Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12/06/2024, 03:35
Behavioral task
behavioral1
Sample
4ukey-for-android.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
4ukey-for-android.exe
Resource
win10v2004-20240508-en
General
-
Target
4ukey-for-android.exe
-
Size
1.9MB
-
MD5
f8cad25e19965dc3e550857dc8f69f3c
-
SHA1
eeaa1fc341a4a8b187db768ef75220441f3da675
-
SHA256
1c82457d6cc05d33ad8c11dfe7046ea1e51eaa6276138c7fc3e4ca63ce3b7ec3
-
SHA512
ce2a7cfc25b25395e3e9926f5bfa22d72f21f6dda1ba22d3803f64da8281d35e88c0fae1dfa20c14cb47473395a4928ca8f40a3aa33ea8ee98963dcaa8afd5c8
-
SSDEEP
49152:J1OOKgkBsWP5UXpv4k6rKRDTvhkIkpV9SIvkV8vhUm8Hlb1/a19gjmj:J1ZNKe54k6avvhkIAV9S3qvhUrHm19gA
Malware Config
Signatures
-
Manipulates Digital Signatures 1 TTPs 1 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates\49DE5C951646DF99480A98AE51028E3FBA0D355E\Blob = 03000000010000001400000049de5c951646df99480a98ae51028e3fba0d355e040000000100000010000000b2a2ea1d078e9c6c1e6819730b5334d61900000001000000100000005a1c6ce229573c60127ae28816737cd70f0000000100000020000000058110a1a5b1121112ea03630837727b4c3bfad9c2f382d3f324a487cef132d12000000001000000e1040000308204dd308203c5a003020102021010fc1e4bbbcfbbb7ae844ea450caf1f3300d06092a864886f70d01010b0500307f310b3009060355040613025553311d301b060355040a131453796d616e74656320436f72706f726174696f6e311f301d060355040b131653796d616e746563205472757374204e6574776f726b3130302e0603550403132753796d616e74656320436c61737320332053484132353620436f6465205369676e696e67204341301e170d3135303530383030303030305a170d3138303630363233353935395a3070310b300906035504061302434e31123010060355040813094775616e67646f6e673111300f060355040713085368656e7a68656e311c301a060355040a141354656e6f72736861726520436f2e2c4c74642e311c301a0603550403141354656e6f72736861726520436f2e2c4c74642e30820122300d06092a864886f70d01010105000382010f003082010a028201010092e67c77d6329cff325e72d6363ff883bc9081a2edb203e8a176cb3a033e6821aaa31d1246672073e01d3a67b2d3af3ab3d7cf6a3eb3053c02dfd5fa0fa93ca1d211e85b0f4d8ca7290931013092caf470f17a3c96b8d99d6cc5f73002b30fd49cbab05e56d0e16b3c93f2ce6c244a8f543fc402efd0f467f3b0cab91018e15043970c68bd0345e8fbf775ba1c4448ba8c57554704f0327c2b0e8bbc67460d809746d07bccba46c748aacca0aa0cab8527fac2129c76f37b358ae965cf09558e4b1fad7791aa392bdc95785284b29b64d6641df9600fadfcc56c3aa9aaddb2300eda0f04587201ec4d376f565e5729bc42011ad63e539fbfb531a1891117cf790203010001a38201623082015e30090603551d1304023000300e0603551d0f0101ff040403020780302b0603551d1f042430223020a01ea01c861a687474703a2f2f73762e73796d63622e636f6d2f73762e63726c30660603551d20045f305d305b060b6086480186f84501071703304c302306082b06010505070201161768747470733a2f2f642e73796d63622e636f6d2f637073302506082b0601050507020230190c1768747470733a2f2f642e73796d63622e636f6d2f72706130130603551d25040c300a06082b06010505070303305706082b06010505070101044b3049301f06082b060105050730018613687474703a2f2f73762e73796d63642e636f6d302606082b06010505073002861a687474703a2f2f73762e73796d63622e636f6d2f73762e637274301f0603551d23041830168014963b53f0793397af7d83ef2e2bcccab7861e7266301d0603551d0e04160414aa0952602744b9cd668a7e22b467ee821e9a0862300d06092a864886f70d01010b05000382010100885351922425782743caf748ead7876211bb12c5cad49783f87e6e7480ba6460d1c7b79b981f846b6658429039fe7ae16d2c63656bc782798312624a1d3cd66db6bac77ed02e9d2e2919c02d97d40372befbf4e70b8575acc584dc866ac7c7497d3d0099146856568c2479859cfcd3c9c9b6f3640e7047c06cca84cda414ad2b4ae523844afb81f25f1c9e3f8cf0c3e14d166c1f37bd8611b95c36a156fb0fef118f327e617ab334fa2a62087f3bf70347d8386e812ea63d60556ef58415b05359843befe71aeab21ecfa427e4ff903718c97f7a828bb0c9a63ae7392f9f0354a760a21106f38594201640f49e3058e33ac19d58bc3997f380873c0d666259c7 DrvInst.exe -
resource yara_rule behavioral1/memory/4812-0-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/4812-11-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/4812-35-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/4812-2735-0x0000000000400000-0x00000000007EC000-memory.dmp upx behavioral1/memory/4812-2747-0x0000000000400000-0x00000000007EC000-memory.dmp upx -
resource yara_rule behavioral1/memory/704-2831-0x000000006A310000-0x000000006AC28000-memory.dmp vmprotect -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation 4uKeyForAndroid.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\SETEFF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\ssudqcfilter.sys DrvInst.exe File created C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_d0ba75672dc1a380\ssudbus.PNF DPInst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfa68364-361f-8246-a69e-d786f498b9e6}\ssudmdm.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840} DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\SET1009.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_d0ba75672dc1a380\amd64\ssudbus.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\SET10F5.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\SETF13.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\SET10F3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudadb.inf_amd64_55cf1c442f8c934e\amd64\WdfCoInstaller01007.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\android_general.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\SETF12.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\SET10F3.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\SETF00.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\SETF11.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\SET101A.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\SET1008.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\WinUSBCoInstaller.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\SET101B.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudadb.inf_amd64_55cf1c442f8c934e\amd64\WinUSBCoInstaller.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{cfa68364-361f-8246-a69e-d786f498b9e6}\SET1171.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\SETB39.tmp DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DPInst64.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\ssudAdb.