File name:

9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe

Full analysis: https://app.any.run/tasks/5f4e3a5e-3bac-4903-ac34-daf43ee37ffc
Verdict: Malicious activity
Threats:

Adware is a form of malware that targets users with unwanted advertisements, often disrupting their browsing experience. It typically infiltrates systems through software bundling, malicious websites, or deceptive downloads. Once installed, it may track user activity, collect sensitive data, and display intrusive ads, including pop-ups or banners. Some advanced adware variants can bypass security measures and establish persistence on devices, making removal challenging. Additionally, adware can create vulnerabilities that other malware can exploit, posing a significant risk to user privacy and system security.

Malware Trends Tracker     >>>
Analysis date: June 01, 2024, 02:31:54
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
adware
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5:

FD59EA05BAFBDB0F197891894B47A5EB

SHA1:

01FBD3CFCFBAAB901E60525D919050772015ADAF

SHA256:

9F39A6E38E472324E31CC76DF7031C3EA094E4930DF34D606F41C459EE8D5157

SSDEEP:

98304:enjWc2uuJPD/PRaaq9/UDRfOXNk+IM97Sg+J4mtLGqLuWPm3fThfK3ykK8Rg3bKe:78

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4mekey_ts_en_2.0.8.exe (PID: 4424)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)

    • Connects to the CnC server

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)

    • Creates a writable file in the system directory

      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • Start.exe (PID: 1204)
      • 4uKey - Password Manager.exe (PID: 5064)

    • Potential Corporate Privacy Violation

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • msedge.exe (PID: 6728)

    • Checks Windows Trust Settings

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)
      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)

    • Checks for external IP

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)

    • Access to an unwanted program domain was detected

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)

    • Executable content was dropped or overwritten

      • 4mekey_ts_en_2.0.8.exe (PID: 4424)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • pnputil.exe (PID: 6388)
      • drvinst.exe (PID: 1412)
      • pnputil.exe (PID: 5112)
      • drvinst.exe (PID: 1360)

    • Process drops legitimate windows executable

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • pnputil.exe (PID: 5112)
      • drvinst.exe (PID: 1360)

    • Reads the Windows owner or organization settings

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)

    • The process drops C-runtime libraries

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)

    • Drops 7-zip archiver for unpacking

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)

    • Drops a system driver (possible attempt to evade defenses)

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • pnputil.exe (PID: 6388)
      • drvinst.exe (PID: 1412)
      • pnputil.exe (PID: 5112)
      • drvinst.exe (PID: 1360)

    • Creates a software uninstall entry

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)

    • Reads the date of Windows installation

      • Start.exe (PID: 1204)

    • Changes Internet Explorer settings (feature browser emulation)

      • 4uKey - Password Manager.exe (PID: 5064)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)

    • Searches for installed software

      • 4uKey - Password Manager.exe (PID: 5064)

  • INFO

    • Reads the computer name

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • Start.exe (PID: 1204)
      • AppleMobileDeviceProcess.exe (PID: 5964)
      • 4uKey - Password Manager.exe (PID: 5064)
      • drvinst.exe (PID: 1412)
      • identity_helper.exe (PID: 3640)
      • drvinst.exe (PID: 1360)

    • Checks supported languages

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4mekey_ts_en_2.0.8.exe (PID: 4424)
      • Start.exe (PID: 1204)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • 4uKey - Password Manager.exe (PID: 5064)
      • AppleMobileDeviceProcess.exe (PID: 5964)
      • CheckErrorx64.exe (PID: 1428)
      • infInstallx64.exe (PID: 3624)
      • infInstallx64.exe (PID: 4216)
      • infInstallx64.exe (PID: 6424)
      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)
      • infInstallx64.exe (PID: 7036)
      • identity_helper.exe (PID: 3640)

    • Checks proxy server information

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)

    • Reads Environment values

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)

    • Reads the machine GUID from the registry

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)
      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)

    • Creates files in the program directory

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • Start.exe (PID: 1204)
      • 4uKey - Password Manager.exe (PID: 5064)
      • AppleMobileDeviceProcess.exe (PID: 5964)

    • Creates files or folders in the user directory

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)

    • Reads the software policy settings

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4uKey - Password Manager.exe (PID: 5064)
      • drvinst.exe (PID: 1412)
      • drvinst.exe (PID: 1360)
      • slui.exe (PID: 6692)

    • Create files in a temporary directory

      • 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe (PID: 6540)
      • 4mekey_ts_en_2.0.8.exe (PID: 4424)
      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)
      • 4uKey - Password Manager.exe (PID: 5064)
      • pnputil.exe (PID: 6388)
      • pnputil.exe (PID: 5112)

    • Creates a software uninstall entry

      • 4mekey_ts_en_2.0.8.tmp (PID: 6856)

    • Disables trace logs

      • 4uKey - Password Manager.exe (PID: 5064)

    • Process checks computer location settings

      • Start.exe (PID: 1204)

