b4b0da2cdb7ab81095f251f66e71421765a60d0255dc5087959218578d2ecd07

Resubmissions

24-09-2023 11:35

230924-nqd53afe82 7

24-09-2023 11:32

230924-nnfwwadh9s 7

Analysis

max time kernel
132s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
24-09-2023 11:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TelamonCleaner_id65101d86a479eog.exe
Size

2.4MB
MD5

aced6b3c9627848f1f20c76d205873a5
SHA1

4e9f8d334a645b5a68fb7c39203c82cf0341a2b6
SHA256

b4b0da2cdb7ab81095f251f66e71421765a60d0255dc5087959218578d2ecd07
SHA512

fff4ea2a7f6e926d543674481b798bac482d1f77a8fc23ade1405ea24b34ec7a0200eaa2b8e4389b91e87d2fa75c55c7f2f3a74ad06fc6ed18b12dc4709d721e
SSDEEP

49152:YBuZrEUDBJZDvXdwmfbFsWgOEPrSgmKvrjr:GkLD1/FsWgznxvrn

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3027552071-446050021-1254071215-1000\Control Panel\International\Geo\Nation	QtWebEngineProcess.exe

Executes dropped EXE 7 IoCs

pid	Process
2476	TelamonCleaner_id65101d86a479eog.tmp
3532	tt-installer-helper.exe
2612	tt-installer-helper.exe
1964	7za.exe
3636	tt-cleaner.exe
5008	tt-cleaner.exe
3732	QtWebEngineProcess.exe

Loads dropped DLL 58 IoCs

pid	Process
2476	TelamonCleaner_id65101d86a479eog.tmp
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
3636	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe
5008	tt-cleaner.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	tt-cleaner.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	tt-cleaner.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\msvcp140_1.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\Qt5PrintSupport.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\Qt5Qml.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\cache.653c3b8e.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\link.626d08ba.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\pause.e89bd789.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-handle-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-sysinfo-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\config\autorunConfig.xml	tt-cleaner.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\js\2.010f4851.chunk.js.map	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\js\main.e31c6497.chunk.js	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-crt-utility-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\check.cb5943eb.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\minus.db59129a.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\registry-active.6951662d.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\language\Spanish.lng	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\config	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\images\special_next_event_offer.png	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\license-activation.bbff544b.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-console-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-crt-runtime-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\updates.63740790.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\Qt5QmlModels.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\cache.170ed16b.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\alert.52af01f8.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\basket.e14fd4a6.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\info.f900f4bc.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\large-files-active.017fed25.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\launch-active.fa70a186.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-console-l1-2-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\translations\qtwebengine_locales	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\libcurl.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\language\Spanish.lng	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\alert.1191a968.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\error.309215c1.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\system-trash.a3d98939.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-libraryloader-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\resources\icudtl.dat	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-crt-process-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\QtWebEngineProcess.exe	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\js\main.e31c6497.chunk.js.map	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-crt-time-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\opengl32sw.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\basket_success.b509a21c.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\virus_error.28529d0d.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\virus_success.2d216ac1.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\language	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-crt-math-l1-1-0.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\basket.28ef3a64.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\basket.c292ac3b.svg	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\concrt140.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\cache.653c3b8e.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\Qt5Core.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\images\payment_offer.png	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\resources\qtwebengine_devtools_resources.pak	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\alert.5b6ae652.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-errorhandling-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-rtlsupport-l1-1-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\ui\static\media\menu-options.a8e3940f.svg	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-processthreads-l1-1-1.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\api-ms-win-core-synch-l1-2-0.dll	7za.exe
File created	C:\Program Files (x86)\Telamon Cleaner\D3Dcompiler_47.dll	7za.exe
File opened for modification	C:\Program Files (x86)\Telamon Cleaner\fonts\PROXIMANOVA-REGULAR.ttf	7za.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2996	2476	WerFault.exe	86

