d84b2a0632974c30a318ca1b44f42c5dc5078c20b9ff6707c0e7892b9e3676d6

Resubmissions

25-08-2023 04:18

230825-ew69csaf3y 7

24-08-2023 04:13

230824-etjehsbd81 7

23-08-2023 14:35

230823-rxy1laeb7y 7

Analysis

max time kernel
296s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23-08-2023 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tsetup-x6.msi
Size

40.1MB
MD5

5e1986968c2bd94cbdef6e874196c833
SHA1

84266c00bb29574dc93acd6b9ce8160d6ac446db
SHA256

d84b2a0632974c30a318ca1b44f42c5dc5078c20b9ff6707c0e7892b9e3676d6
SHA512

29425d1f42aeb1ac795e7af5a0965fd277befa0453efc1e81de368a9d6528e8d4e7f5a93ccdfa11413516738186e3636ad6a4188a42a207042786c1b88ec36cb
SSDEEP

786432:8aigSeDY+BFJOjSX+nhqcoiHGgLrc20pHDXRckQ1I/r2qgkG+YvwH4:8aq65nkSX+nhqcdng51DXRckQ6jFgmYh

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Nxng.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LETsite_Cure.lnk	Nxng.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LETsite_Cure.lnk	Nxng.exe

Executes dropped EXE 6 IoCs

Processes:

999.exetsetup-x64.4.8.3.exetsetup-x64.4.8.3.tmpNxng.exeUUATDT.exeTelegram.exe

pid process

552 999.exe
4784 tsetup-x64.4.8.3.exe
4688 tsetup-x64.4.8.3.tmp
844 Nxng.exe
4328 UUATDT.exe
5096 Telegram.exe

pid	process
552	999.exe
4784	tsetup-x64.4.8.3.exe
4688	tsetup-x64.4.8.3.tmp
844	Nxng.exe
4328	UUATDT.exe
5096	Telegram.exe

Loads dropped DLL 12 IoCs

Processes:

MsiExec.exeMsiExec.exeUUATDT.exeTelegram.exe

pid	process
644	MsiExec.exe
644	MsiExec.exe
644	MsiExec.exe
644	MsiExec.exe
644	MsiExec.exe
644	MsiExec.exe
3004	MsiExec.exe
3004	MsiExec.exe
644	MsiExec.exe
644	MsiExec.exe
4328	UUATDT.exe
5096	Telegram.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Telegram.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exeUUATDT.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	UUATDT.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	UUATDT.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	UUATDT.exe
File opened (read-only)	\??\K:	UUATDT.exe
File opened (read-only)	\??\Z:	UUATDT.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	UUATDT.exe
File opened (read-only)	\??\Y:	UUATDT.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	UUATDT.exe
File opened (read-only)	\??\H:	UUATDT.exe
File opened (read-only)	\??\J:	UUATDT.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	UUATDT.exe
File opened (read-only)	\??\L:	UUATDT.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	UUATDT.exe
File opened (read-only)	\??\P:	UUATDT.exe
File opened (read-only)	\??\W:	UUATDT.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\O:	UUATDT.exe
File opened (read-only)	\??\Q:	UUATDT.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	UUATDT.exe
File opened (read-only)	\??\I:	UUATDT.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	UUATDT.exe
File opened (read-only)	\??\R:	UUATDT.exe
File opened (read-only)	\??\T:	UUATDT.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe	msiexec.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI38BA.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7723E04B-CD41-4EED-8693-618C2BEFD194}	msiexec.exe
File created	C:\Windows\Installer\e59381d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59381d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3CA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3986.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 3 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 48 IoCs

Processes:

explorer.exeTelegram.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000e35626631100557365727300640009000400efbe874f774817576b742e000000c70500000000010000000000000000003a0000000000575fd50055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 7c003100000000001757ab7411005075626c69630000660009000400efbe874fdb491757ac742e000000f80500000000010000000000000000003c0000000000c1bbaa005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 78003100000000001757af7411004d7573696300640009000400efbe874fdb491757af742e000000fd0500000000010000000000000000003a0000000000f9d09e004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 54003100000000001757af7410007966385f534900003e0009000400efbe1757af741757af742e000000fb310200000009000000000000000000000000000000f9d09e007900660038005f0053004900000016000000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Music"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\shell	Telegram.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tdesktop.tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1722984668-1829624581-3022101259-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

