036f8862a3e49aa4b006b877ec3e9a2dfed733dc53a85c338eb67dc808fe125d

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230831-en
resource tags

arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2023, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

seup-X64.8.9.9.msi
Size

83.1MB
MD5

c2dd7e10d429371ffce8dd064f23d271
SHA1

282ce2612f5eeae11c94b4820eb7a327d25cfcea
SHA256

036f8862a3e49aa4b006b877ec3e9a2dfed733dc53a85c338eb67dc808fe125d
SHA512

94b2e667414ad99cba62dcec3efafb611f140cb05ba546a513dbe187d053184fe57b15acddb7a494f0c278408ecf9e0a584d483bb1e7830578aa9fdcc46b465d
SSDEEP

1572864:UCKa/mZuqQjEedibBIqmDt//cCLu0PQh2IA9Vh/RCribIHVueiNaIn+u:UCKZuqQAedibnYS0m2IWRCIw1In

Score

10^/10

evasion trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Executes dropped EXE 5 IoCs

pid	Process
3068	dach.exe
1276	Telegram.exe
3820	Telegram.exe
3076	Telegram.exe
1528	Telegram.exe

Loads dropped DLL 8 IoCs

pid	Process
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
4612	MsiExec.exe
1120	MsiExec.exe
1120	MsiExec.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3068-82-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-84-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-85-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-86-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-87-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-99-0x0000000180000000-0x0000000180033000-memory.dmp	upx
behavioral2/memory/3068-117-0x0000000180000000-0x0000000180033000-memory.dmp	upx

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3FE2BD01AB6BC312BF0DADE7F797388F_F7F9B7BDCC367A8E3539D28F7D4D4BA2	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_F0BB2463DDCCB4B49DC9200CC9E498E9	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dach.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7229E30BCFD0992128433D951137A421_76EBFC12D6FD7EE9DD82775C12CF3BD5	dach.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_2	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\log.txt	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.mhyxyQ	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.pTrNDt	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\opengl_crash_check	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.XZTxRI	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tupdates\temp\Telegram.exe	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_3	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.hxfWuf	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_22_1	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\log_start2.txt	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.iXFYgT	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tupdates\temp\ready	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_4	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_9	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\log_start0.txt	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8Cs.kwThoV	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8Cs.yHdzBz	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_1	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.QaiDBc	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.XZTxRI	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.yenBIQ	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8Cs.yHdzBz	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.ZcgyQl	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_21_3	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\usertag	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\shortcuts-custom.json	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.PmrvqO	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8C\configs.GthGZA	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.RZCMDw	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tupdates\temp\modules\x64\d3d\d3dcompiler_47.dll	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_5	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_6	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\working	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.fsHpFF	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.QaiDBc	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8Cs.ixBNhW	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_3	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\Telegram.exe	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_7	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_21_1	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8C\configs.oOvcUd	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_0	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_8	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_8	msiexec.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_21_2	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\log_start0.txt	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\log_start1.txt	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\shortcuts-default.json	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_2	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\key_datas.stkxyh	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.ZcgyQl	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.zElqIo	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.jygiDV	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8C\configs.DpKVfd	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.RZCMDw	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_6	msiexec.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\settings0	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.pTrNDt	Telegram.exe
File opened for modification	C:\Program Files\HIP-THH\HIP-THH\tdata\13A63D2E145B5F4As.iXFYgT	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\settingss.jygiDV	Telegram.exe
File created	C:\Program Files\HIP-THH\HIP-THH\tdata\D877F783D5D3EF8Cs.ixBNhW	Telegram.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{64C771E6-49B2-43AB-9C7C-204A7AEEFF42}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2BDF.tmp	msiexec.exe
File created	C:\Windows\Installer\e582596.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e582594.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2650.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e582594.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI27B8.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b2ddea05c89702680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b2ddea050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b2ddea05000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db2ddea05000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b2ddea0500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	explorer.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideIcons = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowStatusBar = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc\Recent File List	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ExplorerStartupTraceRecorded = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	dach.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden = "2"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Settings	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\AutoCheckSelect = "0"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dach.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\RenderSoft TextCalc\TextCalc\Settings	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\MapNetDrvBtn = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowCompColor = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\S-1-5-18_Classes\Local Settings	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SeparateProcess = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowTypeOverlay = "1"	explorer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowInfoTip = "1"	explorer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState = 240000003428000000000000000000000000000001000000130000000000000062000000	explorer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	dach.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Filter = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\DontPrettyPath = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\WebView = "1"	explorer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\IconsOnly = "0"	explorer.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Microsoft Management Console\Recent File List	mmc.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	dach.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@mmcbase.dll,-14008 = "Folder"	mmc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	mmc.exe