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
648	schtasks.exe
1940	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3027552071-446050021-1254071215-1000\{1ACECE58-2A98-4807-9A18-648D71FBBA36}	tt-cleaner.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5008	tt-cleaner.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2476	TelamonCleaner_id65101d86a479eog.tmp
2476	TelamonCleaner_id65101d86a479eog.tmp
3732	QtWebEngineProcess.exe
3732	QtWebEngineProcess.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1964	7za.exe
Token: 35	1964	7za.exe
Token: SeSecurityPrivilege	1964	7za.exe
Token: SeSecurityPrivilege	1964	7za.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
2476	TelamonCleaner_id65101d86a479eog.tmp
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5008	tt-cleaner.exe
5008	tt-cleaner.exe
5008	tt-cleaner.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 2476	4664	TelamonCleaner_id65101d86a479eog.exe	86
PID 4664 wrote to memory of 2476	4664	TelamonCleaner_id65101d86a479eog.exe	86
PID 4664 wrote to memory of 2476	4664	TelamonCleaner_id65101d86a479eog.exe	86
PID 2476 wrote to memory of 1968	2476	TelamonCleaner_id65101d86a479eog.tmp	87
PID 2476 wrote to memory of 1968	2476	TelamonCleaner_id65101d86a479eog.tmp	87
PID 2476 wrote to memory of 1968	2476	TelamonCleaner_id65101d86a479eog.tmp	87
PID 1968 wrote to memory of 3532	1968	cmd.exe	89
PID 1968 wrote to memory of 3532	1968	cmd.exe	89
PID 1968 wrote to memory of 3532	1968	cmd.exe	89
PID 2476 wrote to memory of 3188	2476	TelamonCleaner_id65101d86a479eog.tmp	90
PID 2476 wrote to memory of 3188	2476	TelamonCleaner_id65101d86a479eog.tmp	90
PID 2476 wrote to memory of 3188	2476	TelamonCleaner_id65101d86a479eog.tmp	90
PID 3188 wrote to memory of 2612	3188	cmd.exe	92
PID 3188 wrote to memory of 2612	3188	cmd.exe	92
PID 3188 wrote to memory of 2612	3188	cmd.exe	92
PID 2476 wrote to memory of 1964	2476	TelamonCleaner_id65101d86a479eog.tmp	105
PID 2476 wrote to memory of 1964	2476	TelamonCleaner_id65101d86a479eog.tmp	105
PID 2476 wrote to memory of 1964	2476	TelamonCleaner_id65101d86a479eog.tmp	105
PID 2476 wrote to memory of 3636	2476	TelamonCleaner_id65101d86a479eog.tmp	107
PID 2476 wrote to memory of 3636	2476	TelamonCleaner_id65101d86a479eog.tmp	107
PID 2476 wrote to memory of 3636	2476	TelamonCleaner_id65101d86a479eog.tmp	107
PID 3636 wrote to memory of 648	3636	tt-cleaner.exe	108
PID 3636 wrote to memory of 648	3636	tt-cleaner.exe	108
PID 3636 wrote to memory of 648	3636	tt-cleaner.exe	108
PID 3636 wrote to memory of 1940	3636	tt-cleaner.exe	110
PID 3636 wrote to memory of 1940	3636	tt-cleaner.exe	110
PID 3636 wrote to memory of 1940	3636	tt-cleaner.exe	110
PID 3636 wrote to memory of 5008	3636	tt-cleaner.exe	112
PID 3636 wrote to memory of 5008	3636	tt-cleaner.exe	112
PID 3636 wrote to memory of 5008	3636	tt-cleaner.exe	112
PID 5008 wrote to memory of 3732	5008	tt-cleaner.exe	116
PID 5008 wrote to memory of 3732	5008	tt-cleaner.exe	116
PID 5008 wrote to memory of 3732	5008	tt-cleaner.exe	116

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\TelamonCleaner_id65101d86a479eog.exe
"C:\Users\Admin\AppData\Local\Temp\TelamonCleaner_id65101d86a479eog.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\is-0KHVD.tmp\TelamonCleaner_id65101d86a479eog.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0KHVD.tmp\TelamonCleaner_id65101d86a479eog.tmp" /SL5="$701D8,1575658,918016,C:\Users\Admin\AppData\Local\Temp\TelamonCleaner_id65101d86a479eog.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe" --getuid > "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\~execwithresult.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe
      "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe" --getuid
      4⤵
      Executes dropped EXE
      PID:3532
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" "C:\Windows\system32\cmd.exe" /S /C ""C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\TelamonCleaner_id65101d86a479eog.exe > "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\~execwithresult.txt""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe
      "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe" --saveinstallpath --filename=C:\Users\Admin\AppData\Local\Temp\TelamonCleaner_id65101d86a479eog.exe
      4⤵
      Executes dropped EXE
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\7za.exe
    "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\7za.exe" x "C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-install.zip" -o"C:\Program Files (x86)\Telamon Cleaner\" * -r -aoa
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:1964
- - C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe
    "C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe" --install --l=t
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of WriteProcessMemory
    PID:3636
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /sc "onlogon" /tn "Telamon Cleaner" /tr "\"C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe\" --autorun" /rl "highest"
      4⤵
      Creates scheduled task(s)
      PID:648
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "Telamon Cleaner Autorun After Wake Up" /XML "C:\Program Files (x86)\Telamon Cleaner\config\autorunConfig.xml"
      4⤵
      Creates scheduled task(s)
      PID:1940
  - - C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe
      "C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Program Files (x86)\Telamon Cleaner\QtWebEngineProcess.exe
        