explorer.exeTelegram.exe

pid process

1316 explorer.exe
5096 Telegram.exe

pid	process
1316	explorer.exe
5096	Telegram.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.tmp999.exeUUATDT.exe

pid	process
4204	msiexec.exe
4204	msiexec.exe
4688	tsetup-x64.4.8.3.tmp
4688	tsetup-x64.4.8.3.tmp
552	999.exe
552	999.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe
4328	UUATDT.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3636	msiexec.exe
Token: SeSecurityPrivilege	4204	msiexec.exe
Token: SeCreateTokenPrivilege	3636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3636	msiexec.exe
Token: SeLockMemoryPrivilege	3636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3636	msiexec.exe
Token: SeMachineAccountPrivilege	3636	msiexec.exe
Token: SeTcbPrivilege	3636	msiexec.exe
Token: SeSecurityPrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeLoadDriverPrivilege	3636	msiexec.exe
Token: SeSystemProfilePrivilege	3636	msiexec.exe
Token: SeSystemtimePrivilege	3636	msiexec.exe
Token: SeProfSingleProcessPrivilege	3636	msiexec.exe
Token: SeIncBasePriorityPrivilege	3636	msiexec.exe
Token: SeCreatePagefilePrivilege	3636	msiexec.exe
Token: SeCreatePermanentPrivilege	3636	msiexec.exe
Token: SeBackupPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeShutdownPrivilege	3636	msiexec.exe
Token: SeDebugPrivilege	3636	msiexec.exe
Token: SeAuditPrivilege	3636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3636	msiexec.exe
Token: SeChangeNotifyPrivilege	3636	msiexec.exe
Token: SeRemoteShutdownPrivilege	3636	msiexec.exe
Token: SeUndockPrivilege	3636	msiexec.exe
Token: SeSyncAgentPrivilege	3636	msiexec.exe
Token: SeEnableDelegationPrivilege	3636	msiexec.exe
Token: SeManageVolumePrivilege	3636	msiexec.exe
Token: SeImpersonatePrivilege	3636	msiexec.exe
Token: SeCreateGlobalPrivilege	3636	msiexec.exe
Token: SeCreateTokenPrivilege	3636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3636	msiexec.exe
Token: SeLockMemoryPrivilege	3636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3636	msiexec.exe
Token: SeMachineAccountPrivilege	3636	msiexec.exe
Token: SeTcbPrivilege	3636	msiexec.exe
Token: SeSecurityPrivilege	3636	msiexec.exe
Token: SeTakeOwnershipPrivilege	3636	msiexec.exe
Token: SeLoadDriverPrivilege	3636	msiexec.exe
Token: SeSystemProfilePrivilege	3636	msiexec.exe
Token: SeSystemtimePrivilege	3636	msiexec.exe
Token: SeProfSingleProcessPrivilege	3636	msiexec.exe
Token: SeIncBasePriorityPrivilege	3636	msiexec.exe
Token: SeCreatePagefilePrivilege	3636	msiexec.exe
Token: SeCreatePermanentPrivilege	3636	msiexec.exe
Token: SeBackupPrivilege	3636	msiexec.exe
Token: SeRestorePrivilege	3636	msiexec.exe
Token: SeShutdownPrivilege	3636	msiexec.exe
Token: SeDebugPrivilege	3636	msiexec.exe
Token: SeAuditPrivilege	3636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3636	msiexec.exe
Token: SeChangeNotifyPrivilege	3636	msiexec.exe
Token: SeRemoteShutdownPrivilege	3636	msiexec.exe
Token: SeUndockPrivilege	3636	msiexec.exe
Token: SeSyncAgentPrivilege	3636	msiexec.exe
Token: SeEnableDelegationPrivilege	3636	msiexec.exe
Token: SeManageVolumePrivilege	3636	msiexec.exe
Token: SeImpersonatePrivilege	3636	msiexec.exe
Token: SeCreateGlobalPrivilege	3636	msiexec.exe
Token: SeCreateTokenPrivilege	3636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3636	msiexec.exe
Token: SeLockMemoryPrivilege	3636	msiexec.exe

Suspicious use of FindShellTrayWindow 11 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.tmp999.exeTelegram.exe

pid	process
3636	msiexec.exe
3636	msiexec.exe
4688	tsetup-x64.4.8.3.tmp
552	999.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe

Suspicious use of SendNotifyMessage 7 IoCs

Processes:

Telegram.exe

pid process

5096 Telegram.exe
5096 Telegram.exe
5096 Telegram.exe
5096 Telegram.exe
5096 Telegram.exe
5096 Telegram.exe
5096 Telegram.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

999.exeexplorer.exeUUATDT.exeTelegram.exe

pid process

552 999.exe
552 999.exe
1316 explorer.exe
1316 explorer.exe
4328 UUATDT.exe
5096 Telegram.exe

pid	process
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe
5096	Telegram.exe

pid	process
552	999.exe
552	999.exe
1316	explorer.exe
1316	explorer.exe
4328	UUATDT.exe
5096	Telegram.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.exe999.exeexplorer.exetsetup-x64.4.8.3.tmp

description	pid	process	target process
PID 4204 wrote to memory of 644	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 644	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 644	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 3624	4204	msiexec.exe	srtasks.exe
PID 4204 wrote to memory of 3624	4204	msiexec.exe	srtasks.exe
PID 4204 wrote to memory of 3004	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 3004	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 3004	4204	msiexec.exe	MsiExec.exe
PID 4204 wrote to memory of 552	4204	msiexec.exe	999.exe
PID 4204 wrote to memory of 552	4204	msiexec.exe	999.exe
PID 4204 wrote to memory of 552	4204	msiexec.exe	999.exe
PID 4784 wrote to memory of 4688	4784	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 4784 wrote to memory of 4688	4784	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 4784 wrote to memory of 4688	4784	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 552 wrote to memory of 336	552	999.exe	explorer.exe
PID 552 wrote to memory of 336	552	999.exe	explorer.exe
PID 1316 wrote to memory of 844	1316	explorer.exe	Nxng.exe
PID 1316 wrote to memory of 844	1316	explorer.exe	Nxng.exe
PID 1316 wrote to memory of 844	1316	explorer.exe	Nxng.exe
PID 1316 wrote to memory of 4328	1316	explorer.exe	UUATDT.exe
PID 1316 wrote to memory of 4328	1316	explorer.exe	UUATDT.exe
PID 1316 wrote to memory of 4328	1316	explorer.exe	UUATDT.exe
PID 4688 wrote to memory of 5096	4688	tsetup-x64.4.8.3.tmp	Telegram.exe
PID 4688 wrote to memory of 5096	4688	tsetup-x64.4.8.3.tmp	Telegram.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tsetup-x6.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 543E3A1A79BF4F56455550E75AEA042D C
2⤵
- Loads dropped DLL
PID:644

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3624

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 10994877588F7A46DBE572A13D8CB853
2⤵
- Loads dropped DLL
PID:3004

C:\Users\Admin\Documents\999.exe
"C:\Users\Admin\Documents\999.exe" 命令行
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\explorer.exe
C:\Windows\explorer.exe C:\Users\Public\Music\yf8_SI
3⤵
PID:336

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2872

C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe
"C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4784

C:\Users\Admin\AppData\Local\Temp\is-P3768.tmp\tsetup-x64.4.8.3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-P3768.tmp\tsetup-x64.4.8.3.tmp" /SL5="$80064,40001849,814592,C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4688

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5096

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1316

C:\Users\Admin\AppData\Roaming\YUEYU\Nxng.exe
"C:\Users\Admin\AppData\Roaming\YUEYU\Nxng.exe" -n C:\Users\Admin\AppData\Roaming\YUEYU\1YH.zip -d C:\Users\Admin\AppData\Roaming
2⤵
- Drops startup file
- Executes dropped EXE
PID:844

C:\Users\Public\Videos\M5M5P5\UUATDT.exe
"C:\Users\Public\Videos\M5M5P5\UUATDT.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4328

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e59381e.rbs

Filesize
1KB

MD5
d3c867e979844d69107b6055df44deb4

SHA1
4c4e61eaf5d4503fb4f3ed18084c73ebf951ae3f

SHA256
1456fabd63388d358deeb173c1782b1b3e4220cd1acb943970e4057eb715a32e

SHA512
96b7202ddaec1d7916b265d2a5f2eee8a414f3a69ddcd50eea438c6160de741c5ac92ae96b663115e4581081f5dad6d4155e6aa4efde8535df53c543c64377a4