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\SET10F4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_d0ba75672dc1a380\ssudbus.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\SETF13.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\amd64\SETB18.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\SETB28.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\SETB39.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\WdfCoInstaller01007.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\SETF11.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\SETF12.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64 DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudmdm.inf_amd64_99bdd5a4506ef81c\ssudmdm.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\android_winusb.cat DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\SET1008.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\amd64\WdfCoInstaller01009.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\SETEFF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\SET10F6.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ssudbus.inf_amd64_d0ba75672dc1a380\amd64\ssudqcfilter.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfa68364-361f-8246-a69e-d786f498b9e6}\SET1170.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfa68364-361f-8246-a69e-d786f498b9e6}\amd64\ssudmdm.sys DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\SET10F5.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\android_winusb.inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\ssudbus.sys DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_general.inf_amd64_ba6d6c70048ad29d\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\WdfCoInstaller01007.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\SETB28.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\WinUSBCoInstaller.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\amd64\SET1009.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{cfa68364-361f-8246-a69e-d786f498b9e6}\amd64\SET1181.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{79486bfa-1364-4b4d-9ae0-47dc47283840}\amd64\WinUSBCoInstaller2.dll DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{af86fbf5-1f52-e848-abaf-4662df9c32d0}\SET101B.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\SET10F4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{8a8a1087-5147-4044-8ce4-d8a25f31d102}\amd64\SET10F6.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\amd64\SETB18.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\amd64\WinUSBCoInstaller2.dll DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\android_general.inf_amd64_ba6d6c70048ad29d\android_general.cat DrvInst.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt DrvInst.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName DPInst64.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-AFDLF.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-BQ6H5.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\drivers\amd64\is-ER969.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\Cryptodome\Cipher\is-S8DS2.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-O8OR1.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-O24CA.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\db\RemoveFrp.db\Common.Db 4uKeyForAndroid.exe File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-K07P8.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-9D45K.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-9GBAP.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\is-D49DK.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\payloads\is-INFBO.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\is-DOB09.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\Monitor\is-VLV7C.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-4JVUU.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-4KNG6.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\edl_exe\python38.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-FKG0N.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-3DQ7J.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-8UKQU.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-9LDQ8.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-G878T.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\mobiledrv\is-QL8LN.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-1JUDC.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\Microsoft.WindowsAPICodePack.dll 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\adk\drivers\CheckLibusbx86.exe 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-FED83.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-C1UCF.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\api-ms-win-crt-private-l1-1-0.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-E955V.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-A8AFV.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\edl_exe\Loaders\oneplus\is-U83IP.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-F78PU.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-M3VG9.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-HFC3U.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\EntityFramework.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-BPMDG.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\payloads\is-M4SAT.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\TSLogSDK.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-H5A7B.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-RCG1T.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-NF68F.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-MB2JU.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\db\RemoveFrp.db\Common.Db-journal 4uKeyForAndroid.exe File created C:\Program Files (x86)\Tenorshare\4uKey for Android\is-CGA2C.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\exist_9008\is-NAII4.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-SVNU8.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-GO1NO.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\AndroidConnectSDK.