d84b2a0632974c30a318ca1b44f42c5dc5078c20b9ff6707c0e7892b9e3676d6

Resubmissions

25-08-2023 04:18

230825-ew69csaf3y 7

24-08-2023 04:13

230824-etjehsbd81 7

23-08-2023 14:35

230823-rxy1laeb7y 7

Analysis

max time kernel
148s
max time network
160s
platform
windows10-1703_x64
resource
win10-20230703-en
resource tags

arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
submitted
25-08-2023 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tsetup-x6.msi
Size

40.1MB
MD5

5e1986968c2bd94cbdef6e874196c833
SHA1

84266c00bb29574dc93acd6b9ce8160d6ac446db
SHA256

d84b2a0632974c30a318ca1b44f42c5dc5078c20b9ff6707c0e7892b9e3676d6
SHA512

29425d1f42aeb1ac795e7af5a0965fd277befa0453efc1e81de368a9d6528e8d4e7f5a93ccdfa11413516738186e3636ad6a4188a42a207042786c1b88ec36cb
SSDEEP

786432:8aigSeDY+BFJOjSX+nhqcoiHGgLrc20pHDXRckQ1I/r2qgkG+YvwH4:8aq65nkSX+nhqcdng51DXRckQ6jFgmYh

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

i_Jz.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LETsite_Cure.lnk	i_Jz.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\startup\LETsite_Cure.lnk	i_Jz.exe

Executes dropped EXE 6 IoCs

Processes:

999.exetsetup-x64.4.8.3.exetsetup-x64.4.8.3.tmpi_Jz.exeWG_G_F.exeTelegram.exe

pid process

4748 999.exe
2156 tsetup-x64.4.8.3.exe
1636 tsetup-x64.4.8.3.tmp
5024 i_Jz.exe
3708 WG_G_F.exe
3272 Telegram.exe

pid	process
4748	999.exe
2156	tsetup-x64.4.8.3.exe
1636	tsetup-x64.4.8.3.tmp
5024	i_Jz.exe
3708	WG_G_F.exe
3272	Telegram.exe

Loads dropped DLL 13 IoCs

Processes:

MsiExec.exeMsiExec.exeWG_G_F.exeTelegram.exe

pid	process
660	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
4996	MsiExec.exe
4996	MsiExec.exe
660	MsiExec.exe
660	MsiExec.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3272	Telegram.exe

Drops desktop.ini file(s) 1 IoCs

Processes:

Telegram.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exeWG_G_F.exe

description	ioc	process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	WG_G_F.exe
File opened (read-only)	\??\L:	WG_G_F.exe
File opened (read-only)	\??\R:	WG_G_F.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	WG_G_F.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	WG_G_F.exe
File opened (read-only)	\??\N:	WG_G_F.exe
File opened (read-only)	\??\O:	WG_G_F.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\X:	WG_G_F.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	WG_G_F.exe
File opened (read-only)	\??\Q:	WG_G_F.exe
File opened (read-only)	\??\U:	WG_G_F.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	WG_G_F.exe
File opened (read-only)	\??\J:	WG_G_F.exe
File opened (read-only)	\??\S:	WG_G_F.exe
File opened (read-only)	\??\T:	WG_G_F.exe
File opened (read-only)	\??\Y:	WG_G_F.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	WG_G_F.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	WG_G_F.exe
File opened (read-only)	\??\E:	WG_G_F.exe

Drops file in Program Files directory 1 IoCs

Processes:

msiexec.exe

description ioc process

File created C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe	msiexec.exe

Drops file in Windows directory 9 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e580a5b.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAC9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC12.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7723E04B-CD41-4EED-8693-618C2BEFD194}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e580a5b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

msiexec.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe

Modifies registry class 48 IoCs

Processes:

explorer.exeTelegram.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 7800310000000000e35618501100557365727300640009000400efbe724a0b5de35618502e000000320500000000010000000000000000003a00000000006a708a0055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Music"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 780031000000000019577d2211004d7573696300640009000400efbe724a6fa819577d222e000000680500000000010000000000000000003a0000000000187999004d007500730069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380030003300000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\URL Protocol	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 7c003100000000001957772211005075626c69630000660009000400efbe724a6fa8195777222e000000630500000000010000000000000000003c0000000000a365f9005000750062006c0069006300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003600000016000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 540031000000000019577d221000345945796f6900003e0009000400efbe19577d2219577d222e000000d3af01000000060000000000000000000000000000001879990034005900450079006f006900000016000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1766410430-2870137818-4067673745-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Telegram.exe