Download Submit
C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe

Filesize
39.0MB

MD5
c5eea4798d424e3f5dccf04bde9be82e

SHA1
575c10e8604b51591bc492a9f7c5999e2443dffc

SHA256
46c1ddad54a00ebf0a4e486499e73ff0496569c0168d6ff56d3671a08153b4e4

SHA512
e2512abe59cdb29501031619da35e68768d9f86a05141b19dfb22ccf3fcf038fd03b5fa8be042c09abbf4b312ab8d190a54f74a552602abbe0c55bd9d0798cfc

Download Submit
C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe

Filesize
39.0MB

MD5
c5eea4798d424e3f5dccf04bde9be82e

SHA1
575c10e8604b51591bc492a9f7c5999e2443dffc

SHA256
46c1ddad54a00ebf0a4e486499e73ff0496569c0168d6ff56d3671a08153b4e4

SHA512
e2512abe59cdb29501031619da35e68768d9f86a05141b19dfb22ccf3fcf038fd03b5fa8be042c09abbf4b312ab8d190a54f74a552602abbe0c55bd9d0798cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3FD4.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI3FD4.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4023.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI4023.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9EC0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9EC0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA24C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA24C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA27C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA27C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA27C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA29C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA29C.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA4C0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA4C0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA4E0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIA4E0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P3768.tmp\tsetup-x64.4.8.3.tmp

Filesize
3.0MB

MD5
c6519ab04ac2122009b49bc5a5a286f5

SHA1
70bae0dd5d397ed8ec971e235bb1e2a8a73ab8da

SHA256
80de8002597dc3b197d28b39056b3aa815fcaad79b4333c537e0b6c77f1930f9

SHA512
f05db9a1af925ec869ee6b3dfa6aa6c024742711ffbd9710fcf8fd32d2ee7a617a34ce9e40636c0e9c7c5d9cdf951060e52d9319cab85059278cd5486277f18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P3768.tmp\tsetup-x64.4.8.3.tmp

Filesize
3.0MB

MD5
c6519ab04ac2122009b49bc5a5a286f5

SHA1
70bae0dd5d397ed8ec971e235bb1e2a8a73ab8da

SHA256
80de8002597dc3b197d28b39056b3aa815fcaad79b4333c537e0b6c77f1930f9

SHA512
f05db9a1af925ec869ee6b3dfa6aa6c024742711ffbd9710fcf8fd32d2ee7a617a34ce9e40636c0e9c7c5d9cdf951060e52d9319cab85059278cd5486277f18e

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll

Filesize
4.7MB

MD5
62a89e7867d853fee9ad07b7c9d64379

SHA1
944a53602492187308352103d80ff27af1093abf

SHA256
d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9

SHA512
7f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll

Filesize
4.7MB

MD5
62a89e7867d853fee9ad07b7c9d64379

SHA1
944a53602492187308352103d80ff27af1093abf

SHA256
d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9

SHA512
7f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\settingss.qCTYSG

Filesize
1KB

MD5
3268b25bcb614fc05d22b367d039f576

SHA1
3a71be3a3ac5f5d0b7ff74685ba7ac3faad89bab

SHA256
11cd9caf8f6da068ebbc6636db2cc91682909d3ccfd5375ac1a255dc9c7e3dc4

SHA512
4561f4cded8f80c2276be232b03a6f79dd523807baa524506a862eae1fd40b0d5877123620f4702702d50250b53a5be709468d6fbdbbb21faa436d97a1e5697f

Download Submit
C:\Users\Admin\AppData\Roaming\YUEYU\1YH.zip

Filesize
1KB

MD5
d0d2ad48e72a1872bbd6912ab48c9aa7

SHA1
7b396a8e3f6d926c5d35680bff14695845c678a3

SHA256
b0fb8be8c933a93314aa52b6f88b3982787c2919e9cef24073b20ecc3a880847

SHA512
19720f3b65b2e0ac897fcee3811f64362b17e5229fa864a6969ee092f6bd244f8559f1e1302a893bfb6bc103ade3e0370830e5e5d6907fc4f823f682ee7efae3

