Overview

overview

10

Static

static

1

4ukey_1178...01.exe

windows11-21h2-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    165s
  • max time network
    180s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    10/08/2026, 14:20

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ukey_11786371533814321001.exe
  • Size 241.8MB
  • Sample260810-rntdra1alg
  • SHA256 9d07f6eda51f7da50deaa903e607fe83da27b9725ce3e92294649984281db16e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspywarevmprotect

Malware Config

Signatures

  • Modifies firewall policy service 3 TTPs 1 IoCs
    defense_evasion
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • ConfuserEx .NET packer 3 IoCs

    Detects ConfuserEx .NET packer.

  • Drops file in System32 directory 52 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 12 IoCs
  • Launches sc.exe 9 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 5 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ukey_11786371533814321001.exe
    "C:\Users\Admin\AppData\Local\Temp\4ukey_11786371533814321001.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3400
    • C:\Users\Admin\AppData\Local\Temp\is-64R1O.tmp\4ukey_11786371533814321001.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-64R1O.tmp\4ukey_11786371533814321001.tmp" /SL5="$40258,252998494,284672,C:\Users\Admin\AppData\Local\Temp\4ukey_11786371533814321001.exe"
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2708
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c taskkill /f /t /im "Tenorshare 4uKey.exe"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5620
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /f /t /im "Tenorshare 4uKey.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:4436
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:784
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall delete rule name=all program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe"
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:1380
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4uKey_iosWebkitDebugProxy" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe" enable=yes
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall add rule name="Tenorshare 4uKey_iosWebkitDebugProxy" dir=in action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:2064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c netsh advfirewall firewall add rule name="Tenorshare 4uKey_iosWebkitDebugProxy" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe" enable=yes
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2868
        • C:\Windows\SysWOW64\netsh.exe
          netsh advfirewall firewall add rule name="Tenorshare 4uKey_iosWebkitDebugProxy" dir=out action=allow program="C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\tools\ios_webkit_debug_proxy.exe" enable=yes
          4⤵
          • Modifies Windows Firewall
          • Event Triggered Execution: Netsh Helper DLL
          • System Location Discovery: System Language Discovery
          PID:3484
      • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Start.exe
        "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Start.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:5060
        • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Tenorshare 4uKey.exe
          "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Tenorshare 4uKey.exe"
          4⤵
          • Drops file in System32 directory
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:5960
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cbs.tenorshare.com/go?pid=1002&a=i&v=3.10.1
            5⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:5420
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x330,0x7ffce305c188,0x7ffce305c194,0x7ffce305c1a0
              6⤵
                PID:4932
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,7559094205506127244,16963706220535933284,524288 --field-trial-handle=2612,i,8197990835163628122,5260332023082189835,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
                6⤵
                • System Time Discovery
                PID:5984
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,3007467148533995944,1120717042173355339,262144 --field-trial-handle=2612,i,8197990835163628122,5260332023082189835,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:2
                6⤵
                  PID:2204
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,2662432595205268391,5952961259093930510,524288 --field-trial-handle=2612,i,8197990835163628122,5260332023082189835,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
                  6⤵
                    PID:4784
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,272852350099067813,14699770551093000810,2097152 --field-trial-handle=2612,i,8197990835163628122,5260332023082189835,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
                    6⤵
                      PID:4616
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,10378919804298283370,3081511070391527639,2097152 --field-trial-handle=2612,i,8197990835163628122,5260332023082189835,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
                      6⤵
                        PID:4540
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                        6⤵
                        • Drops file in Windows directory
                        • Enumerates system info in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:4636
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffce305c188,0x7ffce305c194,0x7ffce305c1a0
                          7⤵
                            PID:224
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,11516805264709190523,14939223418034728908,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
                            7⤵
                            • System Time Discovery
                            PID:3124
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,6262170510473127978,17597527359636390927,262144 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:2
                            7⤵
                              PID:1108
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,8463806012892932717,10796901956425130775,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
                              7⤵
                                PID:5080
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,15436282244322301744,9055615822873344987,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
                                7⤵
                                  PID:3308
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,15436282244322301744,9055615822873344987,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
                                  7⤵
                                    PID:5200
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4716,i,7879731817582430392,2400856699708366754,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:14
                                    7⤵
                                      PID:4324
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,6783478651599450689,1200132829200236938,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
                                      7⤵
                                        PID:2548
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,6986407768095131693,7026788360831973413,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
                                        7⤵
                                          PID:3248
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,1133046616330426194,7560893991718975891,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14
                                          7⤵
                                            PID:1100
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,2577808351586476888,10830585940518382228,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:14
                                            7⤵
                                              PID:4840
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,9777560865216814331,10160591298824140796,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:14
                                              7⤵
                                                PID:5756
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,14205317349403416243,17050182118258509081,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
                                                7⤵
                                                  PID:912
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,11394046911752641101,17254472634902403486,524288 --field-trial-handle=2560,i,8520730425723483037,13715091253648498823,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:14
                                                  7⤵
                                                    PID:5340
                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Monitor\Monitor.exe
                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Monitor\Monitor.exe" 5960(#-+)UA-116569081-1(#-+)Tenorshare 4uKey(#-+)3.10.1.0(#-+)&cd1=3.10.1.0&cd2=0&cd3=TS&cd4=EN(#-+)1
                                                5⤵
                                                • Executes dropped EXE
                                                • Loads dropped DLL
                                                • System Location Discovery: System Language Discovery
                                                PID:1304
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                5⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:3524
                                                • C:\Windows\system32\sc.exe
                                                  sc start winmgmt
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:2232
                                              • C:\Windows\System32\Wbem\wmic.exe
                                                wmic BaseBoard get SerialNumber
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4032
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                5⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:6068
                                                • C:\Windows\system32\sc.exe
                                                  sc start winmgmt
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:1192
                                              • C:\Windows\System32\Wbem\wmic.exe
                                                wmic BaseBoard get SerialNumber
                                                5⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:4400
                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\CheckErrorx64.exe
                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\CheckErrorx64.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Checks SCSI registry key(s)
                                                PID:5296
                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\mdns\mDNSResponder.exe
                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\mdns\mDNSResponder.exe" -server
                                                5⤵
                                                • Modifies firewall policy service
                                                • Executes dropped EXE
                                                PID:6076
                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\AppleMobileDeviceProcess.exe
                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\AppleMobileDeviceProcess.exe"
                                                5⤵
                                                • Executes dropped EXE
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:3396
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                5⤵
                                                • Executes a command shell one-liner
                                                • Suspicious use of WriteProcessMemory
                                                PID:5140
                                                • C:\Windows\system32\sc.exe
