URL:

https://download.tenorshare.com/downloads/tenorshare-icarefone.exe

Full analysis: https://app.any.run/tasks/4045359a-0296-4205-9653-15bfe05fcf91
Verdict: Malicious activity
Analysis date: February 29, 2024, 13:24:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
Indicators:
MD5:

03DD9B12C4A2FA13BE15BC8EBF75A1FA

SHA1:

F2248D32A26C27934D62E868CE2597E0553AFB2E

SHA256:

41CBAC4AEAFC85B323F0E714596A9BD7B508598F2D83AB0C0CB21F0708A21D3B

SSDEEP:

3:N8SElzILGKxKXKmLVIHLWC:2SKELGNamLVkWC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Connects to the CnC server

      • icarefone.exe (PID: 1496)

    • Drops the executable file immediately after the start

      • iCareFonetrial_ts_en_9.0.2.exe (PID: 3780)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

  • SUSPICIOUS

    • Reads the Internet Settings

      • icarefone.exe (PID: 1496)
      • NetFrameCheck.exe (PID: 3344)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Reads security settings of Internet Explorer

      • icarefone.exe (PID: 1496)
      • NetFrameCheck.exe (PID: 3344)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Reads settings of System Certificates

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Checks Windows Trust Settings

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Checks for external IP

      • icarefone.exe (PID: 1496)

    • Process creates executable files without a name

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Executable content was dropped or overwritten

      • iCareFonetrial_ts_en_9.0.2.exe (PID: 3780)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Reads the Windows owner or organization settings

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Searches for installed software

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Process drops legitimate windows executable

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • The process drops C-runtime libraries

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Drops 7-zip archiver for unpacking

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Drops a system driver (possible attempt to evade defenses)

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Uses NETSH.EXE to delete a firewall rule or allowed programs

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Creates a software uninstall entry

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Changes Internet Explorer settings (feature browser emulation)

      • Tenorshare iCareFone.exe (PID: 2420)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 3240)
      • msedge.exe (PID: 1860)
      • msedge.exe (PID: 3168)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3240)

    • Drops the executable file immediately after the start

      • iexplore.exe (PID: 3916)
      • iexplore.exe (PID: 3240)

    • Checks supported languages

      • icarefone.exe (PID: 1496)
      • iCareFonetrial_ts_en_9.0.2.exe (PID: 3780)
      • wmpnscfg.exe (PID: 1352)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)
      • NetFrameCheck.exe (PID: 3344)
      • Tenorshare iCareFone.exe (PID: 2420)
      • Monitor.exe (PID: 2644)
      • infInstallx86.exe (PID: 3112)
      • infInstallx86.exe (PID: 1072)
      • CheckErrorx86.exe (PID: 2480)

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 3240)
      • iexplore.exe (PID: 3916)

    • Reads the computer name

      • icarefone.exe (PID: 1496)
      • wmpnscfg.exe (PID: 1352)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)
      • NetFrameCheck.exe (PID: 3344)
      • Tenorshare iCareFone.exe (PID: 2420)
      • Monitor.exe (PID: 2644)
      • CheckErrorx86.exe (PID: 2480)
      • infInstallx86.exe (PID: 3112)
      • infInstallx86.exe (PID: 1072)

    • The process uses the downloaded file

      • iexplore.exe (PID: 3240)

    • Reads Environment values

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Checks proxy server information

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Reads the machine GUID from the registry

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Creates files in the program directory

      • icarefone.exe (PID: 1496)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)
      • NetFrameCheck.exe (PID: 3344)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Creates files or folders in the user directory

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Create files in a temporary directory

      • icarefone.exe (PID: 1496)
      • iCareFonetrial_ts_en_9.0.2.exe (PID: 3780)
      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Reads the software policy settings

      • icarefone.exe (PID: 1496)
      • Tenorshare iCareFone.exe (PID: 2420)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1352)
      • msedge.exe (PID: 3168)

    • Creates a software uninstall entry

      • iCareFonetrial_ts_en_9.0.2.tmp (PID: 3760)