Download Submit
C:\Users\Admin\AppData\Roaming\YUEYU\LETsite_Cure.lnk

Filesize
1KB

MD5
46446643819bd8fceb3f342330afacb1

SHA1
fd869d4486e587b2c837137225ceb692ff9f345e

SHA256
db543e1b63430f58382c7af84e2b5ecf17717107edf2c44ab55336ce75c53735

SHA512
48f27a7e6d29d09f9f759ff60a9bd4df3eb74996fc9197b52256de7136dd62d28b90234a7eff43550072cbab20259005a78f25c1d0807d7c8cd05c247dffe0de

Download Submit
C:\Users\Admin\AppData\Roaming\YUEYU\Nxng.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\AppData\Roaming\YUEYU\Nxng.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\AppData\Roaming\YUEYU\Nxng.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\Documents\999.exe

Filesize
792KB

MD5
cb072093838a0215803d0185df4a9af1

SHA1
4c345e5b50ce52abed5842e70f99e0032c87eaf5

SHA256
96d0806e438b5508a4bc0c85670325201e5e0abbf3b338d5ffbff601b05017af

SHA512
03ab19eba3febab68ce3636d6081016cd69e82b40277eea50a9aeb29a6c47033c245a471ef91500fdc09375a19b379dfe226bcc3585d40856684a5c23d626133

Download Submit
C:\Users\Admin\Documents\999.exe

Filesize
792KB

MD5
cb072093838a0215803d0185df4a9af1

SHA1
4c345e5b50ce52abed5842e70f99e0032c87eaf5

SHA256
96d0806e438b5508a4bc0c85670325201e5e0abbf3b338d5ffbff601b05017af

SHA512
03ab19eba3febab68ce3636d6081016cd69e82b40277eea50a9aeb29a6c47033c245a471ef91500fdc09375a19b379dfe226bcc3585d40856684a5c23d626133

Download Submit
C:\Users\Public\Music\yf8_SI\Eue4XO.lnk

Filesize
1006B

MD5
a06f95de56786d5d29a3e95bc705c887

SHA1
555bd9a2773013ee01e512cd8e037608e67a5522

SHA256
700d4b705d9990476c7e7c3dc51d01250649fd58d1b8f13d284c7eddd886ece5

SHA512
6c563bb98ad21b6a648f2d050ec5e18d483b910132fe9076a2deb9b597ee6296daf59a82af0cc6a26f8eec51487efcb74cc53bc21c658e6adf510e83dc719293

Download Submit
C:\Users\Public\Music\yf8_SI\KqkdUK.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\Lsbl2z.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\TAgXGn.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\TAgXGn.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\WCmc6_.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\_Gzg93.lnk

Filesize
1006B

MD5
476dff15e22b016e2338f4a2a5ee5339

SHA1
2ec10b8102e1be27fe828844823076ebd40e06f5

SHA256
7fc83f090fc1bf687dc16b5b0794d845bb99c67d1336377087799c3a9a86253f

SHA512
a5c9b5dfd8cd4151acc5ec53d973d2c545327b02f055975275cc1f96d853dcbe3b5cebaeb85a5fcb1a791361d8cfeb0fdb6f9cc71ad20c5e9f5f108d2af81abc

Download Submit
C:\Users\Public\Music\yf8_SI\f5_SJC.lnk

Filesize
1006B

MD5
e39c4cab288426531de7e183edc67cc0

SHA1
d570cc9f7cbd85ef65a5b777bfc8bfd957646350

SHA256
445ea70990df6af5167fb65989d342386f6012fafe29c2320e467a48e5a7d7c0

SHA512
c35ab33c287c875d9109085c9e0415d25bbd30f45136506e78f1fe999fdab7511c2d9ddfc733edcf37b4f47dd57d1d4e2a04aef4ac80a40ca2df1633b654caf7

Download Submit
C:\Users\Public\Music\yf8_SI\k1UOEx.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\lb4LvY.lnk

Filesize
1006B

MD5
d1375c10f5ff2b6c3bb1fd21cb430a73

SHA1
2226bd68eab717119f4773590c68025b076406db

SHA256
9298a5a60cc291ee14e596553be3346b3e1198a113efe75ca987a31ac1b59304

SHA512
230c87b4eea069b7ee5166c501a0b5fa41e5f87c03fad5b2059bb58f79c73fb23f3008c12124a35363413c41071728422ebd93aabd602c23788bcd1c68ef1d76