    • Reads Microsoft Office registry keys

      • 4uKey - Password Manager.exe (PID: 5064)
      • msedge.exe (PID: 6340)
      • msedge.exe (PID: 6628)

    • Application launched itself

      • msedge.exe (PID: 6340)
      • msedge.exe (PID: 6628)

    • Manual execution by a user

      • msedge.exe (PID: 6628)

    • Drops the executable file immediately after the start

      • pnputil.exe (PID: 6388)
      • pnputil.exe (PID: 5112)
      • msedge.exe (PID: 6628)
      • msedge.exe (PID: 6728)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 6728)
      • msedge.exe (PID: 6628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:06:20 08:24:22+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14
CodeSize: 1748992
InitializedDataSize: 212992
UninitializedDataSize: 2174976
EntryPoint: 0x3bddd0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 2.7.11.0
ProductVersionNumber: 2.7.11.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Tenorshare Co., Ltd.
FileDescription: 4uKey - Password Manager
FileVersion: 2.7.11.0
LegalCopyright: Copyright © 2007-2023 Tenorshare Co.,Ltd.
ProductName: 20230620162357
ProductVersion: 2.7.11.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
198
Monitored processes
64
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe sppextcomobj.exe no specs slui.exe 4mekey_ts_en_2.0.8.exe 4mekey_ts_en_2.0.8.tmp start.exe no specs 4ukey - password manager.exe applemobiledeviceprocess.exe checkerrorx64.exe no specs conhost.exe no specs infinstallx64.exe no specs conhost.exe no specs infinstallx64.exe no specs conhost.exe no specs infinstallx64.exe no specs conhost.exe no specs pnputil.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs drvinst.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs infinstallx64.exe no specs conhost.exe no specs pnputil.exe drvinst.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
32\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—infInstallx64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
428\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—CheckErrorx64.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
440"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5612 --field-trial-handle=2416,i,2415967428120820205,16290723750353106914,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1100"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3672 --field-trial-handle=2416,i,2415967428120820205,16290723750353106914,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1180"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffce6455fd8,0x7ffce6455fe4,0x7ffce6455ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1204"C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\Start.exe"C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\Start.exe—9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
User:
admin
Company:
Tenorshare
Integrity Level:
HIGH
Description:
4uKey - Password Manager
Exit code:
0
Version:
2.1.2.5
Modules
Images
c:\program files (x86)\tenorshare\4ukey - password manager\start.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\crypt32.dll
1360DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{554b3649-d260-8243-a906-10faa938ca83}\netaapl64.inf" "9" "434ddfe5b" "00000000000001DC" "WinSta0\Default" "00000000000001E4" "208" "C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\iTunesRepairResources\x64\NetDrivers64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1412DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{1e48fdb9-eacc-0d43-bb59-269ff79d63f4}\usbaapl64.inf" "9" "469bf3513" "00000000000001D0" "WinSta0\Default" "00000000000001DC" "208" "C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\iTunesRepairResources\x64\UsbDrivers64"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1428"C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\iTunesRepairResources\x64\CheckErrorx64.exe"C:\Program Files (x86)\Tenorshare\4uKey - Password Manager\iTunesRepairResources\x64\CheckErrorx64.exe—4uKey - Password Manager.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\program files (x86)\tenorshare\4ukey - password manager\itunesrepairresources\x64\checkerrorx64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\setupapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
1496"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4768 --field-trial-handle=2416,i,2415967428120820205,16290723750353106914,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
28 133
Read events
27 934
Write events
189
Delete events
10

Modification events

(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Tenorshare\Downloader2.5.0
Operation:writeName:GA_PC
Value:
1
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:guid
Value:
6DB327BF-214F-4C34-BC11-2A27A0762576
(PID) Process:(6540) 9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\GuidGuidold
Operation:writeName:user_id
Value:
1001
(PID) Process:(6856) 4mekey_ts_en_2.0.8.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
C81A0000DBC2E3F7CBB3DA01
(PID) Process:(6856) 4mekey_ts_en_2.0.8.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
16A95D1E6F0E663F9BD653334C7C04964658018922F34F2CE5BF20B384593CBA
(PID) Process:(6856) 4mekey_ts_en_2.0.8.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
Executable files
406
Suspicious files
205
Text files
321
Unknown types
15

