B
                                                                                                                      • SHA256 c66e1ba36e874342cd570cf5bdd3d8b73864a4c9e9d802398be7f46fe39a8532
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      NLog.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NLog.dll
                                                                                                                      • Size 926KB
                                                                                                                      • SHA256 49b24552baedd5a7a25cc4af132bd0e39e0fd4e711e9822a43ba01493ebeee1b
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      NetFrameCheck.db
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.db
                                                                                                                      • Size 10KB
                                                                                                                      • SHA256 de784bf00bc5aaeb18c92ca62e6bce35a14bcace763b3d5cde99d04dd9736521
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      NetFrameCheck.exe
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\NetFrameCheck.exe
                                                                                                                      • Size 5.2MB
                                                                                                                      • SHA256 89cfe233fc7d95d1c3a84bf1f8bda6ce2c4f2ec065e67cd06c2ee899ed4e4cb3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Register.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Register.dll
                                                                                                                      • Size 421KB
                                                                                                                      • SHA256 2c704c9674b20bccf98c072dc8295a02456229e4751552c8c638aae33860d87d
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      SoftwareLog.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\SoftwareLog.dll
                                                                                                                      • Size 1.5MB
                                                                                                                      • SHA256 5f61362cb9014351e43cf60fbee53fc1efab364eeb1ce8e0ff43b326cf470cb6
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      System.Memory.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\System.Memory.dll
                                                                                                                      • Size 135KB
                                                                                                                      • SHA256 52825651c7bee27b598267216f2175250cf8392f90ce1bffa454dc9dcdfcd700
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\System.Runtime.CompilerServices.Unsafe.dll
                                                                                                                      • Size 17KB
                                                                                                                      • SHA256 e935d6887eef7448b9f68999251f6cdb48b33aa4b93c171a0386b93b56c2dba8
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.Downloader.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.Downloader.dll
                                                                                                                      • Size 38KB
                                                                                                                      • SHA256 9e55caca8a8beec7f36dacbb008935c9a3f5795062782be35869987a09959f41
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.Gif.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.Gif.dll
                                                                                                                      • Size 51KB
                                                                                                                      • SHA256 643e46b45c69c181026ac93d93085ced28db10d344630aab4ba7ef26d82b1d31
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.Json.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.Json.dll
                                                                                                                      • Size 460KB
                                                                                                                      • SHA256 87e3c3348fe8eff35b4ca811e0f376a37eaa7830ab8801bf4fac9a9ca3abc7c9
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.Language.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.Language.dll
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 8ee45bdf4c70b3c3305fcd478ccf4bccdad45a47f1fa420ddf34b86f0b1cb45b
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.Media.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.Media.dll
                                                                                                                      • Size 404KB
                                                                                                                      • SHA256 797abea4827b83b6798df0a86adf3bab76aac7e736c9205222245889c000675f
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.MsgSupport.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.MsgSupport.dll
                                                                                                                      • Size 27KB
                                                                                                                      • SHA256 c85d28f067e7974051bf5a628475d0dd6145a89d7ca8423a072ecaa404139091
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TS.MvvmLight.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TS.MvvmLight.dll
                                                                                                                      • Size 547KB
                                                                                                                      • SHA256 ea5c78cba84cf6cd0dcb19dbf2371f7c0b80bfe578667bec44a545de0e51757c
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      TSConfig.json
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\TSConfig.json
                                                                                                                      • Size 5KB
                                                                                                                      • SHA256 5d84ff890be1e01e1f66ebe78e77b2fe7703b88c48e2f4e47d5851236a13ec83
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Tenorshare 4DDiG.exe
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe
                                                                                                                      • Size 7.6MB
                                                                                                                      • SHA256 edf44dbacb5a209a540e18677fb1732833de8ab0faab5074c01ea8b48d585c91
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Tenorshare 4DDiG.exe
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe
                                                                                                                      • Size 8.5MB
                                                                                                                      • SHA256 28c71e24f462410d96e80edd6f6f1a41eaa9f1a721a570ba7fb1d8edda1c7e9a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Tenorshare 4DDiG.exe.Config
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe.Config
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 9135855d7f3becb600a905a6b3133c3aa9d888aa8dc16b58890eaa29cdebd7e9
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Tenorshare 4DDiG.exe.config
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\Tenorshare 4DDiG.exe.config
                                                                                                                      • Size 3KB
                                                                                                                      • SHA256 47a34d20ba09141bc1446d0da6f894872343c5fa10280e57ba51c82628a8a9a9