Download Submit
C:\Users\Public\Music\yf8_SI\lf8YSy.lnk

Filesize
1006B

MD5
8612e24cd6b85cea4d550e6b4dd6db06

SHA1
31a5e33942189b3d7559a46b2e991d5033a50676

SHA256
1ba2487aa353fb673772071e3defee92f2b4b244b7b3229e1f06dc0b57ecb918

SHA512
a34a4c65155459051c8bc4967c7718d61321be19617d7a39cf2bd4f7d82141c285722daf530d0a22fffe0792458a065201a8d88e4496a09c2d603c94f3b007ea

Download Submit
C:\Users\Public\Music\yf8_SI\t0GnUN.lnk

Filesize
1006B

MD5
288ab8bccccfba230c60dee43f9f2051

SHA1
8b100e595f4bd9c0f32b9acbc1b7708f93f4d076

SHA256
b57d7f92013d771602720f558f8e302d20ca69619d960f03b8b4016b21a57baf

SHA512
d03fe15cb4cffca3723effd5d5828d4678b8660e64fca1b9697a33ebf315aae06b65722a317038f14d7dc46ef2cdd162b4005a9482f076ccce721d02d630f9e3

Download Submit
C:\Users\Public\Music\yf8_SI\t93TMt.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\wpg93T.url

Filesize
74B

MD5
f6146a91233b92089b16d682afd8800a

SHA1
b44b268b1afbe7386068ecf34f8829f3a1271037

SHA256
449e43e8cdc866fb306dae02b7a149c5499901a2467f9bb075e789a8ee38a67a

SHA512
5741921f4e2fcd677a290bf513109752ed1273776b28fb11ec6f897a506516001be0c6c1ace45ff8f33b86895627c6f819aca984d1b6eebe84189e70d30383cd

Download Submit
C:\Users\Public\Music\yf8_SI\zg0wd3.lnk

Filesize
1006B

MD5
674c89e9b6ae5db0d03f0c17f7c8bcc4

SHA1
19410afb8672e00ef007ea94cc852aca62b43919

SHA256
fc98a92573db068a42922fbfa25d20b1fa850316f1b126cfc11e4efe0d8c5e27

SHA512
55188f7cd96e95af32a636170410680b7f37a1c1cf4414f7df78fa3e72113963d56208bac73feedf73fb9068f8e5f450b7507823a78e392ef10da07cbb8e9aae

Download Submit
C:\Users\Public\VRBRAU

Filesize
1.3MB

MD5
05a017c10b5616c10b7f14a6963f24d7

SHA1
00ec6ac5ab564914ac99ed05b7d3159676017a4c

SHA256
d041cd04d6a70d1858536da714d4593a47f7ee8c05dd51f6f47508493b3cb6a8

SHA512
34394083d798d8cec99161a07118ad15b4b0cb54ce574ed514db7dce7601413849a3d9338bcf595981b8333a23b6ae0ca1827964e7e72ecdbf75ce7e358a8285

Download Submit
C:\Users\Public\Videos\M5M5P5\UNIANSI.dll

Filesize
2.4MB

MD5
22511904f621d1eaa3ab86a1190f30c8

SHA1
35940f3845c6cb58a812309f4918ef108f407ad5

SHA256
45d30ae58238ad8221f5530fe40bc7560f906c4c84926477423d405440738823

SHA512
7dbbff9eca623adb1647e4eb57aa85a305aeb397ca363a0ef2c7914715813c0597a09bf428c028d630a03731f5053176187e598b89303209c53e1caa9f5847be

Download Submit
C:\Users\Public\Videos\M5M5P5\UUATDT.exe

Filesize
41KB

MD5
73b8b5915e8edb68aafbadcedb012f86

SHA1
e0b30ea35fc04e2c591a93feb32fc8b973ed321e

SHA256
098de42eb3d95eafbbc132293e2a18edd5ec7de1a73571b527fad55d5bca2064

SHA512
aa00b72c2788e9eef8351adb4e602361807d308d85564bf067502b7c62b1125102e9470b3361a21c53f59e6d314e3c667374fd4262fe0d15b64f3766194ec66e

Download Submit
C:\Users\Public\Videos\M5M5P5\UUATDT.exe

Filesize
41KB

MD5
73b8b5915e8edb68aafbadcedb012f86

SHA1
e0b30ea35fc04e2c591a93feb32fc8b973ed321e

SHA256
098de42eb3d95eafbbc132293e2a18edd5ec7de1a73571b527fad55d5bca2064

SHA512
aa00b72c2788e9eef8351adb4e602361807d308d85564bf067502b7c62b1125102e9470b3361a21c53f59e6d314e3c667374fd4262fe0d15b64f3766194ec66e