Dropped files

PID
Process
Filename
Type
65409f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeC:\Users\admin\AppData\Local\Temp\4mekey_ts_en\4mekey_ts_en_2.0.8.exe —
MD5:—
SHA256:—
65409f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exeC:\Users\admin\AppData\Local\Temp\4mekey_ts_en\4mekey_ts_en_2.0.8.exe.xmltext
MD5:7D59192EE9C016928E13E80868EBB075
SHA256:1A08CA415460D4BE20B5593DE857A303E90D66B020D85CF4CED4EFAB0BCE2E3D
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\is-GLMU9.tmpexecutable
MD5:F2089E537431E72CE2AEA9E1D69B92F2
SHA256:8DD051AC5BBF096B50F286005234E09BE4330563117FA69CB9CC6F45DB612DB7
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\unins000.exeexecutable
MD5:DE11286FF28F605EB84003AF05534F10
SHA256:272C5366968C640CD059FE03F32A16C3F59FDF3A8A05AEE59204460C23DF6EA6
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\AgentSupportCLR.dllexecutable
MD5:DB4819BE471C6F13018029096652A4C6
SHA256:A6B70D74AFAD5E7B2F475AC4645FAF3916BAE34465AAE688502D5C127856B797
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\is-DN77I.tmpexecutable
MD5:F2089E537431E72CE2AEA9E1D69B92F2
SHA256:8DD051AC5BBF096B50F286005234E09BE4330563117FA69CB9CC6F45DB612DB7
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\is-EIH1R.tmpexecutable
MD5:1C654F7472A6782F5A62C2BD9E19A11D
SHA256:F83B377CF3EEDB4C9EAD8A2AC1D9FE00C5579534B4A47EF3D8EB69607E250B02
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\is-I1MV7.tmpxml
MD5:7F119B483101AABE56905A9B4DAC9FDD
SHA256:318D4ED2D680CFCAC557622B071E4CB352722A95934EF0226EBF72A6B857D300
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\4uKey - Password Manager.exe.configxml
MD5:7F119B483101AABE56905A9B4DAC9FDD
SHA256:318D4ED2D680CFCAC557622B071E4CB352722A95934EF0226EBF72A6B857D300
68564mekey_ts_en_2.0.8.tmpC:\Program Files (x86)\Tenorshare\4uKey - Password Manager\is-2M53P.tmpexecutable
MD5:DB4819BE471C6F13018029096652A4C6
SHA256:A6B70D74AFAD5E7B2F475AC4645FAF3916BAE34465AAE688502D5C127856B797
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
49
TCP/UDP connections
242
DNS requests
137
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAhflMAthXvozBT%2FU%2B2iPio%3D
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
GET
301
104.17.207.155:80
http://www.tenorshare.com/downloads/service/softwarelog.txt
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
GET
200
208.95.112.1:80
http://ip-api.com/csv
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
POST
200
142.250.185.78:80
http://www.google-analytics.com/collect
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
636
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5612
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
5140
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4364
svchost.exe
239.255.255.250:1900
—
—
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
104.17.207.155:80
www.tenorshare.com
CLOUDFLARENET
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
104.17.207.155:443
www.tenorshare.com
CLOUDFLARENET
—
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
192.229.221.95:80
—
EDGECAST
US
whitelisted
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
unknown
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
104.18.24.249:443
update.tenorshare.com
CLOUDFLARENET
—
unknown

DNS requests

Domain
IP
Reputation
www.tenorshare.com
  • 104.17.207.155
  • 104.17.192.141
whitelisted
ip-api.com
  • 208.95.112.1
shared
update.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown
www.google-analytics.com
  • 142.250.185.78
whitelisted
download.tenorshare.com
  • 104.18.24.249
  • 104.18.25.249
unknown
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 184.51.127.41
  • 184.51.127.51
whitelisted
www.microsoft.com
  • 92.122.89.124
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.0
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.73
whitelisted
go.microsoft.com
  • 23.14.28.77
whitelisted

Threats

PID
Process
Class
Message
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
6540
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe
Possibly Unwanted Program Detected
ET ADWARE_PUP Tenorshare Google Analytics Checkin
—
—
Potential Corporate Privacy Violation
ET POLICY Unsupported/Fake Windows NT Version 5.0
—
—
Misc activity
ET INFO DNS Query to Alibaba Cloud CDN Domain (aliyuncs .com)
6728
msedge.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] External IP Check (pro.ip-api.com)
6728
msedge.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] External IP Check (pro.ip-api.com)
6728
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] A free CDN for open source projects (jsdelivr .net)
3 ETPRO signatures available at the full report
Process
Message
AppleMobileDeviceProcess.exe
ASL checking for logging parameters in environment variable "AppleMobileDeviceProcess.exe.log"
AppleMobileDeviceProcess.exe
ASL checking for logging parameters in environment variable "asl.log"
4uKey - Password Manager.exe
2024-06-01 02:33:14:410 4uKey - Password Manager<4744>:: TSClientContext::Init ios_manager version = 5.0.0.670
4uKey - Password Manager.exe
DeviceMap argument is empty. Skipping appending of deprecated devices.
4uKey - Password Manager.exe
4uKey - Password Manager.exe
Couldn't load our private device map. Device identification will be limited.
4uKey - Password Manager.exe
4uKey - Password Manager.exe
2024-06-01 02:33:14:442 4uKey - Password Manager<1724>:: TSDeviceStateManagerImpl::DetectUsbInsertion Enter
4uKey - Password Manager.exe
ASL checking for logging parameters in environment variable "asl.log"
4uKey - Password Manager.exe
2024-06-01 02:33:14:442 4uKey - Password Manager<1724>:: TSDeviceStateManagerImpl::DetectUsbInsertion Leave
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
9f39a6e38e472324e31cc76df7031c3ea094e4930df34d606f41c459ee8d5157.exe