Modifies registry class 55 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\shell	Telegram.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\ProductName = "HIP-THH"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\shell\open	Telegram.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0B06FDC9804AA44B87795745B93C68C	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "4"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Documents"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E177C462B94BA34C9C702A4A7EEFF24\MainFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Version = "16777216"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\Language = "2052"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\PackageName = "seup-X64.8.9.9.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\shell\open\command\ = "\"C:\\Program Files\\HIP-THH\\HIP-THH\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Program Files\\HIP-THH\\HIP-THH\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tg\DefaultIcon\ = "\"C:\\Program Files\\HIP-THH\\HIP-THH\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\B0B06FDC9804AA44B87795745B93C68C\6E177C462B94BA34C9C702A4A7EEFF24	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\PackageCode = "A648E06E50BD8334A970F1B06FE2B7FF"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Program Files\\HIP-THH\\HIP-THH\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\6E177C462B94BA34C9C702A4A7EEFF24\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2474409663-2236862430-1045297337-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe

Suspicious behavior: AddClipboardFormatListener 5 IoCs

pid	Process
4240	explorer.exe
1276	Telegram.exe
3076	Telegram.exe
3820	Telegram.exe
1528	Telegram.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	msiexec.exe
4684	msiexec.exe

Suspicious behavior: SetClipboardViewer 2 IoCs

pid	Process
3220	mmc.exe
3092	mmc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	4684	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeMachineAccountPrivilege	2636	msiexec.exe
Token: SeTcbPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeLoadDriverPrivilege	2636	msiexec.exe
Token: SeSystemProfilePrivilege	2636	msiexec.exe
Token: SeSystemtimePrivilege	2636	msiexec.exe
Token: SeProfSingleProcessPrivilege	2636	msiexec.exe
Token: SeIncBasePriorityPrivilege	2636	msiexec.exe
Token: SeCreatePagefilePrivilege	2636	msiexec.exe
Token: SeCreatePermanentPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeDebugPrivilege	2636	msiexec.exe
Token: SeAuditPrivilege	2636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2636	msiexec.exe
Token: SeChangeNotifyPrivilege	2636	msiexec.exe
Token: SeRemoteShutdownPrivilege	2636	msiexec.exe
Token: SeUndockPrivilege	2636	msiexec.exe
Token: SeSyncAgentPrivilege	2636	msiexec.exe
Token: SeEnableDelegationPrivilege	2636	msiexec.exe
Token: SeManageVolumePrivilege	2636	msiexec.exe
Token: SeImpersonatePrivilege	2636	msiexec.exe
Token: SeCreateGlobalPrivilege	2636	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2636	msiexec.exe
Token: SeMachineAccountPrivilege	2636	msiexec.exe
Token: SeTcbPrivilege	2636	msiexec.exe
Token: SeSecurityPrivilege	2636	msiexec.exe
Token: SeTakeOwnershipPrivilege	2636	msiexec.exe
Token: SeLoadDriverPrivilege	2636	msiexec.exe
Token: SeSystemProfilePrivilege	2636	msiexec.exe
Token: SeSystemtimePrivilege	2636	msiexec.exe
Token: SeProfSingleProcessPrivilege	2636	msiexec.exe
Token: SeIncBasePriorityPrivilege	2636	msiexec.exe
Token: SeCreatePagefilePrivilege	2636	msiexec.exe
Token: SeCreatePermanentPrivilege	2636	msiexec.exe