pid process

3272 Telegram.exe

pid	process
3272	Telegram.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.tmp999.exeWG_G_F.exe

pid	process
4232	msiexec.exe
4232	msiexec.exe
1636	tsetup-x64.4.8.3.tmp
1636	tsetup-x64.4.8.3.tmp
4748	999.exe
4748	999.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe
3708	WG_G_F.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	4268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4268	msiexec.exe
Token: SeSecurityPrivilege	4232	msiexec.exe
Token: SeCreateTokenPrivilege	4268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4268	msiexec.exe
Token: SeLockMemoryPrivilege	4268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4268	msiexec.exe
Token: SeMachineAccountPrivilege	4268	msiexec.exe
Token: SeTcbPrivilege	4268	msiexec.exe
Token: SeSecurityPrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeLoadDriverPrivilege	4268	msiexec.exe
Token: SeSystemProfilePrivilege	4268	msiexec.exe
Token: SeSystemtimePrivilege	4268	msiexec.exe
Token: SeProfSingleProcessPrivilege	4268	msiexec.exe
Token: SeIncBasePriorityPrivilege	4268	msiexec.exe
Token: SeCreatePagefilePrivilege	4268	msiexec.exe
Token: SeCreatePermanentPrivilege	4268	msiexec.exe
Token: SeBackupPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeShutdownPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4268	msiexec.exe
Token: SeAuditPrivilege	4268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4268	msiexec.exe
Token: SeChangeNotifyPrivilege	4268	msiexec.exe
Token: SeRemoteShutdownPrivilege	4268	msiexec.exe
Token: SeUndockPrivilege	4268	msiexec.exe
Token: SeSyncAgentPrivilege	4268	msiexec.exe
Token: SeEnableDelegationPrivilege	4268	msiexec.exe
Token: SeManageVolumePrivilege	4268	msiexec.exe
Token: SeImpersonatePrivilege	4268	msiexec.exe
Token: SeCreateGlobalPrivilege	4268	msiexec.exe
Token: SeCreateTokenPrivilege	4268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4268	msiexec.exe
Token: SeLockMemoryPrivilege	4268	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4268	msiexec.exe
Token: SeMachineAccountPrivilege	4268	msiexec.exe
Token: SeTcbPrivilege	4268	msiexec.exe
Token: SeSecurityPrivilege	4268	msiexec.exe
Token: SeTakeOwnershipPrivilege	4268	msiexec.exe
Token: SeLoadDriverPrivilege	4268	msiexec.exe
Token: SeSystemProfilePrivilege	4268	msiexec.exe
Token: SeSystemtimePrivilege	4268	msiexec.exe
Token: SeProfSingleProcessPrivilege	4268	msiexec.exe
Token: SeIncBasePriorityPrivilege	4268	msiexec.exe
Token: SeCreatePagefilePrivilege	4268	msiexec.exe
Token: SeCreatePermanentPrivilege	4268	msiexec.exe
Token: SeBackupPrivilege	4268	msiexec.exe
Token: SeRestorePrivilege	4268	msiexec.exe
Token: SeShutdownPrivilege	4268	msiexec.exe
Token: SeDebugPrivilege	4268	msiexec.exe
Token: SeAuditPrivilege	4268	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4268	msiexec.exe
Token: SeChangeNotifyPrivilege	4268	msiexec.exe
Token: SeRemoteShutdownPrivilege	4268	msiexec.exe
Token: SeUndockPrivilege	4268	msiexec.exe
Token: SeSyncAgentPrivilege	4268	msiexec.exe
Token: SeEnableDelegationPrivilege	4268	msiexec.exe
Token: SeManageVolumePrivilege	4268	msiexec.exe
Token: SeImpersonatePrivilege	4268	msiexec.exe
Token: SeCreateGlobalPrivilege	4268	msiexec.exe
Token: SeCreateTokenPrivilege	4268	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4268	msiexec.exe
Token: SeLockMemoryPrivilege	4268	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.tmp999.exeTelegram.exe

pid	process
4268	msiexec.exe
4268	msiexec.exe
1636	tsetup-x64.4.8.3.tmp
4748	999.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe

Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Telegram.exe

pid process

3272 Telegram.exe
3272 Telegram.exe
3272 Telegram.exe
3272 Telegram.exe
3272 Telegram.exe
3272 Telegram.exe
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

999.exeWG_G_F.exeTelegram.exe

pid process

4748 999.exe
4748 999.exe
3708 WG_G_F.exe
3272 Telegram.exe

pid	process
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe
3272	Telegram.exe

pid	process
4748	999.exe
4748	999.exe
3708	WG_G_F.exe
3272	Telegram.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

msiexec.exetsetup-x64.4.8.3.exe999.exetsetup-x64.4.8.3.tmp

description	pid	process	target process
PID 4232 wrote to memory of 660	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 660	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 660	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 3404	4232	msiexec.exe	srtasks.exe
PID 4232 wrote to memory of 3404	4232	msiexec.exe	srtasks.exe
PID 4232 wrote to memory of 4996	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 4996	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 4996	4232	msiexec.exe	MsiExec.exe
PID 4232 wrote to memory of 4748	4232	msiexec.exe	999.exe
PID 4232 wrote to memory of 4748	4232	msiexec.exe	999.exe
PID 4232 wrote to memory of 4748	4232	msiexec.exe	999.exe
PID 2156 wrote to memory of 1636	2156	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 2156 wrote to memory of 1636	2156	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 2156 wrote to memory of 1636	2156	tsetup-x64.4.8.3.exe	tsetup-x64.4.8.3.tmp
PID 4748 wrote to memory of 2536	4748	999.exe	explorer.exe
PID 4748 wrote to memory of 2536	4748	999.exe	explorer.exe
PID 1636 wrote to memory of 3272	1636	tsetup-x64.4.8.3.tmp	Telegram.exe
PID 1636 wrote to memory of 3272	1636	tsetup-x64.4.8.3.tmp	Telegram.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\tsetup-x6.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4268

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D3A6F9144AFA3DA2437512FCC5519D5E C
2⤵
- Loads dropped DLL
PID:660

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:3404

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 96949FEECE528B9DA4CBBD0DEAAAEC5F
2⤵
- Loads dropped DLL
PID:4996

C:\Users\Admin\Documents\999.exe
"C:\Users\Admin\Documents\999.exe" 命令行
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4748

C:\Windows\explorer.exe
C:\Windows\explorer.exe C:\Users\Public\Music\4YEyoi
3⤵
PID:2536

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Modifies data under HKEY_USERS
PID:2388

C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe
"C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2156

C:\Users\Admin\AppData\Local\Temp\is-GF8O6.tmp\tsetup-x64.4.8.3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GF8O6.tmp\tsetup-x64.4.8.3.tmp" /SL5="$C01D2,40001849,814592,C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1636

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3272

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:2968

C:\Users\Admin\AppData\Roaming\B4GDW\i_Jz.exe
"C:\Users\Admin\AppData\Roaming\B4GDW\i_Jz.exe" -n C:\Users\Admin\AppData\Roaming\B4GDW\RO7.zip -d C:\Users\Admin\AppData\Roaming
2⤵
- Drops startup file
- Executes dropped EXE
PID:5024

C:\Users\Public\Videos\8RBRAU\WG_G_F.exe
"C:\Users\Public\Videos\8RBRAU\WG_G_F.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e580a5c.rbs

Filesize
1KB

MD5
7a0eb4310db2a1ac448fa467b7b02651

SHA1
ccc931f2fdbf4f086d2f1ce09f55bee42b673a90

SHA256
fdccc145d09723d2caa30bd3ab10251ada08f894077011c8583e2c9acf714161

SHA512
063968e3c58a02fad94120bed7c628c4707cce5e7ccbbf889071fa67b7c5e9fb31584ba5033c30226436458d881a9675b7aa9050bd2fae33b900897943f6e437