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-4SO5M.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-HKU4I.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\Microsoft.WindowsAPICodePack.Shell.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-MEPCI.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\payloads\is-6AUOA.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\Logs\AndroidConnectSDK.log 4uKeyForAndroid.exe File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\is-JFAQT.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\Cryptodome\Hash\is-TG1H5.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\edl_exe\Cryptodome\Cipher\is-19HOS.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-IJE79.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\edl_exe\is-38DK6.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-KVIKG.tmp 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-V7EI9.tmp 4ukeyforandroid_ts_2.13.0.tmp File opened for modification C:\Program Files (x86)\Tenorshare\4uKey for Android\BugSplatRc.dll 4ukeyforandroid_ts_2.13.0.tmp File created C:\Program Files (x86)\Tenorshare\4uKey for Android\MTKEXE\My_Code\Loader\Preloader\is-JPDND.tmp 4ukeyforandroid_ts_2.13.0.tmp -
Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\INF\setupapi.dev.log DPInst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\inf\oem3.inf DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\certutil.log certutil.exe File opened for modification C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdge.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\inf\oem5.inf DrvInst.exe File opened for modification C:\Windows\inf\oem6.inf DrvInst.exe File created C:\Windows\inf\oem6.inf DrvInst.exe File opened for modification C:\Windows\certutil.log certutil.exe File opened for modification C:\Windows\DPINST.LOG DPInst64.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\inf\oem4.inf DrvInst.exe File created C:\Windows\rescache\_merged\3720402701\1568373884.pri MicrosoftEdgeCP.exe -
Executes dropped EXE 11 IoCs
pid Process 3004 4ukeyforandroid_ts_2.13.0.exe 2032 4ukeyforandroid_ts_2.13.0.tmp 196 Start.exe 704 4uKeyForAndroid.exe 4808 Monitor.exe 688 repair.exe 648 certutil.exe 4532 certutil.exe 3300 InstallAndDriver.exe 312 DPInst64.exe 3464 adb.exe -
Loads dropped DLL 64 IoCs
pid Process 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 4808 Monitor.exe 4808 Monitor.exe 4808 Monitor.exe 4808 Monitor.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs DPInst64.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000 DPInst64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 svchost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags DrvInst.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags DrvInst.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009 svchost.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 592 NETSTAT.EXE -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\4uKeyForAndroid.exe = "1" 4uKeyForAndroid.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\4uKeyForAndroid.exe = "11000" 4uKeyForAndroid.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION 4uKeyForAndroid.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION\4uKeyForAndroid.exe = "1" 4uKeyForAndroid.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN 4uKeyForAndroid.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DomStorageState\EdpCleanupState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tenorshare.com\NumberOfSubdo = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 970951c979bcda01 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\tenorshare.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\msn.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tenorshare.com\NumberOfSubdo = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\www.tenorshare.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.msn.com MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tenorshare.com\ = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{018C91A4-30F8-46AB-8B2B-87628FDBB246} = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tenorshare.com\Total = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\tenorshare.com\Total = "46" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\tenorshare.com\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4812 4ukey-for-android.exe 4812 4ukey-for-android.exe 4812 4ukey-for-android.exe 4812 4ukey-for-android.exe 2032 4ukeyforandroid_ts_2.13.0.tmp 2032 4ukeyforandroid_ts_2.13.0.tmp 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe 3300 InstallAndDriver.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4668 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 704 4uKeyForAndroid.exe Token: SeDebugPrivilege 592 NETSTAT.EXE Token: SeAuditPrivilege 1088 svchost.exe Token: SeSecurityPrivilege 1088 svchost.exe Token: SeDebugPrivilege 4804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4804 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 6632 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 6632 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 1604 MicrosoftEdge.exe Token: SeDebugPrivilege 1604 MicrosoftEdge.exe -
Suspicious use of FindShellTrayWindow 46 IoCs
pid Process 2032 4ukeyforandroid_ts_2.13.0.tmp 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe 704 4uKeyForAndroid.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