        "C:\Program Files (x86)\Telamon Cleaner\QtWebEngineProcess.exe" --type=renderer --no-sandbox --disable-gpu-memory-buffer-video-frames --enable-threaded-compositing --use-gl=angle --enable-features=AllowContentInitiatedDataUrlNavigations,TracingServiceInProcess --disable-features=BackgroundFetch,BlinkGenPropertyTrees,MojoVideoCapture,NetworkServiceNotSupported,OriginTrials,SmsReceiver,UsePdfCompositorServiceForPrint,UseSurfaceLayerForVideo,VizDisplayCompositor,WebAuthentication,WebAuthenticationCable,WebPayments,WebUSB --lang=en-US --webengine-schemes=qrc:sLV --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --service-request-channel-token=15522047877738680652 --renderer-client-id=3 --mojo-platform-channel-handle=2880 /prefetch:1
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3732
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2476 -s 1948
    3⤵
    - Program crash
    PID:2996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2476 -ip 2476
1⤵
PID:348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Telamon Cleaner\MSVCP140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Core.dll

Filesize
5.0MB

MD5
a8aadbf8569b2666ed428cac867ab3a8

SHA1
1bb02bd74b5389d81c55db271d3193ab53231a03

SHA256
cf8e93aaa512d06c33eeda299f9a9e2f03ce2579cc3019cc700c14dc712c044e

SHA512
75cf1b1257beebcaaf6e012ee79c1349bc7610fb309d07979f7d22744a14368f472db5230c18f64a2341fc8810b99417a547ae341ec39fdbcec62a7f2ec2cac0

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Core.dll

Filesize
5.0MB

MD5
a8aadbf8569b2666ed428cac867ab3a8

SHA1
1bb02bd74b5389d81c55db271d3193ab53231a03

SHA256
cf8e93aaa512d06c33eeda299f9a9e2f03ce2579cc3019cc700c14dc712c044e

SHA512
75cf1b1257beebcaaf6e012ee79c1349bc7610fb309d07979f7d22744a14368f472db5230c18f64a2341fc8810b99417a547ae341ec39fdbcec62a7f2ec2cac0

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Core.dll

Filesize
5.0MB

MD5
a8aadbf8569b2666ed428cac867ab3a8

SHA1
1bb02bd74b5389d81c55db271d3193ab53231a03

SHA256
cf8e93aaa512d06c33eeda299f9a9e2f03ce2579cc3019cc700c14dc712c044e

SHA512
75cf1b1257beebcaaf6e012ee79c1349bc7610fb309d07979f7d22744a14368f472db5230c18f64a2341fc8810b99417a547ae341ec39fdbcec62a7f2ec2cac0

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Gui.dll

Filesize
5.7MB

MD5
806e5fdf1b7f8bf1ff3b5b2932a9cc51

SHA1
97f72fb4962d8f4c34eee2f31c1d463dd8809a3b

SHA256
c4f002232626cb9acecd55eb83f4ffbe48a9143327ee6c80e98d3609454e2ac2

SHA512
3c7d81c87b3d2dc8765839fa3e537e87b4519ce1f303f5baed2f48e09273fb11d9b1ccc9c61613b560462de1702bcaf70157e3279bf1b9a07daca128138c8902

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Gui.dll

Filesize
5.7MB

MD5
806e5fdf1b7f8bf1ff3b5b2932a9cc51

SHA1
97f72fb4962d8f4c34eee2f31c1d463dd8809a3b

SHA256
c4f002232626cb9acecd55eb83f4ffbe48a9143327ee6c80e98d3609454e2ac2

SHA512
3c7d81c87b3d2dc8765839fa3e537e87b4519ce1f303f5baed2f48e09273fb11d9b1ccc9c61613b560462de1702bcaf70157e3279bf1b9a07daca128138c8902