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      hqa35vok.newcfg
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\hqa35vok.newcfg
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 e4130ee5504079ce15b576fb347395be6d0c3c8e419e769525d2d4ee8982139b
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      libcrypto-1_1-x64.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\libcrypto-1_1-x64.dll
                                                                                                                      • Size 3.3MB
                                                                                                                      • SHA256 7c3a5d1899a955a01da39a253c2d57d4496956bafebbf5a730388a8fb592b223
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      libcurl.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\libcurl.dll
                                                                                                                      • Size 542KB
                                                                                                                      • SHA256 401e9665ccaead776d966b9064e8fb1b51d6cf22b3b134e1515b750714fd6b98
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      libssl-1_1-x64.dll
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\libssl-1_1-x64.dll
                                                                                                                      • Size 676KB
                                                                                                                      • SHA256 57eb8e72bbad676b997fb9616e6e758ef4fbaba92b84735f5bfef5f81821cf3a
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      raw
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\raw\raw
                                                                                                                      • Size 53KB
                                                                                                                      • SHA256 0e166971854894462d377aee83df0df49fb6e1b7abb24b01dfa947b4767e6de8
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      register.json
                                                                                                                      • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4DDiG\register.json
                                                                                                                      • Size 1KB
                                                                                                                      • SHA256 e2419f093d9a1dcf2a43f51a2deabb49b10b07aa4178e368e9b4cb4a0cee90b5
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      8EC9B1D0ABBD7F98B401D425828828CE_234E9B04AA8520A2E6CE0C38C9A1AE0D
                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_234E9B04AA8520A2E6CE0C38C9A1AE0D
                                                                                                                      • Size 727B
                                                                                                                      • SHA256 79e121269a046a6066b435930994d825a6a6c1aa4857c78cb4ba37b2b08423e4
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      8EC9B1D0ABBD7F98B401D425828828CE_234E9B04AA8520A2E6CE0C38C9A1AE0D
                                                                                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_234E9B04AA8520A2E6CE0C38C9A1AE0D
                                                                                                                      • Size 408B
                                                                                                                      • SHA256 d9b6833ca2f01be4e4b2ef8edc54eed2c9c7a48c5e920b6db2e0e428bca9f57e
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 152B
                                                                                                                      • SHA256 9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      settings.dat
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                      • Size 152B
                                                                                                                      • SHA256 f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      6049849f-a6f5-454d-8d6e-e2fca1527346.tmp
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6049849f-a6f5-454d-8d6e-e2fca1527346.tmp
                                                                                                                      • Size 7KB
                                                                                                                      • SHA256 19f6224e2b6df38040cf359efe0e1559cc729588a91c90f67f7d2f66c11b3826
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      the-real-index
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                      • Size 528B
                                                                                                                      • SHA256 2c551d10cd42a8588f6dfecfaf018a3772ba737e4736efe806dd6e702f78e3f0
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Network Persistent State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
                                                                                                                      • Size 2KB
                                                                                                                      • SHA256 2d064cfcd3b1064dad7e73bce429e279ca13647b1e327f2bea4b91f39d0d37a1
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 5KB
                                                                                                                      • SHA256 6ba0f93753ac8841cfc4f74c65a13e304b55541969df5e38bbee677219345c1e
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Preferences
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                      • Size 7KB
                                                                                                                      • SHA256 4a85932e08e6d980293d6d5664b1fd1065133f61566d756e0b56cdd8e017ba97
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      MANIFEST-000001
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001
                                                                                                                      • Size 41B
                                                                                                                      • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      the-real-index
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                      • Size 120B
                                                                                                                      • SHA256 7fab58e3df3bec6d097be61b5d79c17208f4c11cdf34c4c3b09d8fb68caba0b4
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      the-real-index~RFe593cc1.TMP
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593cc1.TMP
                                                                                                                      • Size 48B
                                                                                                                      • SHA256 619fadaee1cf70f8c5da9c7cf3c8ba7f73d3a2053ce27e4917a55d16728b4dc6
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      CURRENT
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                      • Size 16B
                                                                                                                      • SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      CURRENT
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
                                                                                                                      • Size 16B
                                                                                                                      • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 11KB
                                                                                                                      • SHA256 31564e1f38773ced6b4ba1c85ac3c1bed5c51bc9ab006b96aa52b077ea99e7f3
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      Local State