Token: SeBackupPrivilege	2636	msiexec.exe
Token: SeRestorePrivilege	2636	msiexec.exe
Token: SeShutdownPrivilege	2636	msiexec.exe
Token: SeDebugPrivilege	2636	msiexec.exe
Token: SeAuditPrivilege	2636	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2636	msiexec.exe
Token: SeChangeNotifyPrivilege	2636	msiexec.exe
Token: SeRemoteShutdownPrivilege	2636	msiexec.exe
Token: SeUndockPrivilege	2636	msiexec.exe
Token: SeSyncAgentPrivilege	2636	msiexec.exe
Token: SeEnableDelegationPrivilege	2636	msiexec.exe
Token: SeManageVolumePrivilege	2636	msiexec.exe
Token: SeImpersonatePrivilege	2636	msiexec.exe
Token: SeCreateGlobalPrivilege	2636	msiexec.exe
Token: SeCreateTokenPrivilege	2636	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2636	msiexec.exe
Token: SeLockMemoryPrivilege	2636	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2636	msiexec.exe
2636	msiexec.exe
2636	msiexec.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe
1276	Telegram.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
3068	dach.exe
3068	dach.exe
232	mmc.exe
232	mmc.exe
3220	mmc.exe
3220	mmc.exe
3092	mmc.exe
3092	mmc.exe
4240	explorer.exe
4240	explorer.exe
1276	Telegram.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 4612	4684	msiexec.exe	85
PID 4684 wrote to memory of 4612	4684	msiexec.exe	85
PID 4684 wrote to memory of 4612	4684	msiexec.exe	85
PID 4684 wrote to memory of 1612	4684	msiexec.exe	93
PID 4684 wrote to memory of 1612	4684	msiexec.exe	93
PID 4684 wrote to memory of 1120	4684	msiexec.exe	95
PID 4684 wrote to memory of 1120	4684	msiexec.exe	95
PID 4684 wrote to memory of 1120	4684	msiexec.exe	95
PID 4684 wrote to memory of 3068	4684	msiexec.exe	97
PID 4684 wrote to memory of 3068	4684	msiexec.exe	97
PID 232 wrote to memory of 3876	232	mmc.exe	100
PID 232 wrote to memory of 3876	232	mmc.exe	100
PID 3220 wrote to memory of 3896	3220	mmc.exe	103
PID 3220 wrote to memory of 3896	3220	mmc.exe	103
PID 3068 wrote to memory of 4896	3068	dach.exe	106
PID 3068 wrote to memory of 4896	3068	dach.exe	106
PID 4896 wrote to memory of 4024	4896	cmd.exe	108
PID 4896 wrote to memory of 4024	4896	cmd.exe	108
PID 4896 wrote to memory of 2064	4896	cmd.exe	109
PID 4896 wrote to memory of 2064	4896	cmd.exe	109
PID 4896 wrote to memory of 3208	4896	cmd.exe	110
PID 4896 wrote to memory of 3208	4896	cmd.exe	110
PID 3068 wrote to memory of 2660	3068	dach.exe	111
PID 3068 wrote to memory of 2660	3068	dach.exe	111
PID 3092 wrote to memory of 3308	3092	mmc.exe	114
PID 3092 wrote to memory of 3308	3092	mmc.exe	114

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\seup-X64.8.9.9.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4F8EF7AA8E06CD33323147F7E1BEFBC0 C
  2⤵
  - Loads dropped DLL
  PID:4612
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1612
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EE14A076FC524F191830E8A5F70CD937
  2⤵
  - Loads dropped DLL
  PID:1120
- C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\dach.exe
  "C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\dach.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\6Tc9m.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4896
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:4024
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:2064
  - - C:\Windows\system32\reg.exe
      reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
      4⤵
      UAC bypass
      PID:3208
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c copy /b C:\Users\Public\Pictures\0ud62\GH51y_i\n + C:\Users\Public\Pictures\0ud62\GH51y_i\m C:\Users\Public\Pictures\0ud62\GH51y_i\XunYouwpcap.dll
    3⤵
    PID:2660