Download Submit
C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe

Filesize
39.0MB

MD5
c5eea4798d424e3f5dccf04bde9be82e

SHA1
575c10e8604b51591bc492a9f7c5999e2443dffc

SHA256
46c1ddad54a00ebf0a4e486499e73ff0496569c0168d6ff56d3671a08153b4e4

SHA512
e2512abe59cdb29501031619da35e68768d9f86a05141b19dfb22ccf3fcf038fd03b5fa8be042c09abbf4b312ab8d190a54f74a552602abbe0c55bd9d0798cfc

Download Submit
C:\Program Files (x86)\tsetup-x6\tsetup-x6\tsetup-x64.4.8.3.exe

Filesize
39.0MB

MD5
c5eea4798d424e3f5dccf04bde9be82e

SHA1
575c10e8604b51591bc492a9f7c5999e2443dffc

SHA256
46c1ddad54a00ebf0a4e486499e73ff0496569c0168d6ff56d3671a08153b4e4

SHA512
e2512abe59cdb29501031619da35e68768d9f86a05141b19dfb22ccf3fcf038fd03b5fa8be042c09abbf4b312ab8d190a54f74a552602abbe0c55bd9d0798cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI11A5.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI11E4.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8AEA.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8C82.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8CF0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8CF0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8DAC.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8F63.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8FE1.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GF8O6.tmp\tsetup-x64.4.8.3.tmp

Filesize
3.0MB

MD5
c6519ab04ac2122009b49bc5a5a286f5

SHA1
70bae0dd5d397ed8ec971e235bb1e2a8a73ab8da

SHA256
80de8002597dc3b197d28b39056b3aa815fcaad79b4333c537e0b6c77f1930f9

SHA512
f05db9a1af925ec869ee6b3dfa6aa6c024742711ffbd9710fcf8fd32d2ee7a617a34ce9e40636c0e9c7c5d9cdf951060e52d9319cab85059278cd5486277f18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GF8O6.tmp\tsetup-x64.4.8.3.tmp

Filesize
3.0MB

MD5
c6519ab04ac2122009b49bc5a5a286f5

SHA1
70bae0dd5d397ed8ec971e235bb1e2a8a73ab8da

SHA256
80de8002597dc3b197d28b39056b3aa815fcaad79b4333c537e0b6c77f1930f9

SHA512
f05db9a1af925ec869ee6b3dfa6aa6c024742711ffbd9710fcf8fd32d2ee7a617a34ce9e40636c0e9c7c5d9cdf951060e52d9319cab85059278cd5486277f18e

Download Submit
C:\Users\Admin\AppData\Roaming\B4GDW\LETsite_Cure.lnk

Filesize
1KB

MD5
eb7b60b148a98851c0586b27475bf746

SHA1
f6f8384c6cd2c9be4ab3fbd1be48fa87606255c4

SHA256
79140e9080b1a0edbe56ae099610f899c059bc7bb4f8286d2ad8b358e233b257

SHA512
dfcba874d0e6d3e6021dcefad643a03beb53ae32c5cbd86e205fff24cd327be32b146a00d7abe8e704b5f1fba74a31ff607041d013c67e2a1a748697d164fcfe

Download Submit
C:\Users\Admin\AppData\Roaming\B4GDW\RO7.zip

Filesize
1KB

MD5
77f968540bfc345837025b931c6bd1c3

SHA1
8333e2cf75b71c03504845a294a3588c9ed2d0ab

SHA256
8bbf017543a9021090fa91c6d2e9a02fdd0db01dcbbc1e24b81ab793bdc9cd6c

SHA512
cfe26769898306563b3e5a324484642aa04ec9669616933a983e54bb90f287f670392ca85570a23ead33124109d3e001ba7e195d352e3f3fcb00e10b2a094494

Download Submit
C:\Users\Admin\AppData\Roaming\B4GDW\i_Jz.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\AppData\Roaming\B4GDW\i_Jz.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\AppData\Roaming\B4GDW\i_Jz.exe

Filesize
123KB

MD5
d45ac76aff1438925578bbaeff0a07a9

SHA1
d2def1fdbe2e8fe91055ef8defdda431a01c80dc

SHA256
bf9eea98236e80d7726473a7cde8d9c780d5f055186934b5932c16390be711cb

SHA512
4fac746faadb83f5b96eda6e9f513b5c2f8f2c91e7d9f4666927222a9385f81a52bd52ae738644d944f7f7b9f4c30c35299593630a94807119f830db26992fb3