pid Process 196 Start.exe 688 repair.exe 688 repair.exe 3300 InstallAndDriver.exe 1604 MicrosoftEdge.exe 4668 MicrosoftEdgeCP.exe 4804 MicrosoftEdgeCP.exe 4668 MicrosoftEdgeCP.exe 4732 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4812 wrote to memory of 3004 4812 4ukey-for-android.exe 73 PID 4812 wrote to memory of 3004 4812 4ukey-for-android.exe 73 PID 4812 wrote to memory of 3004 4812 4ukey-for-android.exe 73 PID 3004 wrote to memory of 2032 3004 4ukeyforandroid_ts_2.13.0.exe 74 PID 3004 wrote to memory of 2032 3004 4ukeyforandroid_ts_2.13.0.exe 74 PID 3004 wrote to memory of 2032 3004 4ukeyforandroid_ts_2.13.0.exe 74 PID 4812 wrote to memory of 196 4812 4ukey-for-android.exe 76 PID 4812 wrote to memory of 196 4812 4ukey-for-android.exe 76 PID 4812 wrote to memory of 196 4812 4ukey-for-android.exe 76 PID 196 wrote to memory of 704 196 Start.exe 77 PID 196 wrote to memory of 704 196 Start.exe 77 PID 196 wrote to memory of 704 196 Start.exe 77 PID 704 wrote to memory of 4808 704 4uKeyForAndroid.exe 78 PID 704 wrote to memory of 4808 704 4uKeyForAndroid.exe 78 PID 704 wrote to memory of 4808 704 4uKeyForAndroid.exe 78 PID 704 wrote to memory of 3156 704 4uKeyForAndroid.exe 80 PID 704 wrote to memory of 3156 704 4uKeyForAndroid.exe 80 PID 704 wrote to memory of 3156 704 4uKeyForAndroid.exe 80 PID 3156 wrote to memory of 592 3156 cmd.exe 82 PID 3156 wrote to memory of 592 3156 cmd.exe 82 PID 3156 wrote to memory of 592 3156 cmd.exe 82 PID 3156 wrote to memory of 3916 3156 cmd.exe 83 PID 3156 wrote to memory of 3916 3156 cmd.exe 83 PID 3156 wrote to memory of 3916 3156 cmd.exe 83 PID 3156 wrote to memory of 4188 3156 cmd.exe 84 PID 3156 wrote to memory of 4188 3156 cmd.exe 84 PID 3156 wrote to memory of 4188 3156 cmd.exe 84 PID 704 wrote to memory of 688 704 4uKeyForAndroid.exe 85 PID 704 wrote to memory of 688 704 4uKeyForAndroid.exe 85 PID 704 wrote to memory of 688 704 4uKeyForAndroid.exe 85 PID 704 wrote to memory of 648 704 4uKeyForAndroid.exe 86 PID 704 wrote to memory of 648 704 4uKeyForAndroid.exe 86 PID 704 wrote to memory of 648 704 4uKeyForAndroid.exe 86 PID 704 wrote to memory of 4532 704 4uKeyForAndroid.exe 89 PID 704 wrote to memory of 4532 704 4uKeyForAndroid.exe 89 PID 704 wrote to memory of 4532 704 4uKeyForAndroid.exe 89 PID 704 wrote to memory of 3300 704 4uKeyForAndroid.exe 91 PID 704 wrote to memory of 3300 704 4uKeyForAndroid.exe 91 PID 704 wrote to memory of 3300 704 4uKeyForAndroid.exe 91 PID 704 wrote to memory of 312 704 4uKeyForAndroid.exe 93 PID 704 wrote to memory of 312 704 4uKeyForAndroid.exe 93 PID 1088 wrote to memory of 2012 1088 svchost.exe 95 PID 1088 wrote to memory of 2012 1088 svchost.exe 95 PID 2012 wrote to memory of 2540 2012 DrvInst.exe 96 PID 2012 wrote to memory of 2540 2012 DrvInst.exe 96 PID 1088 wrote to memory of 4804 1088 svchost.exe 97 PID 1088 wrote to memory of 4804 1088 svchost.exe 97 PID 1088 wrote to memory of 4528 1088 svchost.exe 99 PID 1088 wrote to memory of 4528 1088 svchost.exe 99 PID 1088 wrote to memory of 4396 1088 svchost.exe 100 PID 1088 wrote to memory of 4396 1088 svchost.exe 100 PID 1088 wrote to memory of 3576 1088 svchost.exe 101 PID 1088 wrote to memory of 3576 1088 svchost.exe 101 PID 704 wrote to memory of 3464 704 4uKeyForAndroid.exe 104 PID 704 wrote to memory of 3464 704 4uKeyForAndroid.exe 104 PID 704 wrote to memory of 3464 704 4uKeyForAndroid.exe 104 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107 PID 4668 wrote to memory of 1560 4668 MicrosoftEdgeCP.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ukey-for-android.exe"C:\Users\Admin\AppData\Local\Temp\4ukey-for-android.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.13.0.exe/VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\4uKey for Android_Setup_20240612033623.log" /sptrack null2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\is-DKOHQ.tmp\4ukeyforandroid_ts_2.13.0.tmp"C:\Users\Admin\AppData\Local\Temp\is-DKOHQ.tmp\4ukeyforandroid_ts_2.13.0.tmp" /SL5="$A0222,107792699,318464,C:\Users\Admin\AppData\Local\Temp\4ukeyforandroid_ts\4ukeyforandroid_ts_2.13.0.exe" /VERYSILENT /SP- /NORESTART /DIR="C:\Program Files (x86)\Tenorshare\4uKey for Android\" /LANG=en /LOG="C:\Users\Admin\AppData\Local\Temp\4uKey for Android_Setup_20240612033623.log" /sptrack null3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:2032
-
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\Start.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\Start.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:196 -
C:\Program Files (x86)\Tenorshare\4uKey for Android\4uKeyForAndroid.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\4uKeyForAndroid.exe"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:704 -
C:\Program Files (x86)\Tenorshare\4uKey for Android\Monitor\Monitor.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\Monitor\Monitor.exe" 704(#-+)UA-116569081-3(#-+)4uKey for Android(#-+)2.13.0.11(#-+)&cd1=2.13.0.11&cd2=0&cd3=TS(#-+)14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4808
-
-
C:\Windows\SysWOW64\cmd.exe/c netstat -ano | findstr "5037" | findstr LISTENING4⤵
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Windows\SysWOW64\NETSTAT.EXEnetstat -ano5⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:592
-
-
C:\Windows\SysWOW64\findstr.exefindstr "5037"5⤵PID:3916
-
-
C:\Windows\SysWOW64\findstr.exefindstr LISTENING5⤵PID:4188
-
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\repair.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\repair.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:688
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\cert\certutil.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\cert\certutil.exe" -addstore TrustedPublisher TenorshareKey.cer4⤵
- Drops file in Windows directory
- Executes dropped EXE
PID:648
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\cert\certutil.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\cert\certutil.exe" -addstore root TenorshareKey.cer4⤵
- Drops file in Windows directory
- Executes dropped EXE
PID:4532
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\InstallAndDriver.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\InstallAndDriver.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3300
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\DPInst64.exe"C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\DPInst64.exe" /F /D /SW /PATH mobiledrv4⤵
- Drops file in System32 directory
- Checks system information in the registry
- Drops file in Windows directory
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:312
-
-
C:\Program Files (x86)\Tenorshare\4uKey for Android\TS_Android\adb\adb.exeadb -L tcp:5037 fork-server server --reply-fd 40884⤵