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1100

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:232
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ip set address 以太网 static 1.0.0.2 255.255.255.0 1.0.0.1 1
  2⤵
  PID:3876

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" interface ip set address \"WLAN\" static 1.0.0.3 255.255.255.0 1.0.0.1 1
  2⤵
  PID:3896

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1956

C:\Windows\system32\mmc.exe
C:\Windows\system32\mmc.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: SetClipboardViewer
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" /root, C:\Users\Public\Pictures\0ud62\GH51y_i\XunYouConsoleGate.exe
  2⤵
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:3308

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:4240

C:\Program Files\HIP-THH\HIP-THH\Telegram.exe
"C:\Program Files\HIP-THH\HIP-THH\Telegram.exe"
1⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1276

C:\Program Files\HIP-THH\HIP-THH\Telegram.exe
"C:\Program Files\HIP-THH\HIP-THH\Telegram.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
PID:3076

C:\Program Files\HIP-THH\HIP-THH\Telegram.exe
"C:\Program Files\HIP-THH\HIP-THH\Telegram.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
PID:3820

C:\Program Files\HIP-THH\HIP-THH\Telegram.exe
"C:\Program Files\HIP-THH\HIP-THH\Telegram.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: AddClipboardFormatListener
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e582595.rbs

Filesize
10KB

MD5
9f00f07a104b64efa2c8745f16aaa978

SHA1
40a304ba180c149c77e4f837cd61600a2938396a

SHA256
c3094e9d6ef9ae0b2339f983f6525b52e5f21b85aadb16caeee0df25d773f8e0

SHA512
7a159d9bc1de37b7236b287c0f249f598ed7e60035c12b52b3d6a37a2c34c9dbf01af339ed4e15bd32cd5a43b3442b70ae966bd7e197b26ecda0b45d3ed8cbbf

Download Submit
C:\Program Files\HIP-THH\HIP-THH\Telegram.exe

Filesize
124.3MB

MD5
46ea08d10bc31be1c0902f41dc9f96d8

SHA1
fed9ca3f23cc84584ddc9d867de6bd4af5b3fe6a

SHA256
2744db76444a0597d3e0af348025b4ba35accdd2c5f1152e8785a441f87008ba

SHA512
cd55d10e3a2769d5ee017a4fe14bb08c5775f554504fbb82941739fadb6c7b624c9ca57d38e4d96751d48d2842c777acddc9faada3c21c3e8605b2c35d3362c7

Download Submit
C:\Program Files\HIP-THH\HIP-THH\Telegram.exe

Filesize
124.3MB

MD5
46ea08d10bc31be1c0902f41dc9f96d8

SHA1
fed9ca3f23cc84584ddc9d867de6bd4af5b3fe6a

SHA256
2744db76444a0597d3e0af348025b4ba35accdd2c5f1152e8785a441f87008ba

SHA512
cd55d10e3a2769d5ee017a4fe14bb08c5775f554504fbb82941739fadb6c7b624c9ca57d38e4d96751d48d2842c777acddc9faada3c21c3e8605b2c35d3362c7

Download Submit
C:\Program Files\HIP-THH\HIP-THH\Telegram.exe

Filesize
124.3MB

MD5
46ea08d10bc31be1c0902f41dc9f96d8

SHA1
fed9ca3f23cc84584ddc9d867de6bd4af5b3fe6a

SHA256
2744db76444a0597d3e0af348025b4ba35accdd2c5f1152e8785a441f87008ba

SHA512
cd55d10e3a2769d5ee017a4fe14bb08c5775f554504fbb82941739fadb6c7b624c9ca57d38e4d96751d48d2842c777acddc9faada3c21c3e8605b2c35d3362c7