                                                  sc start winmgmt
                                                  6⤵
                                                  • Launches sc.exe
                                                  PID:3676
                                              • C:\Windows\System32\Wbem\wmic.exe
                                                wmic BaseBoard get SerialNumber
                                                5⤵
                                                  PID:4020
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                  5⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:2496
                                                  • C:\Windows\system32\sc.exe
                                                    sc start winmgmt
                                                    6⤵
                                                    • Launches sc.exe
                                                    PID:3728
                                                • C:\Windows\System32\Wbem\wmic.exe
                                                  wmic BaseBoard get SerialNumber
                                                  5⤵
                                                    PID:2032
                                                  • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe
                                                    "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe" -d "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                    5⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:6108
                                                    • C:\Windows\SYSTEM32\takeown.exe
                                                      takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
                                                      6⤵
                                                      • Modifies file permissions
                                                      PID:3200
                                                    • C:\Windows\SYSTEM32\cacls.exe
                                                      cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
                                                      6⤵
                                                        PID:3892
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                      5⤵
                                                      • Executes a command shell one-liner
                                                      PID:5528
                                                      • C:\Windows\system32\sc.exe
                                                        sc start winmgmt
                                                        6⤵
                                                        • Launches sc.exe
                                                        PID:196
                                                    • C:\Windows\System32\Wbem\wmic.exe
                                                      wmic BaseBoard get SerialNumber
                                                      5⤵
                                                        PID:3420
                                                      • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe
                                                        "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe" -d "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                        5⤵
                                                        • Executes dropped EXE
                                                        PID:540
                                                        • C:\Windows\SYSTEM32\takeown.exe
                                                          takeown /F C:\Windows\System32\DriverStore\FileRepository\ /A
                                                          6⤵
                                                          • Modifies file permissions
                                                          PID:5944
                                                        • C:\Windows\SYSTEM32\cacls.exe
                                                          cacls C:\Windows\System32\DriverStore\FileRepository*.* /E /G Everyone:F
                                                          6⤵
                                                            PID:4860
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                          5⤵
                                                          • Executes a command shell one-liner
                                                          PID:4620
                                                          • C:\Windows\system32\sc.exe
                                                            sc start winmgmt
                                                            6⤵
                                                            • Launches sc.exe
                                                            PID:4024
                                                        • C:\Windows\System32\Wbem\wmic.exe
                                                          wmic BaseBoard get SerialNumber
                                                          5⤵
                                                            PID:2908
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                            5⤵
                                                            • Executes a command shell one-liner
                                                            PID:5604
                                                            • C:\Windows\system32\sc.exe
                                                              sc start winmgmt
                                                              6⤵
                                                              • Launches sc.exe
                                                              PID:2888
                                                          • C:\Windows\System32\Wbem\wmic.exe
                                                            wmic BaseBoard get SerialNumber
                                                            5⤵
                                                              PID:4864
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                              5⤵
                                                              • Executes a command shell one-liner
                                                              PID:4040
                                                              • C:\Windows\system32\sc.exe
                                                                sc start winmgmt
                                                                6⤵
                                                                • Launches sc.exe
                                                                PID:5608
                                                            • C:\Windows\System32\Wbem\wmic.exe
                                                              wmic BaseBoard get SerialNumber
                                                              5⤵
                                                                PID:3264
                                                              • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe
                                                                "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:1600
                                                                • C:\Windows\SYSTEM32\pnputil.exe
                                                                  pnputil -i -a "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NewUsbDrivers64\AppleUsb.inf"
                                                                  6⤵
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  PID:3164
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /C sc start winmgmt
                                                                5⤵
                                                                • Executes a command shell one-liner
                                                                PID:4124
                                                                • C:\Windows\system32\sc.exe
                                                                  sc start winmgmt
                                                                  6⤵
                                                                  • Launches sc.exe
                                                                  PID:5288
                                                              • C:\Windows\System32\Wbem\wmic.exe
                                                                wmic BaseBoard get SerialNumber
                                                                5⤵
                                                                  PID:6024
                                                                • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe
                                                                  "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe" -i "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:3052
                                                                  • C:\Windows\SYSTEM32\pnputil.exe
                                                                    pnputil -i -a "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NetDrivers64\netaapl64.inf"
                                                                    6⤵
                                                                    • Checks SCSI registry key(s)
                                                                    PID:1768
                                                                • C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\BsSndRpt.exe
                                                                  "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\BsSndRpt.exe" -i "C:\Users\Admin\AppData\Local\Temp\tmpAE05.ini" -q -s
                                                                  5⤵
                                                                  • Executes dropped EXE
                                                                  PID:4720
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                          1⤵
                                                            PID:4436
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                            1⤵
                                                              PID:3384
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                              1⤵
                                                                PID:5416
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                1⤵
                                                                • Checks SCSI registry key(s)
                                                                PID:3308
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\AppleUsb.inf" "9" "46714db03" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NewUsbDrivers64"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:992
                                                                • C:\Windows\system32\DrvInst.exe
                                                                  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{dc470c27-82f9-b34e-8cee-3350b8236c79}\netaapl64.inf" "9" "40b4ea16b" "0000000000000150" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\NetDrivers64"
                                                                  2⤵
                                                                  • Drops file in System32 directory
                                                                  • Drops file in Windows directory
                                                                  • Checks SCSI registry key(s)
                                                                  • Modifies data under HKEY_USERS
                                                                  PID:2728