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe

Filesize
126.7MB

MD5
b207b753976baf91f4a1cfb6a195fd9d

SHA1
4c7a1cf450d6a96f6f9321a6407cd2d6dd50abb9

SHA256
96fbe1f018b68dc7be9b901eace3e9de00f8b6939af49153b8ebd88d868404d8

SHA512
5e8d9b3a4b78dbf495f14f0136cd891ee4f2fa6bcb4a051b73ba0f1acced17ac1abfceb94748cd10ba759c467be09b107ce1493679791715d05b65e13c5241f1

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll

Filesize
4.7MB

MD5
62a89e7867d853fee9ad07b7c9d64379

SHA1
944a53602492187308352103d80ff27af1093abf

SHA256
d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9

SHA512
7f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\settingss.XUSLLL

Filesize
1KB

MD5
847c84eea382952d36274b4800111808

SHA1
cc57295780a4efcd0acf1e7e38e577f399c17a4d

SHA256
4f873e004e656689602de927c4147522ccd24f66f2ebcd1fbfb05ecbd0048ad6

SHA512
3a7657818feebc7cbf04173c8ba07bed564799b6fb99dd0e51d973da48086ffc721b86a101c5e2aaecd8d68db5e84f5c02dab5d75af7f53cff7368b6cfad9ef9

Download Submit
C:\Users\Admin\Documents\999.exe

Filesize
792KB

MD5
cb072093838a0215803d0185df4a9af1

SHA1
4c345e5b50ce52abed5842e70f99e0032c87eaf5

SHA256
96d0806e438b5508a4bc0c85670325201e5e0abbf3b338d5ffbff601b05017af

SHA512
03ab19eba3febab68ce3636d6081016cd69e82b40277eea50a9aeb29a6c47033c245a471ef91500fdc09375a19b379dfe226bcc3585d40856684a5c23d626133

Download Submit
C:\Users\Admin\Documents\999.exe

Filesize
792KB

MD5
cb072093838a0215803d0185df4a9af1

SHA1
4c345e5b50ce52abed5842e70f99e0032c87eaf5

SHA256
96d0806e438b5508a4bc0c85670325201e5e0abbf3b338d5ffbff601b05017af

SHA512
03ab19eba3febab68ce3636d6081016cd69e82b40277eea50a9aeb29a6c47033c245a471ef91500fdc09375a19b379dfe226bcc3585d40856684a5c23d626133

Download Submit
C:\Users\Public\Music\4YEyoi\6QGAqa.lnk

Filesize
1006B

MD5
2764863a65c53ecdc04f81ae7921a494

SHA1
b31ec2d62ecbbe1164b6166aaf5fa7d519d9c9bf

SHA256
f784907807219f3e109f7763976e50c312421d019f3290f1833d0cc9717c4af4

SHA512
a365bf5476d938171cf847d05774ab7568fbd51b3aa9efa2cbf5d0759e94d777ca2d9bd90b3017c19e25fe8b4f04cb2abfd220ce2ff3c2e4955e018607d7fac0

Download Submit
C:\Users\Public\Music\4YEyoi\zfWPFz.url

Filesize
74B

MD5
37e6a7850e2bc6617072041cfc3ed6af

SHA1
da5dee917a146b7eabd9fd5bfc59c3d15d61cd48

SHA256
c7439c398beb1c9258454b26db402b91d6b7fe3d047b4438207a344e41bacdf5

SHA512
16a904e61d58d63d6b9311122d60ccf7e4c50177a125771e3ab3ef68333b56223b4a03263314876385d526ee9340cfbfefd83f062d9b70858d2123f6d530491f

Download Submit
C:\Users\Public\PL5O4O

Filesize
1.4MB

MD5
70a1467f0cf443eaf202708c1883469c

SHA1
e66f3a3201a1ca32b5d0e7e4aee63d9d56d17297

SHA256
e51892bef88e77d77cef2324c17266756e33a0ffa17bc171bc3683045bbbf6c8

SHA512
4149d412277a13161382d93e14a7ec568eead624addc3608ccfd9b299cf6a4c0a0d2f5a7f308b01a1981789a12507c22a71c605df823af80d05284addd24477f