- Executes dropped EXE
PID:3464
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k dcomlaunch -s DeviceInstall1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f3b65d73-9550-ca4f-b5b1-9a5e74c207a5}\android_general.inf" "9" "408d7d64f" "0000000000000174" "WinSta0\Default" "0000000000000178" "208" "c:\program files (x86)\tenorshare\4ukey for android\ts_android\mobiledrv"2⤵
- Manipulates Digital Signatures
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\system32\rundll32.exerundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{a05068b1-6268-184e-ac7a-c23bd94e2cdb} Global\{9c241fa3-0568-0c49-afe5-212ce03f355c} C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\android_general.inf C:\Windows\System32\DriverStore\Temp\{7f429c1a-1053-e04d-a112-bd73c22b5834}\android_general.cat3⤵PID:2540
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f1afea55-4535-ec4f-a8fe-cbe50d6a5156}\android_winusb.inf" "9" "4b06b7c6b" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "c:\program files (x86)\tenorshare\4ukey for android\ts_android\mobiledrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4804
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1a3e34ca-ee0a-3848-870a-89b94312dba2}\ssudadb.inf" "9" "431498427" "000000000000017C" "WinSta0\Default" "0000000000000168" "208" "c:\program files (x86)\tenorshare\4ukey for android\ts_android\mobiledrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4528
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{d2679572-5aa4-9546-8604-bc10dcaad806}\ssudbus.inf" "9" "4e71ed667" "0000000000000184" "WinSta0\Default" "0000000000000180" "208" "c:\program files (x86)\tenorshare\4ukey for android\ts_android\mobiledrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4396
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ccbfa0f3-dfbd-dc41-b894-d2278f82bb7a}\ssudmdm.inf" "9" "41bff5877" "0000000000000180" "WinSta0\Default" "0000000000000190" "208" "c:\program files (x86)\tenorshare\4ukey for android\ts_android\mobiledrv"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3576
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1604
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5068
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4668
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4804
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:1560
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6632
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6900
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
19.9MB
MD52fc239fc68d1fa152c95478fa10c9136
SHA1c3afd7bd669e271f1dc8d7696821f0a4798c181a
SHA256d4674a751b0128e4860ba4f578cd62212dd273128cf55177c13906e89947f123
SHA5122047d004c4411e64affa0ecfdecc7084aca206dc12d5356d72b4937c7bd6c92ee907ff0627868c763da5d3c8b342c2897e94e81c9d5be84cc55f127cd4b2308f
-
Filesize
3KB
MD506274d121c249ecb021bfe2d7fe66c28
SHA153b6c3d6680ba089c7f4da9a45489cdc95307f62
SHA25620e97520639a355f5fd472cc7ec056af52214ad854f8746aba805b26b3034a58
SHA5122be6221d9dbfd67c207b04b45bd71901cf58ba092254a41960ea4d21ea80dc149ec96b378ac25147901fe1f493e42b2b0aa1f99b8745b006019aec90aa59de2d
-
Filesize
181KB
MD598afaa8a927c3d76a230f935ec735b94
SHA1ad410dd129090cdd8a4fb01653dfc74fce26f15e
SHA256887f6b2c9e8a559b1f84b139b032276503f43f59adbe12ae7bb437e5774b026e
SHA512ed8aa6b2ff29efef88f0e1ebb8005fbf8d04d3bcc1ca420dcbc5426ee66ddcb042f9ac1768f29f722b47e346efb7716a819c5380c6f766b34c8e08d2b007ebdb
-
Filesize
640B
MD5a559238487c685f5bd9c1ed82b9b55e6
SHA1bdad0bd40b5f50df6824826ea613d3aa0d274199
SHA2566c6f55d1e364ad7691bc5f74973fe4834e3a7a1ccb5f81ac635df8580dca7404
SHA512a80a3a3eb216b582d542918a1e4fa08bf320f984d409c380fd2382db360189bb940fda264018e772da8f966d2b2d15c73defd10f9cca229aceae1dd375bd924e
-
Filesize
2KB
MD53080fb142ef1e238c1cfbd0359b09f8a
SHA15815b63d8d3b72ff10cda3d7a5fe89cbc49a3724
SHA25651cae7476a7e3c9b8837ef1f75fb97dab58c7ac04796ea9125c82a47938747b5
SHA512c7e52247322575c21f0d8c6302f66791a178a7dd75945c61220372710f5e47d40d4343ddd5692adc6a833d0a47088cea7b3f74aad5a7c7b6ec7a8a0b9386d91a
-
Filesize
592B
MD517630d7cce9333d2da772222383f0bc1
SHA1d56bc8751354b88b3b10356f2f1d3c139be1a613
SHA256f7ab4dbdda43711e3d5196d3ff40470a0a048b2bea3746e25bce82fe878e80c9
SHA512b9f2af61cb8f10708df07b55a7a7965ebaa2b5b288a5895f74d8c08cbd99c8ac4948e5b1dafeebacfed71621c7dd232d4df95c7779f28d7d76344bbe5afedfaf
-
Filesize
1KB
MD5dcaf1ab876c9c56941e235c8437b5b16
SHA13c340e7897993f787828289548a49d393854d749
SHA2564e4d3dfa8e3e720149ec144a20f70c8f237ca5da744333fc726cfa50520e63f1
SHA5124b7e41cf9b91f7bc21efb0a6c8954164d0772c16166baff191b8b193ac13a1c62e85e04b54ed21004b0e2ba83aa931c3464981760b3e3094b105945ae8335dfe
-
Filesize
10KB
MD5fc0f6c3de5494fb24dc645bec6f98db9
SHA1701af41b33e4e4ebe064cadd26fc17debfe041e9
SHA256c2e704c34ba042db147a8e62a01662dbe4994afda9db06389f2d5420be704684
SHA5129df666d873cc299ac2475f612e463908fc848d54db72b4d01aa81411ecb8c200de60eddf32c2144d80234fccee5f5b7ccc39a9c6bc843b3a0f02f08312d65305
-
Filesize
4.8MB
MD5401f4ddaf63f58bcce275a1fd686361e
SHA1cb8d6f07927dbc178f6371d54061cdef6179bf49
SHA25617d90f1052d42a555f40497e4cfdbf3d8c8dc55665ded9a56391625e1368a85d
SHA5121f53adf9a73bf1610ec5aa20dc537f95d92a3d85e1e043a5cd225b8eba1d5a247bfc6e22fd13a3b5b2740feac50a91eb6c76b095e3049dcdfd50dea07e97dee7
-
Filesize
545KB
MD5abddb20b232215b1210dae717c837269
SHA1d255b7781dcc15c1c8e99a3343d0b2e6d4fabe64
SHA256fdf7eaa1aff7cdef9b11ea39dde3f720a9c884e309968dca60476895f9fa6519
SHA512f9c18f905b88e06853c6cfb026aa50bdad2afd0da3bfcfe867c29177844251eda8f453e671c546e80e686c6d0fb6f2f34cd90ec35269dd64e5111f62e7e5b424
-
Filesize
105KB
MD57db9d918e3f9e3da8101a64988ebfa27
SHA1658d0f7c05f78be5ee82fb30b9c4d11f0f580fce
SHA256c6b9d47491e47d3302b0d752db57416438767fe357719fb62c92f58bb42ca8ba
SHA5120fd37a0486965d019dbbcfa251399918cc026db39816218e6deff2cf1b9b46141a524961716c2ec7a7b36d1a694406a41e08ffd7bf99481e081fccaee5b9077b
-
Filesize
166KB
MD53935ec3158d0e488da1929b77edd1633
SHA1bd6d94704b29b6cef3927796bfe22a2d09ee4fe7
SHA25687cbd1f3bf5ab72089a879df110263784602a574c0ae83f428df57ae2f8115db