                                                              Network

                                                                    MITRE ATT&CK Enterprise v16

                                                                    Reconnaissance

                                                                    Resource Development

                                                                    Initial Access

                                                                    Execution

                                                                    Command and Scripting Interpreter

                                                                    1
                                                                    T1059

                                                                    Windows Command Shell

                                                                    1
                                                                    T1059.003

                                                                    Persistence

                                                                    Create or Modify System Process

                                                                    2
                                                                    T1543

                                                                    Windows Service

                                                                    2
                                                                    T1543.003

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Privilege Escalation

                                                                    Create or Modify System Process

                                                                    2
                                                                    T1543

                                                                    Windows Service

                                                                    2
                                                                    T1543.003

                                                                    Event Triggered Execution

                                                                    1
                                                                    T1546

                                                                    Netsh Helper DLL

                                                                    1
                                                                    T1546.007

                                                                    Defense Evasion

                                                                    File and Directory Permissions Modification

                                                                    1
                                                                    T1222

                                                                    Impair Defenses

                                                                    2
                                                                    T1562

                                                                    Disable or Modify System Firewall

                                                                    2
                                                                    T1562.004

                                                                    Modify Registry

                                                                    2
                                                                    T1112

                                                                    Credential Access

                                                                    Discovery

                                                                    Browser Information Discovery

                                                                    1
                                                                    T1217

                                                                    Network Share Discovery

                                                                    1
                                                                    T1135

                                                                    Peripheral Device Discovery

                                                                    1
                                                                    T1120

                                                                    Query Registry

                                                                    3
                                                                    T1012

                                                                    System Information Discovery

                                                                    3
                                                                    T1082

                                                                    System Location Discovery

                                                                    1
                                                                    T1614

                                                                    System Language Discovery

                                                                    1
                                                                    T1614.001

                                                                    System Time Discovery

                                                                    1
                                                                    T1124

                                                                    Lateral Movement

                                                                    Collection

                                                                    Command and Control

                                                                    Exfiltration

                                                                    Impact

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    AgentSupportCLR.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\AgentSupportCLR.dll
                                                                    • Size 2.7MB
                                                                    • SHA256 883c6485697f2996b3e0a8250c715254439255ac9b8b43f2edfc92c7ada43e53
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    AntiCrack.dat
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\AntiCrack.dat
                                                                    • Size 536B
                                                                    • SHA256 3d122b100476fdd8785bef916a4f2d073fd23a01dc6fbd179dbe8ca3f2abb1f7
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    AppService.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\AppService.dll
                                                                    • Size 67KB
                                                                    • SHA256 64555301464d82836ef60697b673cd9b614616932ef399d624c6d7e5d8541a41
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BugSplat64.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\BugSplat64.dll
                                                                    • Size 620KB
                                                                    • SHA256 b9e3fd42a97ba6f3a7f6a4c2f44af224ef5d72f01bbf14ef14b5864c5503fdfc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    BugSplatDotNet.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\BugSplatDotNet.dll
                                                                    • Size 26KB
                                                                    • SHA256 1d738037887b46739b6767780411e2f32ef06f1bc840b469883047946710f109
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    CommonRegister.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\CommonRegister.dll
                                                                    • Size 1.1MB
                                                                    • SHA256 10592ec14730e88198c33cb88afb98abaaf58026ea396184b1a7585a619aa306
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    FileReport.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\FileReport.dll
                                                                    • Size 105KB
                                                                    • SHA256 7b5db936d7af2bb3bbfd6b44310f44806c21391a52a41e365acef4db9a18c8f0
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Fukey.exe.config
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Fukey.exe.config
                                                                    • Size 1KB
                                                                    • SHA256 a17c5d7bcc139e16e5782cde826a74b019836dc1c6d312fabaff25cd0c80e640
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    IosManager.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\IosManager.dll
                                                                    • Size 405KB
                                                                    • SHA256 288d60890d17fd00f694beb87bc6a2490e85ee38cc4e285e6ad4dd7c0a2e3b1b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    RepairItunes.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\RepairItunes.log
                                                                    • Size 748B
                                                                    • SHA256 16c60f1e31c21338ce6680f95b48da1c27b97568653bfcc7836ebc7196ff953a
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    RepairItunes.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\RepairItunes.log
                                                                    • Size 5KB
                                                                    • SHA256 2357ad3ce9028392dadcb72ffc8aeb225973a4446e4fb8b9d5ce985ba014e007
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SoftwareLog.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\SoftwareLog.log
                                                                    • Size 1KB
                                                                    • SHA256 afa7529e89753d7cbfb1d93330049e79f6b75eec2cff086b5a55baa18109f4ca