Download Submit
C:\Program Files\HIP-THH\HIP-THH\Telegram.exe

Filesize
124.3MB

MD5
46ea08d10bc31be1c0902f41dc9f96d8

SHA1
fed9ca3f23cc84584ddc9d867de6bd4af5b3fe6a

SHA256
2744db76444a0597d3e0af348025b4ba35accdd2c5f1152e8785a441f87008ba

SHA512
cd55d10e3a2769d5ee017a4fe14bb08c5775f554504fbb82941739fadb6c7b624c9ca57d38e4d96751d48d2842c777acddc9faada3c21c3e8605b2c35d3362c7

Download Submit
C:\Program Files\HIP-THH\HIP-THH\Telegram.exe

Filesize
124.3MB

MD5
46ea08d10bc31be1c0902f41dc9f96d8

SHA1
fed9ca3f23cc84584ddc9d867de6bd4af5b3fe6a

SHA256
2744db76444a0597d3e0af348025b4ba35accdd2c5f1152e8785a441f87008ba

SHA512
cd55d10e3a2769d5ee017a4fe14bb08c5775f554504fbb82941739fadb6c7b624c9ca57d38e4d96751d48d2842c777acddc9faada3c21c3e8605b2c35d3362c7

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_0

Filesize
648KB

MD5
a9d5fcb4edadcf53399f1c5f9ae5d9ae

SHA1
210377216a6869a40655c75f47a392b4600f6f44

SHA256
a917a5dcf7e329dfb760ece674de96a01ab5e2f51751de95d032c4bb5e2a1f0e

SHA512
7a47a64e1dacc0b3c621b13d9d0cc60bf98d58d2a93add9beb87ce476cce296029f028feea1970bfacbbbaae6b143e24f8245ac32bfdf6cee65089b568bf6ec4

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_1

Filesize
648KB

MD5
28c7a651b3411fff0be43767457541f3

SHA1
64cc0c0474f72deb03459a47e91e6f1b5cc5a867

SHA256
0f1d63de6e20766acc95159db99724d5babbabbb9adb1506dc1337163ec61338

SHA512
bc3a5492c72293bf0dcfa1883e586e17dd16afce06817d466c6672e9ac6c04a1c74bddaedd0753b1ddfff20bd88ab36d055643369416725be95bfb7a72f37070

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_2

Filesize
648KB

MD5
8bae1c34285e15fae092ef5afb4bdb9a

SHA1
ce7098ffafa1a0150de43e390f4489bd0a35bfd1

SHA256
48d4c29de7c7e13c65856da6963a20f41f9001dab80bb72b68d61cab7fee1d33

SHA512
927581328052659a0e65df5499b5e16624145ff61512255c64770194384d7ea5b469c3b1301e63146de7b5fc01bf6acf6e81e567806cdfed3a4b306b98e18ca4

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_3

Filesize
648KB

MD5
28dc94bc2f0fd3ce3a70f5207ec35bde

SHA1
96cd2a1b1237270b857b72ac0b4f90c7111d0099

SHA256
0b2cb32c6eda76598f5ef427a7ef9309bf3d6c2cb206ca1e37f164636ff25bc3

SHA512
8eea266f16f517bbb2908738c5d027375b3452bae4032f187094e56c6830c05487acfb781182e02aa9dbdcb9c0e8d58fb28b5d7f9aca9ed7000488cbe0029fe0

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_4

Filesize
648KB

MD5
fa7909ed2d3e1d9a593ab5fa0d66958b

SHA1
8b1baf1bbf8ecb8d34fd155746f84e6887665dc6

SHA256
8935d03aa7c5c253c92ebf8fac42aaac5f0aa04b531ad3196954e45ee2b3a389

SHA512
d43a6b169a6e2c60e63e71e3aefd05f8e8c4b691672536943ed81dc342eff372aab51e8b25e6e17d4dabe9166f3520850bef8cc03604d003c0ec01b382691748

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_5

Filesize
648KB

MD5
7076344b06be17207948f79de741e3e7

SHA1
338e2311f944087807be80dd2fb2e8584e9bdd65

SHA256
43c24b430152745f6fb61fd27d2598489e21d60ae2f0e0c89bb264f484afe899

SHA512
9a518ad991a3263117c122b7cff14e6191ee91a40c5daa75e77fd854edbe7dac2c46a4a80fe0d91d5fda1ebf9d4ef0091b3d543c8abb52900584e0f0bdabc9dd