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                      • Size 11KB
                                                                                                                      • SHA256 744433347d960a02236f43f33cf9848b41ecff806790f239e5692e87161a515b
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      RegisterAndLog.dll
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\b0494a1f-4bd3-AwEQqIi5npItE6o+RvKOKw==\RegisterAndLog.dll
                                                                                                                      • Size 1.2MB
                                                                                                                      • SHA256 2df246fad542e3af8622674a86fa7920a6797fb54cb11e49f935e0ddb4163d12
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      AnyDataRecovery_4ddig_10.1.0.tmp
                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-S6N9P.tmp\AnyDataRecovery_4ddig_10.1.0.tmp
                                                                                                                      • Size 1.7MB
                                                                                                                      • SHA256 b4e77fda37e556b7b1e9910534d3f6339ff9debd82ccf0f59fdedc02c40b8cc5
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      88ecb21c21674908814a34608d937150.json
                                                                                                                      • Path F:\4DefaultTemp\88ecb21c21674908814a34608d937150.json
                                                                                                                      • Size 1KB
                                                                                                                      • SHA256 03e4061c1dacdd1ea7277d11b59cb3914531f9c1553c6b5cd0a45d7c7dffc615
                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                      Submit Download

                                                                                                                      AnyDataRecoverySDK.dll
                                                                                                                      • Path F:\4DefaultTemp\HotUpdateConfig_x64\AnyDataRecoverySDK.dll
                                                                                                                      • Size 3.8MB
                                                                                                                      • SHA256 614a79152841eef15ceb18e6fd4c655ff82a1b50094947ed7e5815aa41cd0a5c
                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                      Submit Download

                                                                                                                      memory/1468-663-0x0000000000400000-0x00000000005C5000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1468-44-0x0000000000400000-0x00000000005C5000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1468-667-0x0000000000400000-0x00000000005C5000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1704-36-0x0000000000400000-0x00000000004BF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1704-39-0x0000000000401000-0x0000000000412000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1704-662-0x0000000000400000-0x00000000004BF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/1704-668-0x0000000000400000-0x00000000004BF000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-0-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-32-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-11-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-661-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-813-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-256-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-751-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3116-669-0x0000000000400000-0x000000000083A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-685-0x000002E6620B0000-0x000002E66290E000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-1028-0x000002E66A390000-0x000002E66A68B000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-805-0x000002E6679D0000-0x000002E667A8C000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-808-0x000002E664340000-0x000002E664362000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-807-0x000002E669F90000-0x000002E66A042000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-806-0x000002E6642F0000-0x000002E664304000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-810-0x000002E669BF0000-0x000002E669C4C000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-793-0x000002E663A20000-0x000002E663A2A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-814-0x000002E669C50000-0x000002E669C9C000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-795-0x000002E663A30000-0x000002E663A38000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-747-0x000002E6633C0000-0x000002E6633CA000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-796-0x000002E663A40000-0x000002E663A48000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-798-0x000002E663B40000-0x000002E663B4E000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-749-0x000002E6634C0000-0x000002E6635AA000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-2050-0x000002E6699A0000-0x000002E669B53000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-845-0x000002E669D80000-0x000002E669E08000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-799-0x000002E663A90000-0x000002E663A98000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-801-0x000002E663B50000-0x000002E663B58000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-800-0x000002E663C10000-0x000002E663C18000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-797-0x000002E663B60000-0x000002E663B98000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-792-0x000002E663A50000-0x000002E663A76000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-1878-0x000002E669960000-0x000002E6699A0000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-1042-0x000002E669D60000-0x000002E669D68000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-1041-0x000002E669E90000-0x000002E669ECE000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-1040-0x000002E669D40000-0x000002E669D58000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-790-0x000002E663AA0000-0x000002E663B16000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-787-0x000002E6634B0000-0x000002E6634C0000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-684-0x000002E6470D0000-0x000002E64794E000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-782-0x000002E663480000-0x000002E66348A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-686-0x000002E662AA0000-0x000002E662C28000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-784-0x000002E6634A0000-0x000002E6634AC000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-693-0x000002E6497A0000-0x000002E6497C6000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-691-0x000002E662C30000-0x000002E662CBC000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-689-0x000002E662030000-0x000002E66209A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-694-0x000002E662CC0000-0x000002E662DFA000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-699-0x000002E662E00000-0x000002E662F3A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-728-0x000002E663270000-0x000002E6633B9000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3504-723-0x000002E662A40000-0x000002E662A4A000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/3772-804-0x000001CBEFCE0000-0x000001CBEFCE8000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4876-841-0x0000000005440000-0x000000000548C000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4876-840-0x0000000005130000-0x00000000051F7000-memory.dmp
                                                                                                                      Download

                                                                                                                      memory/4876-822-0x0000000000030000-0x0000000000056000-memory.dmp
                                                                                                                      Download