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SoftwareLog.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\SoftwareLog.log
                                                                    • Size 2KB
                                                                    • SHA256 a891130c2f2b26e46b899ea9b77df3f0376977364233841440e9b6c2c84d14b8
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SoftwareLog.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\SoftwareLog.log
                                                                    • Size 3KB
                                                                    • SHA256 b235c911920b25de6c763ca6d9b0c3798b320461f88329c93ffdb205f6e75088
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SoftwareLog.log
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Logs\SoftwareLog.log
                                                                    • Size 4KB
                                                                    • SHA256 048c473eb6f52b7be932daf10946d42d9a7e85800fab3c63dbe0a956e1ec3fcc
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\api-ms-win-crt-locale-l1-1-0.dll
                                                                    • Size 18KB
                                                                    • SHA256 8b543b1bb241f5b773eb76f652dad7b12e3e4a09230f2e804cd6b0622e8baf65
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-17LJG.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-17LJG.tmp
                                                                    • Size 18KB
                                                                    • SHA256 b5c725bbb475b5c06cc6cb2a2c3c70008f229659f88fba25ccd5d5c698d06a4b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-7H2FE.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-7H2FE.tmp
                                                                    • Size 19KB
                                                                    • SHA256 ac0cec8644340125507dd0bc9a90b1853a2d194eb60a049237fb5e752d349065
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-8DQE8.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-8DQE8.tmp
                                                                    • Size 17KB
                                                                    • SHA256 9f7bda59faafc8a455f98397a63a7f7d114efc4e8a41808c791256ebf33c7613
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-9CUJF.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-9CUJF.tmp
                                                                    • Size 18KB
                                                                    • SHA256 758a2f9ef6908b51745db50d89610fe1de921d93b2dbea919bfdba813d5d8893
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-B67MN.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-B67MN.tmp
                                                                    • Size 18KB
                                                                    • SHA256 ff9b51aff7fbec8d7fe5cc478b12492a59b38b068dc2b518324173bb3179a0e1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-BJVIF.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-BJVIF.tmp
                                                                    • Size 21KB
                                                                    • SHA256 b7c3ebc36c84630a52d23d1c0e79d61012dfa44cdebdf039af31ec9e322845a5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-EK5CC.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-EK5CC.tmp
                                                                    • Size 28KB
                                                                    • SHA256 39723e61c98703034b264b97ee0fe12e696c6560483d799020f9847d8a952672
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-HCH5I.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-HCH5I.tmp
                                                                    • Size 23KB
                                                                    • SHA256 73ab2161a7700835b2a15b7487045a695706cc18bcee283b114042570bb9c0aa
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-J6U6U.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-J6U6U.tmp
                                                                    • Size 20KB
                                                                    • SHA256 4d0f0ea6e8478132892f9e674e27e2bc346622fc8989c704e5b2299a18c1d138
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-JMN6F.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-JMN6F.tmp
                                                                    • Size 17KB
                                                                    • SHA256 ae5e73416eb64bc18249ace99f6847024eceea7ce9c343696c84196460f3a357
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-LVD34.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-LVD34.tmp
                                                                    • Size 18KB
                                                                    • SHA256 7e6b33a4c0c84f18f2be294ec63212245af4fd8354636804ffe5ee9a0d526d95
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-N9558.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-N9558.tmp
                                                                    • Size 18KB
                                                                    • SHA256 56d8b7ee7619579a3c648eb130c9354ba1ba5b33a07a4f350370ee7b3653749a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-O33VI.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-O33VI.tmp
                                                                    • Size 18KB
                                                                    • SHA256 675b1b82dd485cc8c8a099272db9241d0d2a7f45424901f35231b79186ec47ee
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-PGV4Q.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-PGV4Q.tmp
                                                                    • Size 20KB
                                                                    • SHA256 a7fa48de6c06666b80184afee7e544c258e0fb11399ab3fe47d4e74667779f41
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-SJBFC.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-SJBFC.tmp
                                                                    • Size 22KB
                                                                    • SHA256 1ee8e99190cc31b104fb75e66928b8c73138902fefedbcfb54c409df50a364df
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-UF8CH.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-UF8CH.tmp
                                                                    • Size 23KB
                                                                    • SHA256 7bcab4ca00fb1f85fea29dd3375f709317b984a6f3b9ba12b8cf1952f97beee5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    is-UOVR4.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\MobileDevicex86\is-UOVR4.tmp
                                                                    • Size 1.1MB
                                                                    • SHA256 6f8f05993b8a25cadf5e301e58194c4d23402e467229b12e40956e4f128588b3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    NetFrameCheck.db
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\NetFrameCheck.db
                                                                    • Size 9KB
                                                                    • SHA256 9c8a3bbdefe586ecc50c82e76595a9e8d660862eb39bbaceb82c393d07960b07
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Newtonsoft.Json.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Newtonsoft.Json.dll
                                                                    • Size 695KB
                                                                    • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Register.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Register.dll
                                                                    • Size 5.5MB
                                                                    • SHA256 0008947c69cd50b2faad1751d3bcc7c37f64d5ce734c7aad59009017bb3abc6d
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    RegisterAndLog.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\RegisterAndLog.dll
                                                                    • Size 2.7MB
                                                                    • SHA256 4c2c525b6e6aacc5d586ec115971e5fdcba76b1b01553e2c6680b39db39d16b5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    config.json
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\RenewConfig\config.json
                                                                    • Size 23KB
                                                                    • SHA256 555dad5ffdbde520510e3f9fb4c8f83021927de975fc17ddf848e5f2ff022773
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    icon.png
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\RenewConfig\icon.png
                                                                    • Size 480B
                                                                    • SHA256 ca245470deffc1dcf691b7de78e7647d809ed506e205370536d0b5a96d212369
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    version.txt
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\RenewConfig\version.txt
                                                                    • Size 8B
                                                                    • SHA256 acd07dd34922c72e24157858ef966c24c9dab9c3114c227c720112221434a182
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    is-6GRSB.tmp
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Resource\Images\ClickStartJailbreak\is-6GRSB.tmp
                                                                    • Size 91KB
                                                                    • SHA256 5a0f5c12546340d5d46d18fd7e3644c75a6bef8a15c8a9984c9d50cd1bc1ca1e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SQLite3.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\SQLite3.dll
                                                                    • Size 1.0MB