Download Submit
C:\Users\Public\Videos\8RBRAU\PBVM125.dll

Filesize
2.6MB

MD5
6d63bd639adf4fb6d0f6ec3c1cf894bb

SHA1
59fb6d0dbbb435be22cf0e11af5fcff60e4ba7e5

SHA256
fb0e6c973a39328a9fbb15f79d64281559a673b0c7f60860990437457a8f8ec7

SHA512
4ab02b311f9fc8931c0555760fea8d55a82071d6f4005770e293bc6239acece1236abb51763d956b065c44628a6f184dc6f3a565b3c252bfc9d1805b60db7dc5

Download Submit
C:\Users\Public\Videos\8RBRAU\WG_G_F.exe

Filesize
188KB

MD5
d05c2a2f2a02419f1dbfcda9497e10ba

SHA1
3cfb4351767f5fd8c5bc078d037d0e0e5e7f2cb5

SHA256
d9914af5dfbc0813de5570a3d2fcb8fe848d232a71cdcd424672e9cc8406382b

SHA512
cd336acce69c0d878d2cf352adc5c2c242bdcd9ad2ceb5f917987f8e76421b38c691b9fcefc88962789f97d447cd8e6a2f3fe83f1440a998ed9876253040a2ca

Download Submit
C:\Users\Public\Videos\8RBRAU\WG_G_F.exe

Filesize
188KB

MD5
d05c2a2f2a02419f1dbfcda9497e10ba

SHA1
3cfb4351767f5fd8c5bc078d037d0e0e5e7f2cb5

SHA256
d9914af5dfbc0813de5570a3d2fcb8fe848d232a71cdcd424672e9cc8406382b

SHA512
cd336acce69c0d878d2cf352adc5c2c242bdcd9ad2ceb5f917987f8e76421b38c691b9fcefc88962789f97d447cd8e6a2f3fe83f1440a998ed9876253040a2ca

Download Submit
C:\Users\Public\Videos\8RBRAU\WG_G_F.exe

Filesize
188KB

MD5
d05c2a2f2a02419f1dbfcda9497e10ba

SHA1
3cfb4351767f5fd8c5bc078d037d0e0e5e7f2cb5

SHA256
d9914af5dfbc0813de5570a3d2fcb8fe848d232a71cdcd424672e9cc8406382b

SHA512
cd336acce69c0d878d2cf352adc5c2c242bdcd9ad2ceb5f917987f8e76421b38c691b9fcefc88962789f97d447cd8e6a2f3fe83f1440a998ed9876253040a2ca

Download Submit
C:\Users\Public\Videos\8RBRAU\info.txt

Filesize
761KB

MD5
a30b2ac506a66831f0c0ba66f3eccba3

SHA1
4531dac9c8100ff97b43388ad41cf8185966bb91

SHA256
fd1419f367e94409709e65801f2aaa9c93a3db43b0c3b92bbd113c82dada873c

SHA512
c6a57dc2a0428da358d7fc061b90494bd294766332d19e47b115db0c7731cbf2943a931a42c8d419275dd4a8fb61bd2315504c007ac1e8680c4c5ac43a913ab6

Download Submit
C:\Windows\Installer\MSIAC9.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
C:\Windows\Installer\MSIC12.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
25.0MB

MD5
b47fce41183d84475c179ecf11fed3ff

SHA1
81597e4d21455d151829501b768cad130c604fa2

SHA256
f60ecdbddb003343c9f2260bf7a41b6c1a15b64cde55d64a434f968d2251bb19

SHA512
dc7715e15453dfa53b9cbe5a2ed075a3997fcd201408c78bfae704c5c9cb1f0964f1924d4e359a615e717b325e2c5c7b3b84008fe551a2a4f094ed31db020f69

Download Submit
\??\Volume{9753329a-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6699e29a-ebe2-4d42-81c2-229d234a9b4d}_OnDiskSnapshotProp