Download Submit
C:\Users\Public\Videos\M5M5P5\UUATDT.exe

Filesize
41KB

MD5
73b8b5915e8edb68aafbadcedb012f86

SHA1
e0b30ea35fc04e2c591a93feb32fc8b973ed321e

SHA256
098de42eb3d95eafbbc132293e2a18edd5ec7de1a73571b527fad55d5bca2064

SHA512
aa00b72c2788e9eef8351adb4e602361807d308d85564bf067502b7c62b1125102e9470b3361a21c53f59e6d314e3c667374fd4262fe0d15b64f3766194ec66e

Download Submit
C:\Users\Public\Videos\M5M5P5\UniAnsi.dll

Filesize
2.4MB

MD5
22511904f621d1eaa3ab86a1190f30c8

SHA1
35940f3845c6cb58a812309f4918ef108f407ad5

SHA256
45d30ae58238ad8221f5530fe40bc7560f906c4c84926477423d405440738823

SHA512
7dbbff9eca623adb1647e4eb57aa85a305aeb397ca363a0ef2c7914715813c0597a09bf428c028d630a03731f5053176187e598b89303209c53e1caa9f5847be

Download Submit
C:\Users\Public\Videos\M5M5P5\info.txt

Filesize
761KB

MD5
a30b2ac506a66831f0c0ba66f3eccba3

SHA1
4531dac9c8100ff97b43388ad41cf8185966bb91

SHA256
fd1419f367e94409709e65801f2aaa9c93a3db43b0c3b92bbd113c82dada873c

SHA512
c6a57dc2a0428da358d7fc061b90494bd294766332d19e47b115db0c7731cbf2943a931a42c8d419275dd4a8fb61bd2315504c007ac1e8680c4c5ac43a913ab6

Download Submit
C:\Windows\Installer\MSI38BA.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Windows\Installer\MSI38BA.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Windows\Installer\MSI3986.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Windows\Installer\MSI3986.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
7308bf97a5449760082f2b0ea55a4418

SHA1
58afe3aea30d6dfceda016fe690ec93352925d04

SHA256
f9580112dd2b7a4cc5dc845e4004febb25272b8f25fa04a8d85ce2e7227c9f65

SHA512
f8d1441f3c7cb32a2faa5c911ce052273ca8ac9304d5d5652ceddf6f48f2b83c72c118ebdf32f17bb60e8b69cc1b44d9a120fef0d1bf52b56c0cdc5a8402e891

Download Submit
\??\Volume{0fca93b8-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{17ad9081-7bfe-44e6-a385-164c97de2911}_OnDiskSnapshotProp

Filesize
5KB

MD5
3074f930c5fdb5e6025828e46a6aaebb

SHA1
c327bbf88c5c98b862c81459a8369b74c5dea4b0

SHA256
b18f8b392737b492a08b6214108d14627efcf4556353ada90b741a2c5a8f2c90

SHA512
befc5ab268bfd83c3e4914a1c9e8f4b323acf1acabc576d29959f702c154e9015da487e4fd001f19efa028dfd7164e868e204c7bdc9499b8959a4ca188faf639

Download Submit
memory/552-104-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download
memory/4328-226-0x0000000010000000-0x0000000010318000-memory.dmp

Filesize
3.1MB

Download
memory/4328-218-0x0000000000C60000-0x0000000000CA8000-memory.dmp

Filesize
288KB

Download
memory/4328-212-0x0000000010000000-0x0000000010318000-memory.dmp

Filesize
3.1MB

Download
memory/4688-244-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4688-87-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/4688-207-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4688-99-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4688-130-0x00000000008E0000-0x00000000008E1000-memory.dmp

Filesize
4KB

Download
memory/4688-135-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/4784-77-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4784-97-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/4784-253-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/5096-245-0x00000299ABB00000-0x00000299ABB10000-memory.dmp

Filesize
64KB

Download
memory/5096-255-0x00000299ABB00000-0x00000299ABB10000-memory.dmp

Filesize
64KB

Download
memory/5096-326-0x00000299ABB00000-0x00000299ABB10000-memory.dmp

Filesize
64KB

Download