                                                                    • SHA256 5c7f30f65b829a11114d6f164730a2e440694b0d31e32e2050de4a85c8fac29b
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SoftwareLog.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\SoftwareLog.dll
                                                                    • Size 1.5MB
                                                                    • SHA256 a6fc6d85f4f0dbd6c00f47caa26cab8d7941934cf39790e6e83c2803422cb29c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Start.exe
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Start.exe
                                                                    • Size 4.7MB
                                                                    • SHA256 45bd286a3b1c5606b7dc072559f4a9ba3f1e0d8683a232934d89fb5f2a884afb
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    TS.Base.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\TS.Base.dll
                                                                    • Size 68KB
                                                                    • SHA256 5dab592210a41da93f640fa647f432aae3e186d1f79cca798b19144d589b9002
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    TS.Common.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\TS.Common.dll
                                                                    • Size 418KB
                                                                    • SHA256 574d99db21e9e0eae2f986d1a12c9ffcd1d5f7f86a8e907518988e04806fb867
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    TS.MvvmLight.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\TS.MvvmLight.dll
                                                                    • Size 547KB
                                                                    • SHA256 1fa7d48273bbefcfb2d20580cab97393d6b963cebf90088a45d19f5f06b3d1e6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    TS.UI.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\TS.UI.dll
                                                                    • Size 363KB
                                                                    • SHA256 04875f0fc151f5d418bc2683be9ba4e6529ea4272d5b115e9f71b3f624eaa692
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    TSEmbeddedPurchase.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\TSEmbeddedPurchase.dll
                                                                    • Size 401KB
                                                                    • SHA256 4591dd3f92de0f8e4a12de9890d78bf2c2c0845ea8697f0cefd537ce0319e0e8
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Tenorshare 4uKey.exe
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\Tenorshare 4uKey.exe
                                                                    • Size 37.2MB
                                                                    • SHA256 d97a2aba1359213ae8fdf126374c07ba55ae4b9403e435f6f08d30e0cfaae716
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ThreadCore.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\ThreadCore.dll
                                                                    • Size 112KB
                                                                    • SHA256 524c2eeb05f110f1aa252839d107b6f9feecc3a0cef9cb0b7a3604259de611f5
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    cloud
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\cloud
                                                                    • Size 135B
                                                                    • SHA256 be7a52d6d1b2e5e2c7a9e338f3ab71b4b2e76797f19cc06d5899aece2701365b
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    log.config
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\config\log.config
                                                                    • Size 1KB
                                                                    • SHA256 2f750f8507efb91aa9baad406b59e64b22d35a0f7c525945ab842a880ae6cfb0
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    infInstallx64.exe
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\iTunesRepairResources\x64\infInstallx64.exe
                                                                    • Size 339KB
                                                                    • SHA256 3de5cdbd64b8ab719c1e8ff70a9663b0d9f5e86ea4c76069a7e94abb0d645ba3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ios_manager.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\ios_manager.dll
                                                                    • Size 2.6MB
                                                                    • SHA256 e1d3eddb028c37a090572811b8d8f8c1a5ad5278dfa7e7ea93236377f5bd8ecf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    itunes_manager.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\itunes_manager.dll
                                                                    • Size 205KB
                                                                    • SHA256 ca00eaf7896113b6de346a029e146a237e25766157872cf6c7cf4c1f22e7c6c9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libcrypto-1_1-x64.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\libcrypto-1_1-x64.dll
                                                                    • Size 3.3MB
                                                                    • SHA256 7c3a5d1899a955a01da39a253c2d57d4496956bafebbf5a730388a8fb592b223
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libcurl.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\libcurl.dll
                                                                    • Size 542KB
                                                                    • SHA256 401e9665ccaead776d966b9064e8fb1b51d6cf22b3b134e1515b750714fd6b98
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    libssl-1_1-x64.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\libssl-1_1-x64.dll
                                                                    • Size 676KB
                                                                    • SHA256 57eb8e72bbad676b997fb9616e6e758ef4fbaba92b84735f5bfef5f81821cf3a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    log4net.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\log4net.dll
                                                                    • Size 274KB
                                                                    • SHA256 c4b4fedd80c1f908701e2d705392c4975563c84c40cd3b71aa167a401dfd879f
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    msvcp140.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\msvcp140.dll
                                                                    • Size 613KB
                                                                    • SHA256 99e3e25cda404283fbd96b25b7683a8d213e7954674adefa2279123a8d0701fd
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ts_base.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\ts_base.dll
                                                                    • Size 306KB
                                                                    • SHA256 783a5dd1b3b477c611cf3593fd69987d0d5e40cf06caed1becc7e99f26686bf9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    ts_client.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\ts_client.dll
                                                                    • Size 113KB
                                                                    • SHA256 b9a96596c97db5f1c8f27c4c1e8fb397e7352d0ac11b8de2fd1cb7fdf628bb60
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    vcruntime140.dll
                                                                    • Path C:\Program Files (x86)\Tenorshare\Tenorshare 4uKey\vcruntime140.dll
                                                                    • Size 83KB
                                                                    • SHA256 2b7602cc1521101d116995e3e2ddfe0943349806378a0d40add81ba64e359b6c
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    manifest.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
                                                                    • Size 135B
                                                                    • SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    protocols.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
                                                                    • Size 3KB
                                                                    • SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    settings.dat
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                    • Size 280B
                                                                    • SHA256 acd2e75ecd8821f4454b95f25b6238696055d0c89fbd322b8a9938926b5b4a59
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    BookmarkMergedSurfaceOrdering
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                    • Size 6B
                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    BrowsingTopicsState
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                    • Size 414B
                                                                    • SHA256 4b1ad730f5acc94a3e1a3a463b716ee4562fff3ada65aef9028cda8c9a4a4426
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                    • Size 3KB
                                                                    • SHA256 cc7f5afb36e550273e953bf1c4c520b4f8167de2788bd8b560314216391e440e
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    the-real-index~RFe59188f.TMP
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59188f.TMP
                                                                    • Size 3KB
                                                                    • SHA256 9e986c830a3a84ff81785e2271b3e7d7cac334ea6a41dfab0256463534cf08c2
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    data_1
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
                                                                    • Size 264KB
                                                                    • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                    Submit Download