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Gui.dll

Filesize
5.7MB

MD5
806e5fdf1b7f8bf1ff3b5b2932a9cc51

SHA1
97f72fb4962d8f4c34eee2f31c1d463dd8809a3b

SHA256
c4f002232626cb9acecd55eb83f4ffbe48a9143327ee6c80e98d3609454e2ac2

SHA512
3c7d81c87b3d2dc8765839fa3e537e87b4519ce1f303f5baed2f48e09273fb11d9b1ccc9c61613b560462de1702bcaf70157e3279bf1b9a07daca128138c8902

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Network.dll

Filesize
1.1MB

MD5
461ebc61de9df636ebedff159ee29a11

SHA1
d23a55c4497aa981f6e88a192776fa8651fc7189

SHA256
836ac6225b472b803c37ff2cee850be512007c0c4533fd01d4f3d68f901dc011

SHA512
3ed4f61fd0a05b7dc9b78b9e88f91c5cb4efd993f786f10e2c167a199802771d26e9a5cdd512520eb1924991628e4199a299d46418aadf8935a0062d75eb52e9

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Network.dll

Filesize
1.1MB

MD5
461ebc61de9df636ebedff159ee29a11

SHA1
d23a55c4497aa981f6e88a192776fa8651fc7189

SHA256
836ac6225b472b803c37ff2cee850be512007c0c4533fd01d4f3d68f901dc011

SHA512
3ed4f61fd0a05b7dc9b78b9e88f91c5cb4efd993f786f10e2c167a199802771d26e9a5cdd512520eb1924991628e4199a299d46418aadf8935a0062d75eb52e9

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Positioning.dll

Filesize
264KB

MD5
fb7361707f2a4bf54dec582fb1ea91c7

SHA1
4f592c71c076cdfedbf4ace30a34a82c858c3011

SHA256
13f5f4810e697198b044f83164d9859cd6493138e569dfe7710b64cb38f9c572

SHA512
72e59c9876cb555a6c13bc81eca424b5ee350a26e734a069563940b93d1d2c8c9c6fc70ca839f719c1825386fd4074544173d2f6dd83eb3868a8f40bcffdc772

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Positioning.dll

Filesize
264KB

MD5
fb7361707f2a4bf54dec582fb1ea91c7

SHA1
4f592c71c076cdfedbf4ace30a34a82c858c3011

SHA256
13f5f4810e697198b044f83164d9859cd6493138e569dfe7710b64cb38f9c572

SHA512
72e59c9876cb555a6c13bc81eca424b5ee350a26e734a069563940b93d1d2c8c9c6fc70ca839f719c1825386fd4074544173d2f6dd83eb3868a8f40bcffdc772

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5PrintSupport.dll

Filesize
267KB

MD5
3ca8d13593039367ab8b3b2f65d73c85

SHA1
9ec8edb23c334b308b41347bfb1f496b08a66b6d

SHA256
b4b097fdc36b39e5461133a25eedbb4070dee28c809f1e671aaa77f0eb0bd951

SHA512
563ae51a5040623a60a5aa2db72361583858bbfbf7098d654ec39b0d5421f74f6bd8ef047ca893811d20e313c0cbb5081143bab2b4c58cea29886b249f429118

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5PrintSupport.dll

Filesize
267KB

MD5
3ca8d13593039367ab8b3b2f65d73c85

SHA1
9ec8edb23c334b308b41347bfb1f496b08a66b6d

SHA256
b4b097fdc36b39e5461133a25eedbb4070dee28c809f1e671aaa77f0eb0bd951

SHA512
563ae51a5040623a60a5aa2db72361583858bbfbf7098d654ec39b0d5421f74f6bd8ef047ca893811d20e313c0cbb5081143bab2b4c58cea29886b249f429118

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Qml.dll

Filesize
3.0MB

MD5
6e5907142c07044dcf0a8768e119729d

SHA1
1db673acee16a92327f2d70c1f16cd79db714d8f

SHA256
4833bce18ad0dc5f2f287c52afdb8d5e821a59e9a43e1cf1f521ae7e910aab56

SHA512
3576a471d2fb81fe096db86555434cca0d86afa8a8bb7551ae96011e2e2a7d105d819f11a1d2c7eb5feeae61b15ebd2ac6f354e7a6cf31e1b1dd3c4485d67872