Filesize
5KB

MD5
9c6442e1b23fc6d703de6ebdb67dd201

SHA1
b930cb0e9bafb551775d10f5472489e283672f8f

SHA256
4e3ccf211ba59b115848f9d394fce99effd8570449809589eab81bd613adbbd6

SHA512
77cf12e7421ee251f6823dd25c6d0074186241dca4405d7c774772cc4930d66666ce7d8b867303c5fcb353b3d2aab918f8a60abfa007b364852ea980af34e085

Download Submit
\Users\Admin\AppData\Local\Temp\MSI11A5.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI11E4.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8AEA.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8C82.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8CF0.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8DAC.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8F63.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Local\Temp\MSI8FE1.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll

Filesize
4.7MB

MD5
62a89e7867d853fee9ad07b7c9d64379

SHA1
944a53602492187308352103d80ff27af1093abf

SHA256
d412909f1b597045b856caecedfc677eb4708af00e5b70788a01fa6af49c09d9

SHA512
7f66bf278222bf1079a3695ad55086ccc7d8b05d7db4f9a5bcbfe4ac8d82bc1a618b1c6dc675da61d47f48fce2b0670ce6f66db63e79e232604304cfc629d6d0

Download Submit
\Users\Public\Videos\8RBRAU\pbvm125.dll

Filesize
2.6MB

MD5
6d63bd639adf4fb6d0f6ec3c1cf894bb

SHA1
59fb6d0dbbb435be22cf0e11af5fcff60e4ba7e5

SHA256
fb0e6c973a39328a9fbb15f79d64281559a673b0c7f60860990437457a8f8ec7

SHA512
4ab02b311f9fc8931c0555760fea8d55a82071d6f4005770e293bc6239acece1236abb51763d956b065c44628a6f184dc6f3a565b3c252bfc9d1805b60db7dc5

Download Submit
\Users\Public\Videos\8RBRAU\pbvm125.dll

Filesize
2.6MB

MD5
6d63bd639adf4fb6d0f6ec3c1cf894bb

SHA1
59fb6d0dbbb435be22cf0e11af5fcff60e4ba7e5

SHA256
fb0e6c973a39328a9fbb15f79d64281559a673b0c7f60860990437457a8f8ec7

SHA512
4ab02b311f9fc8931c0555760fea8d55a82071d6f4005770e293bc6239acece1236abb51763d956b065c44628a6f184dc6f3a565b3c252bfc9d1805b60db7dc5

Download Submit
\Windows\Installer\MSIAC9.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
\Windows\Installer\MSIC12.tmp

Filesize
557KB

MD5
e1423fc5ddaedc0152a09f4796243e31

SHA1
c92cec1fb6093d6922fe64719e583048fca12153

SHA256
3042d947f0e3accd3307d4d983aba352c4b01f6ca10aa45dbe660ca0a0a107de

SHA512
fc21fadb5b86dc0c4fc8fea5d166b9b8a500df2b662c201626a8bcf6d3f7bd590b8ec3bae31f2f558b74ccb49ca74f51ee48b19bd047a27ef0c794b21cc84b39

Download Submit
memory/1636-257-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1636-99-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1636-164-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1636-113-0x0000000000400000-0x000000000070F000-memory.dmp

Filesize
3.1MB

Download
memory/1636-88-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/1636-108-0x00000000009B0000-0x00000000009B1000-memory.dmp

Filesize
4KB

Download
memory/2156-74-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2156-98-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/2156-258-0x0000000000400000-0x00000000004D4000-memory.dmp

Filesize
848KB

Download
memory/3272-248-0x00000160F9340000-0x00000160F9350000-memory.dmp

Filesize
64KB

Download
memory/3272-314-0x00000160F9340000-0x00000160F9350000-memory.dmp

Filesize
64KB

Download
memory/3708-237-0x0000000000800000-0x0000000000B71000-memory.dmp

Filesize
3.4MB

Download
memory/3708-221-0x0000000000800000-0x0000000000B71000-memory.dmp

Filesize
3.4MB

Download
memory/3708-226-0x0000000002360000-0x00000000023A8000-memory.dmp

Filesize
288KB

Download
memory/3708-223-0x0000000000800000-0x0000000000B71000-memory.dmp

Filesize
3.4MB

Download
memory/4748-118-0x0000000010000000-0x0000000010046000-memory.dmp

Filesize
280KB

Download