    • Reads product name

      • Tenorshare iCareFone.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
91
Monitored processes
35
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe icarefone.exe no specs icarefone.exe wmpnscfg.exe no specs icarefonetrial_ts_en_9.0.2.exe icarefonetrial_ts_en_9.0.2.tmp netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netsh.exe no specs netframecheck.exe no specs tenorshare icarefone.exe monitor.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs checkerrorx86.exe no specs msedge.exe no specs infinstallx86.exe no specs msedge.exe no specs infinstallx86.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
448"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2208 --field-trial-handle=1208,i,1828090270522383096,4882049491117081206,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
968"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1208,i,1828090270522383096,4882049491117081206,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1072"C:\Program Files\Tenorshare\Tenorshare iCareFone\iTunesRepairResources\x86\infInstallx86.exe" -d "C:\Program Files\Tenorshare\Tenorshare iCareFone\iTunesRepairResources\x86\NetDrivers86\netaapl.inf"C:\Program Files\Tenorshare\Tenorshare iCareFone\iTunesRepairResources\x86\infInstallx86.exe—Tenorshare iCareFone.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\tenorshare\tenorshare icarefone\itunesrepairresources\x86\infinstallx86.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1288"C:\Windows\system32\netsh.exe" advfirewall firewall delete rule name=all program="C:\Program Files\Tenorshare\Tenorshare iCareFone\Tenorshare iCareFone.exe" C:\Windows\System32\netsh.exe—iCareFonetrial_ts_en_9.0.2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1352"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\icarefone.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\icarefone.exe
iexplore.exe
User:
admin
Company:
Tenorshare Co., Ltd.
Integrity Level:
HIGH
Description:
Tenorshare iCareFone
Exit code:
0
Version:
2.7.11.0
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\icarefone.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1624"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1644 --field-trial-handle=1208,i,1828090270522383096,4882049491117081206,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1696"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1240 --field-trial-handle=1336,i,17465526761812696429,1698733331686931952,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1776"C:\Windows\system32\netsh.exe" advfirewall firewall add rule name="Bonjour Service(ts)" program="C:\Program Files\Tenorshare\Tenorshare iCareFone\Bonjour\mDNSResponder.exe" dir=out action=allow enable=yes protocol=udp localport=anyC:\Windows\System32\netsh.exe—iCareFonetrial_ts_en_9.0.2.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1836"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1400 --field-trial-handle=1336,i,17465526761812696429,1698733331686931952,131072 /prefetch:3C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
46 879
Read events
46 179
Write events
644
Delete events
56

Modification events

(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
1
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
31091474
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
31091474
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(3240) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
652
Suspicious files
67
Text files
226
Unknown types
72

Dropped files

PID
Process
Filename
Type
3240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:9F5D4485730FC877DDCDD1130D35B750
SHA256:12406A92CC54C771E1CCB71F0176F51DF1A712F3C92297A8C9B4740A33162609
3916iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\SRZUCU66.txttext
MD5:79B3B45730825AF29AE429D72BD9C1D5
SHA256:D187FE555078AC4EBFF496733C317C37BBB97BBC2E7F06BC09412B2CA1C3002C
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:7BB9321C1556D9B8D24F3AFD5CDB826C
SHA256:9D25DB37B278204CDCC2625FE8658E8B8975F8428556CBBFF27A798EC0FAADAD
3240iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\VersionManager\ver7923.tmpxml
MD5:CBD0581678FA40F0EDCBC7C59E0CAD10
SHA256:159BD4343F344A08F6AF3B716B6FA679859C1BD1D7030D26FF5EF0255B86E1D9
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464der
MD5:8202A1CD02E7D69597995CABBE881A12
SHA256:58F381C3A0A0ACE6321DA22E40BD44A597BD98B9C9390AB9258426B5CF75A7A5
3916iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\tenorshare-icarefone[1].htmhtml
MD5:3505BE90F78146EAEAF165A345BD1558
SHA256:CEABF24CFE9C8B0DC448CE0F79DE3A2BC40F096CBF88AAE630CB0DDEDD9925FA
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:F02769243AA527E24A82F78D9B3DBCC9
SHA256:4753530CF48D7F7DA3B6BBEEF9A6B449A0DDDB0091CD057A63FC7FDEE7C03E90
3240iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:A5E504E20CD5565F096EDB8EA34E63E1
SHA256:48FF652B9CC1ED65426D4ACA7666B8DC956FD531272754F6D9F206B3C7C419B3
3916iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464binary
MD5:273C544BC52AD727B05DFEF9C50247FA
SHA256:44A0FE2F36D86DD64F7F5E35B25686FDCB47B8D249BD353D1B445D3C60D41089
3916iexplore.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Cookies\Low\MRB2XEJP.txttext
MD5:AC7D9FCF25FB432AEADC9CD05732EB72
SHA256:4E47CC9D0C52F47DB5F5F82C1A4139988707F71CAEFAFA88C434DE7096ACAB2B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
66
TCP/UDP connections
242
DNS requests
103
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1496
icarefone.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
text
145 b
unknown
1496
icarefone.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
1496
icarefone.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
1496
icarefone.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
1496
icarefone.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
image
35 b
unknown
3916
iexplore.exe
GET
304
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?f78d505714a595e3
unknown
—
—
unknown
3916
iexplore.exe
GET
304
178.79.242.0:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?545e1839169dd0e6
unknown
—
—
unknown
3916
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
3916
iexplore.exe
GET
200
172.217.16.195:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFCjJ1PwkYAi7fE%3D
unknown
binary
724 b
unknown
1080
svchost.exe
GET
200
95.140.236.128:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?c503292d7802e201
unknown
compressed
67.5 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
3916
iexplore.exe
104.18.25.249:443
download.tenorshare.com
CLOUDFLARENET
—
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3916
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3916
iexplore.exe
178.79.242.0:80
ctldl.windowsupdate.com
LLNW
DE
whitelisted
3916
iexplore.exe
172.217.16.195:80
ocsp.pki.goog
GOOGLE
US
whitelisted
1080
svchost.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
unknown
3240
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3240
iexplore.exe
95.140.236.128:80
ctldl.windowsupdate.com
LLNW
US
unknown