                                                                    SiteList-Enterprise.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                    • Size 2B
                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 4KB
                                                                    • SHA256 326257e3513fbd9672e081161b4c57e004a9c77738e996d528a42f8498a4f088
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Network Persistent State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                    • Size 3KB
                                                                    • SHA256 2666e40001e36e7921173a593b36432d7e58ce4aad4160162b0b72acf97f9201
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    SCT Auditing Pending Reports
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                    • Size 2B
                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Sdch Dictionaries
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                    • Size 40B
                                                                    • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                    • Size 16KB
                                                                    • SHA256 b7da71ffd0c4b5d90c1f38599381a3ab09085edf2bc30afaadfb4218a4698149
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Secure Preferences
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                    • Size 36KB
                                                                    • SHA256 b5cdb11b466913a85dcc64f83e8b051824e34245b58ebacf2b8ec8996da15a36
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    sync_diagnostic.log
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                    • Size 22KB
                                                                    • SHA256 c2025d717e5e581f6a29c5812eb8fe1500f4af4c689ef1fa9aa4c00a511f5314
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    office_endpoints_list.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists\2026.6.5.1\office_endpoints_list.json
                                                                    • Size 9KB
                                                                    • SHA256 f0c77aaacfc571e0bc3f51387febe134d991bf3c7f1941af303ed901f288dcd6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 26KB
                                                                    • SHA256 7245377917274e1731609e171e61979303b907e7e613c9bf3d36850ff378cdcf
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 6d3d7f2f8aeb5a1f51ff757e3cc759c553ae243b1156c95c97cafb6f008231d2
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 30KB
                                                                    • SHA256 a826597da475b74538e5ab9b11d72ed0cfc7db0308b49899db02b787527e30f3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 2fbbd1bc15fea066ee091c8d8937dd5228f6d7e7692cffc7fc44a292c986a665
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 26KB
                                                                    • SHA256 94bc065640a54e7bad77f519669562b8eec80e03df5a331e68dec9713c05f45a
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    Local State
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                    • Size 25KB
                                                                    • SHA256 6ba21f3f704a8ad422bea94aab54a89255bd598695d074b1ae54fcb93fa119df
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    keys.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2026.8.3.1\keys.json
                                                                    • Size 8KB
                                                                    • SHA256 3d6c659801f1686ff3ac64bc3b24b1d0ae76ffdd5f0e9c399ba37d1354a15ab4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                    • Size 2KB
                                                                    • SHA256 b3b422bec6d157be35f5dbba8373199c83d1228c07cb8114f81e42d882e995c1
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                    • Size 2KB
                                                                    • SHA256 3da7b1cc122e38b313c6d52e9d2b57d0373f600e252a671175c95c2a0d01960e
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                    • Size 153KB
                                                                    • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    metadata.json
                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                    • Size 132B
                                                                    • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    b07a9060-2eb1-4319-b8f4-7a5fdfc5a1b8.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\b07a9060-2eb1-4319-b8f4-7a5fdfc5a1b8.tmp
                                                                    • Size 1B
                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                    • MD5 SHA1 SHA512
                                                                    Submit Download