SHA5125173891b1dfad2298910236a786c7b9bbcfce641491a25f933022088c81465fb93fd2385d270e9a0632f674355538da464d1edacf511140d6f31d91d1afe64fc
-
Filesize
252B
MD5c7549a0e6912d164407e9fe0522ab52d
SHA1b86db04eead86cabac3641d661db2f57f5a8c540
SHA25603da737ff8588340015de3f5950aa085458fae5959fe627c129e4b8efb4cae1d
SHA512afe497b48c5a829e21431c9ebbef18b6a3124107d36db309c87ad7215cbe82f6ee0366859fc02e41f30f9d0374450a1f729491c650352bf36e810d66e3238b4f
-
Filesize
55KB
MD56faa7c6a31842a499be6f6a5b8c68811
SHA18b2598a5a0ade60d192769d3a7c199d743751b76
SHA2568dad00573b42f5732598c3c35b52e5afda2dd56fefae00ceacb4005d43ebf240
SHA512d9dda2d98e93dd95c942c2d4637749dc0caeb277113f8e264655a0d5c30c65588ac78013c278fd914ec3314a473d8a76af837fdfa401b1ecf315a82493f9a064
-
Filesize
55KB
MD59106e3f0da38c9cdd56b4cdbb7e3fe9b
SHA1f49fd975872fdaf92275b05cd2acbe536f7cfd52
SHA256295b12ca3064203c86e785365cc46616f9f207c7969def40ac25b3f5d643340c
SHA512e798699f0ecf195b251cb7bd9ee984ff984399e01197baf92f45c1ea5b7b0a4a4fbbb5462c32f8e70737e1a63490eaaada0ebc810f19b4ce0846cb84cbd67061
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\#!001\MicrosoftEdge\Cache\HFLNFZGU\rn-ui-tenorshare3-1.0.0.min[1].css
Filesize123KB
MD51ae7064d57d52db2655c17a595c122ea
SHA17b0695b23d35f0ffdd347aac377683bf278441c7
SHA2564592d559c15f98067c64e1989ab0a43b73425b947a4833e995aca0fe41387259
SHA5126b8482f22027f4e8bb06c2bec4ff07e47b497018b6bff969752d42dd057a031fe2134a1a63c861657ca7642a857ebfd91034caea59940e9fb14ea579417ca80c
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\Cache\JY2VR9F6\logo-2023[1].ico
Filesize4KB
MD5d8a36816a5903f46e0b9f060b0f89a83
SHA1a307d80aae145698491eb2ad16d506c5fe05c952
SHA2561d2ee1993423875ccaf834347d0a81049ce6ba7cbf86719268c1e03e0f4aea61
SHA512dfadc9d0b492bee2f41264c5294c95fcf8bd805ed5921a35acb06e087164224432fdee167233f5ba1419c136dbafd7ecfed47f7e5766dab167c28a7d9b655765
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\Temp\~DF80A4A1C10994A189.TMP
Filesize24KB
MD5d3cdb7663712ddb6ef5056c72fe69e86
SHA1f08bf69934fb2b9ca0aba287c96abe145a69366c
SHA2563e8c2095986b262ac8fccfabda2d021fc0d3504275e83cffe1f0a333f9efbe15
SHA512c0acd65db7098a55dae0730eb1dcd8aa94e95a71f39dd40b087be0b06afc5d1bb310f555781853b5a78a8803dba0fb44df44bd2bb14baeca29c7c7410dffc812
-
Filesize
1.3MB
MD575a53f57a5f8e0c6b049b810fcff315e
SHA1b00bdaa6c7c04f895d91ded7b83e1810d551d2fd
SHA256fd5fee4aa6a6fcc71a6b5f55c35fed1fb6e3c9c0ec75489bf54f59252c8e0219
SHA51237d272fd12bfcc215deb54c8f0aba4e7cd0783548a0a43f13f4b74cb03c1d8a01c4b690d24eb306d2e25f94b3cf3dd9422ad0a6fcee96be3d518099502b53eb6
-
Filesize
30KB
MD5c737261dd3748b1851b01b6d88a89585
SHA194fe1bde09975085b4a464ee01846b6b3283d3f6
SHA2560fefdbc1a0b2259cac93283ad18b16b3390a4f9e2984d6b96bf601b591f20f66
SHA5125ccdb39fe34a9144b815109f7317a1e1bd6a78d86952a734cdaa2303255e56ed73471231acb27f256658ebd0c91d897750aa8a4305a3baa8977d9f3233465bda
-
Filesize
4KB
MD55b19b37f2db547aa46ae5bbb742d1a1b
SHA1701281e8283e9e3681220099a9da5013a5a437af
SHA256caacb8a0af03cd1756121deda00344a8a808000c6a1633ed7d520cfd22c26eb0
SHA512c005c5b45285c90d3c82c8933ccc0237a1716ae38e6354c61c8cb97437f6ec64b7cf8a5930c81d1c5f7489d5815cab7f2a0eabeb232478917f814a15ef35bf35
-
Filesize
208KB
MD537680aeca1bf2d430719a297f68ecd49
SHA199a25f410cc1cdba3f53b8ef9d50bb0ab6c8d8f2
SHA25664e6a2c077316ce4807f2f480324f4011003686f698ccb0aa93c659daae1fab5
SHA5121f95496307b9a48706d59572219f7ae55e55b47b5c0dd388001c4f12d22ed559482db77a0d460580c75290d9d30b63615585a680f8951e1c6a146bbea5819848
-
Filesize
29KB
MD5613ef003087cba0ef5e4672fe521078f
SHA10df801e371af14329b41a274d11cab3be2aff7f4
SHA25608e5698aa190265b85b72ede336738aa67ab72db3036ed6925b838c2e3398f34
SHA512c79c117e7628b6b0da119ff334b21ec0504296eb82ce98eb3580119ec402e3149be8b91d3f244aa2b7ec3c4f7f8f4d654694a27ae30db5d8359c146bdc5bbfa9
-
Filesize
49KB
MD546ae75a7c8213cfd255693f2e5e56265
SHA188ed314360b98e6e82e7cc3201faeb4a9fd291b4
SHA2564d6c35449ceb28237b3efbc8816196cce7546537a1000705e0e33b7b0c3dfc7f
SHA5122b1bf8f7274472146203e5d6e51a5b81306c89aee5ae287ddb9c5a0bdba9b2831d1ab11fbf5a10aca6b6795b06b0ba34d70631b534b7db555474b65390e08e15
-
Filesize
117KB
MD5bc319c065335b10a5aa5938a677a60d5
SHA12504afcb10e538105a670c873b47656ee799d476
SHA2566f32af2a440e763dc2add06f3422dcf3285bdfa9e69e5c3cd67a10f039b2830f
SHA5120c19b616411af9cab7e419da8a1cda65cb3f6bfe3e82700c275d2aba97ad46ee8385909a432ff2682e811f8834c0159b2d0b332eeacd6d4f067d993720cd303d
-
Filesize
54KB
MD5bc0e0f5e7cc6b5a4c1eb406ae2b6c85b
SHA10f812245bff2f40f7eba2fa3f1d0e68de54d3354
SHA2563eb684f76a6ffb2c7a6f52f4efb70d5c0e500cce4c88706f10cdff1a06faac83
SHA5122c3e22b98d8d5c561b306751d07d75f93f0b8081bc2ac731af79e4a07da8c4e3b4774164eacfd05a9fb379a7d220808735eb78143662b78731e66958d8366a4d
-
Filesize
30KB
MD5e2abd1060f2b4b2a3946208f20a2a05d
SHA16ecc41b90dc29eb5f3b5b3471b5b357ebe56d45a
SHA256a0906ecad6bf8cd05bd5b73077ab5c228bcaa529e54f290b6fd72f40609a47af
SHA5127db9e69ca4bab295cd2662665259a1911091700102fabfd02f53dc1c3e1887157da1d0f7a31ee4ee8fcec6a788380095d0282b6d0e50b862a53a0e5e1d12d13c
-
Filesize
12KB
MD5e9553abb6404746c5a3f144447eefb79
SHA185a33267f12961af9ed9ae799deda5e62bea236f
SHA25661e0b4d0b8d4d854fe0b3064eb799bb917947d431227f32d4e4e2fc6063dac2e
SHA512dd811c54513cc01ff0f9ee802549262a54b74cce203332f200c1b7ec4880589cb50e1f5c9d4cd4b6e9d7d1c0c3316e070982b6aa7f29f76df7a07656a184092f
-
C:\Users\Admin\AppData\Local\Temp\{f1afea55-4535-ec4f-a8fe-cbe50d6a5156}\amd64\WdfCoInstaller01007.dll
Filesize1.4MB
MD53743ae1bca793fecb691c67ed4640e10
SHA11ca41b65159d64dd6cc95f0146884d96c7c9514d
SHA2565324858c8f8fe2985adef687478475a0f40ee47892145a4df26ca4532e8c67e4
SHA5125be0a24a4844c763ceb167006eb663b7722aa40b77310886d22d184916ec36601285feb8a7ee79a0df952f00354bbca1da0f9d353690f586303f8b5a42af5560
-
C:\Users\Admin\AppData\Local\Temp\{f1afea55-4535-ec4f-a8fe-cbe50d6a5156}\amd64\WinUSBCoInstaller.dll
Filesize694KB
MD561591d21c9f63a427782c673757f01a1
SHA1b090fe47327e3556476550ddb6269c8eeaed0015
SHA256ec896fe452bb9fde9e148dda20c527b8053ba1e98b74bf47102b2ca1e4794e13
SHA512e388a7af4911f3794b66cff701fb4232f35f03d404d63ee95651ab40e9cb26ed425497d37f63c9e1f3be14a45a8ee79ba055836539670fc92c5ad350cbdfe26e
-
Filesize
80KB
MD54637fa749ec464a904dc514a654be4fe
SHA17ad8b58bf97c0570cf4fe4d2e81f25547d6e0916