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_18_6

Filesize
648KB

MD5
677eaf4328bfa07263b0518d7a538c68

SHA1
2daabe657291c7088e45d09125c10247f52b81e6

SHA256
9522b74b926f4c3989e962f815ff7f1cb93e26f68522457e4f2e3dede4a64aeb

SHA512
87b5eb241f7f854ffc2b49d83b3c40be73693dd1a6c900d2d07c047f8e689d9fc44d6198a168372a4df53532d910d045c4141b321a5f2b33e36081399362fa4b

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_0

Filesize
1.1MB

MD5
e0d699a63ecfb007d72bf4a158a1dea6

SHA1
15bae81866f8dc89d256bf6aa6fe29e6ae1099f2

SHA256
89e572bbce672b25b93c9f95b4ae3e1295da308f79c7ed0342ad40e184b5a6e4

SHA512
a397a0a64c5fe734e98ef911d929897f0fa6b4d272956d0c5eca170a7e226783b52f4eb7871bd73bbf6517a98c6ba5e93608b1f8d807b320ab97e8555719ae94

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_1

Filesize
1.1MB

MD5
bb05e538eb0fd043124c1dbd7a54f6a0

SHA1
c44c550a754d87880e3413cfa0cb3bcbe7523edb

SHA256
0255d50c8fc8f036794a3cebdf2937a94821c6cf07caee1be90cf11fbf4f4c47

SHA512
ff6a9b0862307ebe85d72a62eefc09054290995c373f3c5b248bb6f04a6246d68160f6227873bc11649b894cd011f263c0d258796dffa09afb31412d78a8be69

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_2

Filesize
1.1MB

MD5
92cf692ec1350a03271cf7241d696852

SHA1
7af420c4564b67485bb6ea043a242f366fedef12

SHA256
ebd8b64b606c941b14c0b2a20d308672ecb0bae4e7bab5bf3180c820276f1355

SHA512
f3955b98ecef489e35274f7eef8d37c0650c078e651ac167c3ced8b0109536e0b3479cbe65d5c4b71aba0b0a8cccd531e6448740f638729159c70455d104a851

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_3

Filesize
1.1MB

MD5
cf672c2191ad9aabd4c380a95bf426e0

SHA1
e0c8d175e98483242f61efcb9885a8369051a9e8

SHA256
88e08b41b3470b4c1438f95d8e72164c5d8d9471f956d4545489e4f3ebd683d2

SHA512
ec68dd9a0d7292d9a570500d3e119db2056869814f0195f2d0b69d043a50a6031a0b122c016229a92015d2b3f34cba8f9939888fb469f1f73592f004d59af351

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_4

Filesize
1.1MB

MD5
eeea43d3974ad7c693bc76ecd2f687da

SHA1
939720d7aaf86ca815d75f08bea4cdb5d588f4bd

SHA256
64caf40aea1b4605b064f7aea7bce2eb745ec6ff1bea5621fc8d0e401e804f4f

SHA512
15a2396e3b06253add6b9e117540e65a63a1acc6c48b6a52c1f9b8929aacba3addb8e11bb879b3b7d8a75278c626886877cbe0ae4ae0ba498e1b4c2c76ba4618

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_5

Filesize
1.1MB

MD5
30692e87e6b0f97e6277ede297df9e84

SHA1
9184fe68950608bf81e706bb93f8f5b6dec26030

SHA256
b9e6942fcb22fd19400980b3fe0ce66cb1b90cae0f0a3d9e263f84265c6cb371

SHA512
07c7bd39596ca10ad8e3496eed24ed6b843a1dad3ef758c0a2a12993207b281e218f88dd71a8b73e7b78fd1c0c0686864a8cb79f5f1181e5bab41d5edf927b59