                                                                    4ukey_11786371533814321001.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\is-64R1O.tmp\4ukey_11786371533814321001.tmp
                                                                    • Size 1.3MB
                                                                    • SHA256 6e2eac046216d430b27beab2fa025b582a8e1b20e6da58e4a53f5f3f066551a4
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETAF4C.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{dc470c27-82f9-b34e-8cee-3350b8236c79}\SETAF4C.tmp
                                                                    • Size 1.6MB
                                                                    • SHA256 18487b4ff94edccc98ed59d9fca662d4a1331c5f1e14df8db3093256dd9f1c3e
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETAF4D.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{dc470c27-82f9-b34e-8cee-3350b8236c79}\SETAF4D.tmp
                                                                    • Size 10KB
                                                                    • SHA256 2b8a6ebc3e10d06a6ebbcb4ef89992978836eb52d2ad1c09e19b137b0963c2f9
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETAF4E.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{dc470c27-82f9-b34e-8cee-3350b8236c79}\SETAF4E.tmp
                                                                    • Size 4KB
                                                                    • SHA256 6db20d1374088a64b5a435189e3cbf1c0f30496d4a2c80346bc904605f3d0261
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETAF4F.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{dc470c27-82f9-b34e-8cee-3350b8236c79}\SETAF4F.tmp
                                                                    • Size 22KB
                                                                    • SHA256 d774db020d9c46d1aa0b2db9fa2c36c4a9c38d904cc6929695321d32aca0d4d1
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETA98F.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\SETA98F.tmp
                                                                    • Size 54KB
                                                                    • SHA256 ac3469ac659287626b05cda0da457b63ed78241d4f20c60778f6292d6e158346
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETA9A0.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\SETA9A0.tmp
                                                                    • Size 22KB
                                                                    • SHA256 775e43292702903d1f3991b655dde23ccb378052d28f7e0e8f89e2f4580a7387
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETA9A1.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\SETA9A1.tmp
                                                                    • Size 16KB
                                                                    • SHA256 71ef7dbef3e7b2c1bdc32c1a4400aa5f92c5c7eee9ef6261385c54cd9d0e26a6
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETA9A2.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\SETA9A2.tmp
                                                                    • Size 131KB
                                                                    • SHA256 17fa26ea576e98f40eb2a353123d27232335e3a20c8d91465ec83710bc1a8eae
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    SETA9A3.tmp
                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{ebd4b689-47b6-5f49-b4fd-5b7037eae03e}\SETA9A3.tmp
                                                                    • Size 38KB
                                                                    • SHA256 72fe475d8ada0cc2e26a4e659ca7d03bdb8d3061b4a689016a54eb52b18773a3
                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                    Submit Download

                                                                    manifest.json
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_1864387994\manifest.json
                                                                    • Size 78B
                                                                    • SHA256 c7e506687caffcf3906916ad3fc190a19212d67a2535479241096bd0d4418b03
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    manifest.json
                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4636_350333533\manifest.json
                                                                    • Size 165B
                                                                    • SHA256 fc5dd0f6692cb24ec676b53527dabff28114c905dd08f72c97ac54a22c1bffae
                                                                    • MD5 SHA1 SHA512 TLSH
                                                                    Submit Download

                                                                    memory/2708-5-0x0000000002520000-0x0000000002521000-memory.dmp
                                                                    Download

                                                                    memory/2708-318-0x0000000000400000-0x0000000000555000-memory.dmp
                                                                    Download

                                                                    memory/2708-9-0x0000000002520000-0x0000000002521000-memory.dmp
                                                                    Download

                                                                    memory/2708-8-0x0000000000400000-0x0000000000555000-memory.dmp
                                                                    Download

                                                                    memory/2708-1656-0x0000000000400000-0x0000000000555000-memory.dmp
                                                                    Download

                                                                    memory/2708-1586-0x0000000000400000-0x0000000000555000-memory.dmp
                                                                    Download

                                                                    memory/3400-0-0x0000000000400000-0x000000000044F000-memory.dmp
                                                                    Download