DNS requests

Domain
IP
Reputation
download.tenorshare.com
  • 104.18.25.249
  • 104.18.24.249
unknown
ctldl.windowsupdate.com
  • 178.79.242.0
  • 95.140.236.128
whitelisted
ocsp.pki.goog
  • 172.217.16.195
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
www.tenorshare.com
  • 104.17.207.155
  • 104.17.192.141
whitelisted
update.tenorshare.com
  • 104.18.25.249
  • 104.18.24.249
unknown
ip-api.com
  • 208.95.112.1
shared
www.google-analytics.com
  • 142.250.185.78
  • 142.250.186.142
whitelisted

Threats

PID
Process
Class
Message
1496
icarefone.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1496
icarefone.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
1496
icarefone.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
1496
icarefone.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
1496
icarefone.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Tensorshare Google Analytics Checkin
2420
Tenorshare iCareFone.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
4 ETPRO signatures available at the full report
Process
Message
Tenorshare iCareFone.exe
2024-02-29 13:29:52:849 Tenorshare iCareFone<3180>:: TSClientContext::Init ios_manager version = 5.0.0.750
Tenorshare iCareFone.exe
2024-02-29 13:29:52:853 Tenorshare iCareFone<3180>:: Result Code=*****************************Application Start up.************************************************
Tenorshare iCareFone.exe
2024-02-29 13:29:53:039 Tenorshare iCareFone<2896>:: Begin Init Language
Tenorshare iCareFone.exe
2024-02-29 13:29:54:060 Tenorshare iCareFone<2896>:: product:Tenorshare iCareFone,Version:9.0.2.6
Tenorshare iCareFone.exe
2024-02-29 13:29:54:122 Tenorshare iCareFone<2292>:: MainViewModel.CheckInstallMode: [Legal]
Tenorshare iCareFone.exe
2024-02-29 13:29:54:197 Tenorshare iCareFone<2896>:: BitProcess is x32, Version: 9.0.2.6,Site:TS
Tenorshare iCareFone.exe
2024-02-29 13:29:55:474 Tenorshare iCareFone<240>:: UsbDeviceInfoHelper.CheckAppleDeviceHard, Started!
Tenorshare iCareFone.exe
2024-02-29 13:29:56:126 Tenorshare iCareFone<2896>:: Info: CommonStyleHelper Log:InitLanguageResource CultureInfo=en-US
Tenorshare iCareFone.exe
2024-02-29 13:29:56:127 Tenorshare iCareFone<240>:: UsbDeviceInfoHelper.CheckAppleDeviceHard, End!
Tenorshare iCareFone.exe
Native library pre-loader is trying to load native SQLite library "C:\Program Files\Tenorshare\Tenorshare iCareFone\x86\SQLite.Interop.dll"...
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://download.tenorshare.com/downloads/tenorshare-icarefone.exe