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\cache_24_6

Filesize
1.1MB

MD5
45da064a83b06d0619b45025a0607c79

SHA1
3cd0336619073a14ef2daef249a600ca1784af54

SHA256
9247ad81f3ce766c45a6393fc0aec29b60f351e629f6a19f7fc040241a34b07f

SHA512
0626c8625cbe2ea74d96e615db5b96eb72859e2b3eb26df6f381bb25f81ac5b1379ed690475b45eeef283c22ecb0ad95cfe39c0bc631676c669def06df523a0f

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\dach.exe

Filesize
23.5MB

MD5
06f1f365c9381955dd39c5aea4a0962c

SHA1
7210eb3781d901e218b64129bed3c731e3c8e15b

SHA256
c77a24edb501b037d2efe36e1e72599673adcde77e9ff4c93caaa052896bd3fe

SHA512
f7b4cfd279ca695c5c1843d862607d44a228816460b4c55a16a38463d77f3d7eabd55e9e1dd434d2ef2d6fb461d7d26cc3afcd5f4c22a75230fbbb60e6703708

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\emoji\dach.exe

Filesize
23.5MB

MD5
06f1f365c9381955dd39c5aea4a0962c

SHA1
7210eb3781d901e218b64129bed3c731e3c8e15b

SHA256
c77a24edb501b037d2efe36e1e72599673adcde77e9ff4c93caaa052896bd3fe

SHA512
f7b4cfd279ca695c5c1843d862607d44a228816460b4c55a16a38463d77f3d7eabd55e9e1dd434d2ef2d6fb461d7d26cc3afcd5f4c22a75230fbbb60e6703708

Download Submit
C:\Program Files\HIP-THH\HIP-THH\tdata\usertag

Filesize
8B

MD5
2ae8a930cc4ed6621303b0b92e3090f6

SHA1
994c8600ca345a1be877f8d95821a21ef566499a

SHA256
1e40a5cf20d861e468995a883b6cf37f44d00a4f5b4786ced35450930cc9d09e

SHA512
88c38865d925a6dcb76dce23f4241c89f27e5a061cbe710590905fca0551c5fff1f15f8dc4b0bc9fe83a24485afcdd1252966ff2d8a5c4e7779e2321e262aed0

Download Submit
C:\Users\Admin\AppData\Local\Temp\9d95d1ee20a52d85a4cbef184eef2e78-{87A94AB0-E370-4cde-98D3-ACC110C5967D}

Filesize
61B

MD5
1e6d97cdadfd46e17ad164c7dfa08088

SHA1
f7cc069faf03a88c64ce1daba87de5fae2ad1dfc

SHA256
aea0241c4be75760a32e908b30ffb486f55df40551d64358d3e0fe569f379924

SHA512
1ca871d2cb07afb1fcbde6acd490a3e27e824b883158e80e73ec4684088fd09d62d96303a034fa10a70f16efb4d81b472b222e9f11db37d40ee720f9f4a60120

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8A1F.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI8A1F.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI91E1.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI91E1.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI92BC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI92BC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI92BC.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI931B.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI931B.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI93A9.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI93A9.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9550.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSI9550.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Users\Admin\AppData\Roaming\6Tc9m.bat

Filesize
392B

MD5
30d6eb22d6aeec10347239b17b023bf4

SHA1
e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

SHA256
659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

SHA512
500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

Download Submit
C:\Users\Public\Pictures\0ud62\GH51y_i\m

Filesize
100KB

MD5
9d5e0bf0051b01d0da01b6fd8b842377

SHA1
f02e09f5755a453d5e4b0aacfc776ccb9046a346

SHA256
81cd87ad1eba86833c0a9ddbf2c2b415a9ad480d1214ed6fa95fbde20c929707

SHA512
b5b41a5ab4ebbdd10085100d2511aee364cde2d43b10eca0895ceaab943cb9e0ba563ed976c057cc7cabf82af55cf2442fdc9fa00c8c7bccff053f38f92839cf