SHA256958d3a85eb3d63fafa805d170eefaad1baaf431fa0fc836c7c5c811a9ff79b70
SHA512cb2fe02525b59635122abfda7d214b3f99120a6bbbff2cb8a40edafde8564ac9fe980dadf1f660d2f08452b7cae0a72be762663c4769f3b4bb863ccdc8f73df5
-
Filesize
96KB
MD5461bc0c9b848e1ffa52094cf9b2d29de
SHA170ee67fb13b2f2be1f5a57ab193643aefba8d39c
SHA2565b02e78de9e81a9df5d8d94eb88e5045b28994b586f24f282d339905ceef5052
SHA5128e2241c83fd9d0064849410ca2c1f17f674fd9714136a5e37729902c4a3a237cf7cb169e58d4f9d066748d11fb605845e4141b3917a25018e9a5baa51b7b1faa
-
C:\Users\Admin\AppData\Local\Temp\{f3b65d73-9550-ca4f-b5b1-9a5e74c207a5}\amd64\WdfCoInstaller01009.dll
Filesize1.6MB
MD588db5179ffd901f3baa2ad67080b7173
SHA1514d54016356cc715b1055c0c2f3e9690e1f3b5f
SHA2561cd446e97e112db2235d8418195d53315a929f4efe157066151eecd58d93385e
SHA5124cfc131c0fd26b25fe1fc89b28eec4662fdbc8fcd914c20ab25a1178764ff1dcad65250de42fc66a9a54a5139b98db903bbb53903afa6f70d79657f2fc9f8870
-
C:\Users\Admin\AppData\Local\Temp\{f3b65d73-9550-ca4f-b5b1-9a5e74c207a5}\amd64\WinUSBCoInstaller2.dll
Filesize983KB
MD52522aad5fccbaf4f689a80d49c11930f
SHA13728e15a4a4e7a705abc0190990a04e9349dc94f
SHA256cbbd9824b24ed78515a74d2d82a759c46a48ee0533069eced1b59811ee92825b
SHA5123fb98a7f609ac74a3c765817e8faa324c4cab83539857329afcaf34f213d99750837fe7b0d42e289e88690ee5f81c69869a4ea11285f2a4e5fde2c75270630e3
-
Filesize
80KB
MD5d700af17f6b7daf62ff0e51b8ba7ed78
SHA1da57bbf4c482d4cdf8ea87b95123c30ae620b628
SHA256f3a741dc23f5c8948c882f888e4c6b86c2fc5c4d2107d37e87d36399b9c25137
SHA512805b73b8d659b837cd743fa424b8f4be15c357e3af6c0e011a8942d90459b7a1bf93f1e8f7dcc313ad1fd06124ffd528e83321ce5fa4fcf9d9d4e700eff5d024
-
Filesize
2KB
MD53a17e20ae8879d95f89737d2d0a63dd0
SHA1be156a27afeaea39d6a7c9d25cfa8dafaf91756b
SHA256c57bb3a91d37b71f2ca2add50f295d44058c2d004dca6449f3c6896b5815d88f
SHA51226bb7ba4ba0c42b01a418fdef94f10cb107a372568977e903ba26af08a8f4e3e79881fc26b5330ccbf61b0c0cc0d3571a576037c6f09f406e45229de40d3b527
-
Filesize
93KB
MD5646444182a52092ae150561417a555ed
SHA144e893e761b2afaf1ead45c8f02c030670538549
SHA256cd1f4b314b87da34416274183ca499192ed733d75d2f150fa893f8df84957f69
SHA5120a56c61d4e91d40cc877b0302dfa12cecb91df7a27cadaced40c4c9f0a5aa79b9a06e9e7e940a0b95bad79304fc2f610ce01a5a04954f43358ac89ee471a836b
-
Filesize
71KB
MD56fba496860ba419c2a4c3408833e7a41
SHA1c190138e738912e931ec1e6a799367ed1d7cda52
SHA256068b6e00ef3beb624468c4ab8ddf0e89defc9ff594978a9d0780b4e95dc890f5
SHA5129f6a24f44b6b0b6295684a40dd5f056d22b40789d9c8d95be1700c6e360b4ce3d5bec8567077a913bed967e39a79fec75d6c2b72e7ebc1fa774f5ffe8a13cff3
-
Filesize
312B
MD5ef9926e7a8bea56f7c3bfe05f1b18973
SHA1636e12906e4704c870efa7cfc2e07113f0a53323
SHA2564b5e5d4029d3a60d0712e754d426dd144b6cf1224dbae8a3280db223f9eada9d
SHA512a3d5416de0a474d7255a1efd31736ff75ddab6b37541f1ccbbe0ee3bbc5d56ce5890dba1cc267af56097b3c30117ca90bb703678760785c50731bfcaf47681fa
-
Filesize
18KB
MD53a1b808695e771a5c5862847975110cd
SHA1fa55750486e20a03ea2104c18f7a9e15889a640a
SHA2563561a45cb01351ac80e7128c884bc610f2d38990d5b996596272e555dd0ce0e6
SHA51244c043f8ac7dae6edc65b5e2f86c19037b74eded6d60115445b131c06daf179f39d27e0e3d2848e286f7479c4e5d99966187053d19ff0a89c07b509946b3a41f
-
Filesize
7KB
MD5df483136fa23957c63d59a38abc2d9bb
SHA169eacccc5fa674cf5fe0daf9078bfa56a574cc24
SHA256084747988d360ae9c9b88cac88a71e0e16c5b4e317219e799a320097a39f51c5
SHA512cb6b12ec3f50f7cf55ac11a91ccb3e323878cf7d4508fb040e513dc8dbf9f3f0189534041747123a86a2aacfdaa4632715e153e7792579260e03969719d82f35
-
Filesize
1.6MB
MD54da5da193e0e4f86f6f8fd43ef25329a
SHA168a44d37ff535a2c454f2440e1429833a1c6d810
SHA25618487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
SHA512b3d73ed5e45d6f2908b2f3086390dd28c1631e298756cee9bdf26b185f0b77d1b8c03ad55e0495dba982c5bed4a03337b130c76f7112f3e19821127d2cf36853
-
Filesize
51KB
MD5c7d21310ea0a644aa6394de1e46e3d31
SHA138a4a10cd3868e4a7874ba633c7b13c13de3f33c
SHA256597f27a2696f945fd6388ca62d5ee98e44694f477f57ef8a68c2151b2276e838
SHA5121cb3279c156773579005733710a25aa317b3a3a08a69dd5b2729b80a0ca5fc35a4f547666598d1151503754539f7a7109bb4ad603af84a1d2e4a7635d5cf7a8c
-
Filesize
232KB
MD597470a3e5505f6fdec57fa1e4126052e
SHA1c6081de4dd374cb7f03d2c52d2a9eb28fe92fefd
SHA256fe26c89b5851b3807b9000cf2ffd6e4083e2f567a4019b5a57aeb9b976064cf0
SHA5122af7f9e98f2764b9d4e7b1e16d91588c289d4fdeb2a273370e0814d541aad40d47f6725b9341a59c02064ef9b08a3ab5f5e442373fbd463346de24bad3a4f38b
-
Filesize
46KB
MD5ada2d34031c8981d8a31089733ebff0d
SHA1133e460cf09a25e07c669db850e61bb5e8ec572d
SHA2560f86090e2493b77ef3c2169c6b573306685606341519fe3f99ee09bfa12bdf5d
SHA512361bdef7546dc5da84e972b04f43c85e1532d539e15c78207ed70729d09f92ad8d09cd63aaf33918ea5a6c37c6fee6067d729ede4b17394e432d987b3e3533c1
-
Filesize
979KB
MD5246900ce6474718730ecd4f873234cf5
SHA10c84b56c82e4624824154d27926ded1c45f4b331
SHA256981a17effddbc20377512ddaec9f22c2b7067e17a3e2a8ccf82bb7bb7b2420b6
SHA5126a9e305bfbfb57d8f8fd16edabef9291a8a97e4b9c2ae90622f6c056e518a0a731fbb3e33a2591d87c8e4293d0f983ec515e6a241792962257b82401a8811d5c
-
Filesize
148KB
MD50e36781bb0f25fe141f3fd13e733de6a
SHA1fdbd8c2ae37169d4eed84cd1adf4e4a8b666e561
SHA256749f67297cd87fc45d0986e3fe9ff0977a80f80d63188885816bc6f9324892c0
SHA5126264de32c517be4fbb2872d18e77a0f0b078142acf344e6180b7e54399654354f82052f66a4f1d2e9f332bfdf1b1ea644599fc298a078786584d4c32d02d9be0
-
Filesize
43KB
MD53f886ccce73c834d0ba9a07b89a5adad
SHA19a88c6dcf2d6c77cb13da92c956cc0fd23882e7d
SHA25649a8af4fc09a41b51744b936c9e7700001020f3c5ac4476d87767c6fc3ca2a1c
SHA51212e2de91ea28d09db246d22a0fc9c8ba04c6a1af6722c8a933556ad9ec6200770dfd828b6e43f4821afb258e9122de41d4aa42ad912b4e0c7f26101a1115b94e
-
Filesize
1.4MB
MD5a9970042be512c7981b36e689c5f3f9f
SHA1b0ba0de22ade0ee5324eaa82e179f41d2c67b63e
SHA2567a6bf1f950684381205c717a51af2d9c81b203cb1f3db0006a4602e2df675c77
SHA5128377049f0aaef7ffcb86d40e22ce8aa16e24cad78da1fb9b24edfbc7561e3d4fd220d19414fa06964692c54e5cbc47ec87b1f3e2e63440c6986cb985a65ce27d
-
Filesize
41KB
MD5b716d4d759663bc4174fd0a379da8e50
SHA1d3ec6dc9a60548754f78079b3454827acd7fb210
SHA256cf05e87ab212a0f8a6f3e675448de1637042527a32b086651c27597501ee833c