                                                                    memory/3400-1657-0x0000000000400000-0x000000000044F000-memory.dmp
                                                                    Download

                                                                    memory/3400-7-0x0000000000400000-0x000000000044F000-memory.dmp
                                                                    Download

                                                                    memory/5960-1664-0x000001FF3EF30000-0x000001FF3EF76000-memory.dmp
                                                                    Download

                                                                    memory/5960-2107-0x000001FF5D0E0000-0x000001FF5D113000-memory.dmp
                                                                    Download

                                                                    memory/5960-2103-0x00007FFCDEFD0000-0x00007FFCE03A6000-memory.dmp
                                                                    Download

                                                                    memory/5960-2102-0x00007FFD0EE40000-0x00007FFD0EE42000-memory.dmp
                                                                    Download

                                                                    memory/5960-1917-0x000001FF5B4E0000-0x000001FF5B512000-memory.dmp
                                                                    Download

                                                                    memory/5960-1855-0x000001FF5B4D0000-0x000001FF5B4E0000-memory.dmp
                                                                    Download

                                                                    memory/5960-1844-0x000001FF5ADE0000-0x000001FF5B4CB000-memory.dmp
                                                                    Download

                                                                    memory/5960-1833-0x000001FF5A490000-0x000001FF5A498000-memory.dmp
                                                                    Download

                                                                    memory/5960-1818-0x000001FF5A4B0000-0x000001FF5A4DE000-memory.dmp
                                                                    Download

                                                                    memory/5960-1806-0x000001FF598C0000-0x000001FF598CC000-memory.dmp
                                                                    Download

                                                                    memory/5960-1773-0x000001FF5A210000-0x000001FF5A27A000-memory.dmp
                                                                    Download

                                                                    memory/5960-2558-0x000001FF5D550000-0x000001FF5D9CF000-memory.dmp
                                                                    Download

                                                                    memory/5960-1786-0x000001FF5A140000-0x000001FF5A181000-memory.dmp
                                                                    Download

                                                                    memory/5960-1741-0x000001FF59EB0000-0x000001FF59EE7000-memory.dmp
                                                                    Download

                                                                    memory/5960-2632-0x000001FF5EB20000-0x000001FF5EB8C000-memory.dmp
                                                                    Download

                                                                    memory/5960-2642-0x000001FF5EAB0000-0x000001FF5EAB8000-memory.dmp
                                                                    Download

                                                                    memory/5960-2644-0x000001FF5EAC0000-0x000001FF5EAC8000-memory.dmp
                                                                    Download

                                                                    memory/5960-2645-0x000001FF5EBD0000-0x000001FF5EC08000-memory.dmp
                                                                    Download

                                                                    memory/5960-2646-0x000001FF5EBA0000-0x000001FF5EBAE000-memory.dmp
                                                                    Download

                                                                    memory/5960-2649-0x000001FF5EC30000-0x000001FF5EC48000-memory.dmp
                                                                    Download

                                                                    memory/5960-2651-0x000001FF5EC90000-0x000001FF5ECCE000-memory.dmp
                                                                    Download

                                                                    memory/5960-1738-0x000001FF597C0000-0x000001FF597C6000-memory.dmp
                                                                    Download

                                                                    memory/5960-1737-0x000001FF597D0000-0x000001FF597DA000-memory.dmp
                                                                    Download

                                                                    memory/5960-1733-0x000001FF597B0000-0x000001FF597B6000-memory.dmp
                                                                    Download

                                                                    memory/5960-1730-0x00007FFCE4340000-0x00007FFCE4C8D000-memory.dmp
                                                                    Download

                                                                    memory/5960-1729-0x00007FFD0EE30000-0x00007FFD0EE32000-memory.dmp
                                                                    Download

                                                                    memory/5960-1695-0x000001FF59560000-0x000001FF595C8000-memory.dmp
                                                                    Download

                                                                    memory/5960-1719-0x000001FF598D0000-0x000001FF599E8000-memory.dmp
                                                                    Download

                                                                    memory/5960-1722-0x000001FF599F0000-0x000001FF59CAB000-memory.dmp
                                                                    Download

                                                                    memory/5960-1672-0x000001FF59030000-0x000001FF592F1000-memory.dmp
                                                                    Download

                                                                    memory/5960-1685-0x000001FF59620000-0x000001FF596D2000-memory.dmp
                                                                    Download

                                                                    memory/5960-1687-0x000001FF594B0000-0x000001FF594D2000-memory.dmp
                                                                    Download

                                                                    memory/5960-1681-0x000001FF594F0000-0x000001FF5955C000-memory.dmp
                                                                    Download

                                                                    memory/5960-1668-0x000001FF58EE0000-0x000001FF58F3E000-memory.dmp
                                                                    Download

                                                                    memory/5960-1666-0x000001FF3D5E0000-0x000001FF3D5F4000-memory.dmp
                                                                    Download

                                                                    memory/5960-1662-0x000001FF58D40000-0x000001FF58DCC000-memory.dmp
                                                                    Download

                                                                    memory/5960-1660-0x000001FF3D5C0000-0x000001FF3D5D4000-memory.dmp
                                                                    Download

                                                                    memory/5960-1658-0x000001FF3AC50000-0x000001FF3D18A000-memory.dmp
                                                                    Download