Download Submit
C:\Users\Public\Pictures\0ud62\GH51y_i\n

Filesize
100KB

MD5
e5288e073f3152d92c4b1a48fa5b60e2

SHA1
212b4a783aea1576bdf749e6073d345228771bd4

SHA256
0090b02ba8d40df543f236e6b1ff7d206a5b1fcfc1535ddcf5bf8225bfb19625

SHA512
b768d32663d0c19e6ee74fdf4a7007edbb5af27249dfbd33cc00b2c3e0136f40ed2bf86001e8e37cce45d6fde8c3c9dc1c5d20ec334a967b93fe033e4acdb37a

Download Submit
C:\Windows\Installer\MSI2650.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI2650.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI27B8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\MSI27B8.tmp

Filesize
540KB

MD5
dfc682d9f93d6dcd39524f1afcd0e00d

SHA1
adb81b1077d14dbe76d9ececfc3e027303075705

SHA256
f0f00100e20741444f8a6f5db8cc826515134622c3a82e4f53ba6237e97a8328

SHA512
52f84956b480bd06914a3615b75ad198a3ce821b0dd88dd30443bf4ea3d406349c95a115c31cb879775bd716563473909d22a8ec34253eca1aa7009845430bc9

Download Submit
C:\Windows\Installer\e582594.msi

Filesize
83.1MB

MD5
c2dd7e10d429371ffce8dd064f23d271

SHA1
282ce2612f5eeae11c94b4820eb7a327d25cfcea

SHA256
036f8862a3e49aa4b006b877ec3e9a2dfed733dc53a85c338eb67dc808fe125d

SHA512
94b2e667414ad99cba62dcec3efafb611f140cb05ba546a513dbe187d053184fe57b15acddb7a494f0c278408ecf9e0a584d483bb1e7830578aa9fdcc46b465d

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.0MB

MD5
e7f050546cfee02b13772e6209f0194d

SHA1
8dac445f6ed5fcc1a1197976e83cf7729a8986ea

SHA256
127200903e0f3fe884bfbe288b06c8199227b5a6bad1808c43926cae2fd137a8

SHA512
05a74ab7c92bc031687d19607fc15f768850df8d52fc974297d71d407ead872331644585401e454bd53db1f0cb272199ab6b651f66c852317ffeb22ff56f8fbc

Download Submit
\??\Volume{05eaddb2-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{cdc435bf-6dd6-4bd0-8adb-a9255242cdc2}_OnDiskSnapshotProp

Filesize
5KB

MD5
df87c18da707c5d995724e75653843ba

SHA1
9ed698cefd20868deb4c952572fa7edcb7c5e14f

SHA256
5d358c0bdd571b3dde628e50a47d0ff06b3540485371c93a32c9693addf81e8f

SHA512
e37fe2081f4f6505e35fcb26aefd9fd2ceea40394ee73b5eab4b3fee7ea0d99ef31a5d21f21b1f67d12007125d24ebdaf6f5dcc02ecfa1cf558acc0fc3fa9b14

Download Submit
memory/1276-197-0x0000026FCEB90000-0x0000026FCEBA0000-memory.dmp

Filesize
64KB

Download
memory/1276-131-0x0000026FCEB90000-0x0000026FCEBA0000-memory.dmp

Filesize
64KB

Download
memory/1528-146-0x000001ED4A830000-0x000001ED4A840000-memory.dmp

Filesize
64KB

Download
memory/1528-201-0x000001ED4A830000-0x000001ED4A840000-memory.dmp

Filesize
64KB

Download
memory/3068-117-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-87-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-86-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-85-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-84-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-82-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3068-99-0x0000000180000000-0x0000000180033000-memory.dmp

Filesize
204KB

Download
memory/3076-196-0x000001EA25A00000-0x000001EA25A10000-memory.dmp

Filesize
64KB

Download
memory/3076-144-0x000001EA25A00000-0x000001EA25A10000-memory.dmp

Filesize
64KB

Download
memory/3820-202-0x00000273A2F20000-0x00000273A2F30000-memory.dmp

Filesize
64KB

Download
memory/3820-142-0x00000273A2F20000-0x00000273A2F30000-memory.dmp

Filesize
64KB

Download