SHA512c43713dee7082df3d6d172d88c21d16722373e1cc1d60b01e00c9fd4ef84e8ae52356a5296d43193034a8b39b92b871d37b4192a1737b1e03de22fd09522ee46
-
Filesize
40KB
MD53081c6c34049d16d519b3b23776312e3
SHA1d213d5b2ff59819c326083083d4c5a2775ef4334
SHA2560dc8fe163846582e710281d30193ade4f312e49b8808feec7b1bc0f526c3a75a
SHA5125df4f0e7566a0dfb000f52f6c3d1939f9930f02f23263995d7e36bfa2fe5b7f85668fdb0bb40042228e8e336f6e249accc2d06fa867f85571e0c2f5b31e78224
-
Filesize
831KB
MD58e7b9f81e8823fee2d82f7de3a44300b
SHA11633b3715014c90d1c552cd757ef5de33c161dee
SHA256ebe3b7708dd974ee87efed3113028d266af87ca8dbae77c47c6f7612824d3d6c
SHA5129ae37b2747589a0eb312473d895ef87404f4a395a27e15855826a75b4711ea934ca9a2b289df0abe0a8825dec2d5654a0b1603cf0b039fe25662359b730ce1a9
-
Filesize
247KB
MD5c01f0282933a1e7557bcb8f449948592
SHA1393e33b977e780df93dd1c7ec942272dda74a5d5
SHA25681bbc770abab99437a995f75a1f132f8d2e4a60a6344e9cbc7f2aeae3e2309a5
SHA5127cf4db032ebe62b0cc1cd00044de88a18467e452de25463c50e26f3295b19053af5dee465b0878c2ad2dc78bef86871d672806415d7ba1dcbfd84353490c2510
-
Filesize
21KB
MD5554019fe8a53a9aefecf8c148e745b78
SHA137e32cad2dfa3167421eb5a50c527fa9b44ad3f9
SHA2569851989a35a8ec1d830066bc79e58ff489b8654d84c26f4275baa3af1f277b5f
SHA51293db34a0de5fef0ed9708b93bf61c4298cebbb23ec5eb96eb61f72da8e218afa7fdb85a324f528a1bc6b03bad7ea7578405541ed7e8cd6ede7d9ff65f20b87bd
-
Filesize
232KB
MD5df201e7262845dfdd6c34e72ea55fa8a
SHA11c4848d56f9b943d625b1a6a0bc1be7c127bda2b
SHA2569c17098f53b106da730669a3f2e20a487a5b75218b61522f937c6d8cebb87a50
SHA512e9435e5a6dd37f1a681d0c8cb7c255301f802fa84220fee5eac9c360f8df37d55cc8236301b5777887c21921d28390067dadc2a4c80a011afb160869ec1790a7
-
Filesize
677KB
MD56e6180411f540473e7e5851cce551cd6
SHA11c4ee47fb1a07f88f99443fe2d1477e0a66815af
SHA256fe8ae60382cab62c0d061a7fbb55262a660a871992fcaf489f66a28ae1967bdf
SHA512e58615f83dd6702f6878601d99bf4a2ef09a376c22ef6e2e5daf085bc6278903e8907447f70ef1ba479b307c0826424f094ef5aabc0a9204c80d33de71f62c68
-
Filesize
61KB
MD591cddb44624f3d6104973391870c5144
SHA1042565cabb047e36b7a2288542a57ba028776126
SHA25608ef6f20bfac0dc64ed40f10b1ce25516480bcf402adeb58ed62772e8e9ea471
SHA5121b31618432a66207f2f8256dcd26fa94ed85d37e9510306f61e8093f11a132889e036cdf3c8e9c00b6e5b205beea854baa9941ea5bef51d23f0f4f08d06a978f
-
Filesize
74KB
MD57ac317503f258008ee8a6b134165bae9
SHA190d122ea4fdd56bb740c9a4cde3d085bac475d04
SHA25644eb29ed114d26a4ef27f5f1c1204d396d2a8f20ecf6a1be5cf12fc0331751c8
SHA512a4748368e6bb26caa8ef34917851d37ab90b1e6cf437e26d048608426693e255e20a3ffe6709d10a549a2f75e25181174cdbd37dc76041344ff884e7cffb8828
-
Filesize
79KB
MD5ded964684dcc1c1064a21c762ee2dc2e
SHA1b351a746a5891d00128b914f2e14c73dd0baab24
SHA256a1831bd6b089eeba34bc08e7b2413a4b2235bcdeac806e3c44c6f1e04f961d34
SHA512bfb792ab42d1f2a63156160ce0daadc2f7082b2a78e7343ed9cd34e114ddf0b050cd4ea84b8dff89c82f0d2b53292b70039f083ee3dba4925eb25630c3d362d8
-
Filesize
54KB
MD5580244bc805220253a87196913eb3e5e
SHA1ce6c4c18cf638f980905b9cb6710ee1fa73bb397
SHA25693fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
SHA5122666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
-
Filesize
68KB
MD5a5ebdb6a6a6765fe62cd520eb5a29400
SHA1df9cd98287d48ba673e4390ca34cbe5697239cca
SHA2565dab592210a41da93f640fa647f432aae3e186d1f79cca798b19144d589b9002
SHA512bc2df4695735350478bcabfd52718bdd3167662954acdc79f466c6a0cf813c6cbfe0f06d787aaceaf3180a5751d20a94d4ee2b65bfd981894fba0ef91bafb2a3
-
Filesize
344KB
MD549f5a7d99965473e366f34a911c03156
SHA18915f09b066443c2f38051ddb982e5483b0f26f2
SHA25626215f8a595a8aee41267ff7cf07a9c510af7f3e61a77f69c77d2644f4c727d7
SHA512fc88707e9aa3548c5a16a65ce65beee5c63b4dae5d5fc8151059e8117abce7dedcca41f4aaec9afdcfeeed11438250c58d54b74ad85c88f28ea2e5d24bcb5b73
-
Filesize
260KB
MD56b48ea282b62e610b683d481714631a1
SHA105949b3b08b6b5a2554fb2f3673eca07dbd5cdb5
SHA2568c561e1f29e16359a95d476b94d1f2a9fbad29a0e98676aa5fbfa9f3888543e8
SHA512f17fac6227dff63764bd8191c75707bbf9df6f900da0716f4806fc08604ea49ff74ca95f458dbb5f152b71b9862987737b5aa95ed1ccf5d938536c131b2a1bc8
-
Filesize
519KB
MD594237c2bb096f7c941d66a3c3f876f89
SHA170767de4d3ff372b5c9f3dc79fc9cdfefa84bbdf
SHA2566f6a412ccea2986308d10369f33fbc2f3115b6b052d07e0a3206e75b4a7e24ba
SHA512cce946ca4ab40d9c7af3cc232a20a43cc757dd4fd8265fbaded24ca56f7804d0045805d96491b1633f609864c5d2f07a05e9289b7d0b0035f2ec5f3cde6ee4ce
-
Filesize
826KB
MD5329fd88299a7e1fa62d7504c871e1999
SHA15b538e3a7b942399bc4b361c9f071ef17a62c508
SHA25693662d9ba21f5f17d20abd60aafffde1d6a657ddba3d9ec0b52a929c259ce36a
SHA512bf1f0c6d13960e0e47cc6b63c972d89f64a9b1e178e7e9771b12f064ba01fb534d44ec7db83571fc635cb94e8ef7e9485ba7e63376eda079cc6d4ebb3283b423
-
Filesize
6.4MB
MD5dca27d754aea7838434cb731d76289e6
SHA15b22a9e576b2aeaeb90b7bc0bf9b592138517cdf
SHA256fdd295538c7ff5d82197e6f1edb2a2422e6f2d1607bcde9d573760a0585b143f
SHA512a5f26727ff1e29d193628d355bc062cf3e3db69f4b6f5fd1d5c2f4b8e79c85e9f43e73d7d12cd3e593bd0edf07d4f1413ebcda066d89efc8805e56c6be1c5ce3
-
Filesize
274KB
MD589fae4917324733916b9a4d59aed4a6a
SHA1ae38246943f7197d7c68d2aa28990214bca898b6
SHA25628d4294e82424986102aa3f55beee539db737188aa99e07dba1e890a20fa990a
SHA512ea35ea6bbef497ffc16ef11305d4860dc42f12c38e52997539a95e34a2adfaf7e3fa362a9d25452dbfc58744f6257aae2a6c63625d3c50886e55d8153a85bc8d
-
Filesize
429KB
MD5851e7732d09151d218a2e7c3bf2dafbb
SHA1f5aca8cd8da53976b13a4adc9c6111356803c4c9
SHA2562545c8b2eab83c9de0e48a36923949d30837dbc61d638a5fb879b0c9d647976d
SHA5129fbd2e66cd6a107e14b083372ac3303058e3978c8616b9e3b79a05b26066c3681d16ca8c2f29423e53af0e3d3ec61745414f9845f416fa7272a3a7ffaca65465
-
Filesize
411KB
MD5ba144e0cd4d3f82598b69bbcc0d30e78
SHA12b0571f4e7934ab53e14b5ab2e4f8dd25491af9e
SHA2565253e1f1bd5ba20175bc39b53afcd87d42d609c49c52ac9784baafee51a45272
SHA5123385cadcb8d109e87cbd2930d508d3e55952ac9c6b2a86e66a1e2dde398c39df34e00f04d7bf9d3a27639e6b02dd34228ffc1c031de8bfd713e0c9b10c49d0e2
-
Filesize
81KB
MD5aeab74db6bc6c914997f1a8a9ff013ec
SHA16b717f23227d158d6aa566498c438b8f305a29b5
SHA25618ccb2dd8af853f4e6221bb5513e3154ef67ae61cee6ec319a8a97615987dc4b
SHA512a2832b7720599361e2537f79a2597acb1a2d5633fdfe20a0d1075e9457683fdb1d5676d121c0bf1a825ff99512dcd924254f1151b50aae922acc0cc10f461036