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Qml.dll

Filesize
3.0MB

MD5
6e5907142c07044dcf0a8768e119729d

SHA1
1db673acee16a92327f2d70c1f16cd79db714d8f

SHA256
4833bce18ad0dc5f2f287c52afdb8d5e821a59e9a43e1cf1f521ae7e910aab56

SHA512
3576a471d2fb81fe096db86555434cca0d86afa8a8bb7551ae96011e2e2a7d105d819f11a1d2c7eb5feeae61b15ebd2ac6f354e7a6cf31e1b1dd3c4485d67872

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5QmlModels.dll

Filesize
409KB

MD5
25f45cb9dceda77d1ba7195231e3d26b

SHA1
f20ca5c5cfd14ac89d12c5a742c6ad22062ee012

SHA256
db769c3b34bf9775543d939e574d920237d1ebd00f9e1cbd909affda2b46c252

SHA512
13be1a19e6fcf614441bf21ffa1891d61b6bb8a7a1f7b9cc321ce0b5dc35e7cbd4dfdf10741f5b13b8f571f164c3b5b1a205e92572f592b57ba6d24cc6ddfc9b

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5QmlModels.dll

Filesize
409KB

MD5
25f45cb9dceda77d1ba7195231e3d26b

SHA1
f20ca5c5cfd14ac89d12c5a742c6ad22062ee012

SHA256
db769c3b34bf9775543d939e574d920237d1ebd00f9e1cbd909affda2b46c252

SHA512
13be1a19e6fcf614441bf21ffa1891d61b6bb8a7a1f7b9cc321ce0b5dc35e7cbd4dfdf10741f5b13b8f571f164c3b5b1a205e92572f592b57ba6d24cc6ddfc9b

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Quick.dll

Filesize
3.5MB

MD5
7326e1eedbc7578fe74281dafe854a99

SHA1
b5a907f2dd8d637e31794a16c9451a933343fff2

SHA256
ceee311e5bce28242cc604158576d503a2d577479ac7aa89c2ca3c8af6bc6f63

SHA512
2f0cc9b22bd4d8afab11f9c84fc55be3b89db49969bc4476a900697472084e8cd17e820fe9bbfeeea270e2995fc46f10ac9f380bc97907f8a72f908803532aa1

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Quick.dll

Filesize
3.5MB

MD5
7326e1eedbc7578fe74281dafe854a99

SHA1
b5a907f2dd8d637e31794a16c9451a933343fff2

SHA256
ceee311e5bce28242cc604158576d503a2d577479ac7aa89c2ca3c8af6bc6f63

SHA512
2f0cc9b22bd4d8afab11f9c84fc55be3b89db49969bc4476a900697472084e8cd17e820fe9bbfeeea270e2995fc46f10ac9f380bc97907f8a72f908803532aa1

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5QuickWidgets.dll

Filesize
64KB

MD5
f13ad9472f4e5fb5519c49057ee68342

SHA1
a391917f3af1762cf6953e7d39346eb423ede575

SHA256
9bea8e64280c8ce7452cd0e70720230ee1a84db9e839e09f7097a34467c199b0

SHA512
45f63baad32f285a2a83ac1b345ea6ca1f6dd6941f87d7ddb0199fd52397c02e9eae4e30a260e37248cb5009a0e6832996466734f407cc1683f445f17fb740b3

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5QuickWidgets.dll

Filesize
64KB

MD5
f13ad9472f4e5fb5519c49057ee68342

SHA1
a391917f3af1762cf6953e7d39346eb423ede575

SHA256
9bea8e64280c8ce7452cd0e70720230ee1a84db9e839e09f7097a34467c199b0

SHA512
45f63baad32f285a2a83ac1b345ea6ca1f6dd6941f87d7ddb0199fd52397c02e9eae4e30a260e37248cb5009a0e6832996466734f407cc1683f445f17fb740b3

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebChannel.dll

Filesize
104KB

MD5
d8eb1fede1aa1f08d6946c17de7d3c48

SHA1
3998d1e4c4ff740109a0d870a09ff84a2d69c9de

SHA256
bcdf9970c9de4417991d69356a3259ceb7fdd03eba26ebf40d6c90fdd9eeac8f

SHA512
ee1cb44986a4aa0192dfd99c986f349f277e5ad116c68d96a48eeb1b00b01a50797299fb0deb43e87cbdf01fd6aa72c0f1196df9ef06e05466da50ea8224d37b

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebChannel.dll

Filesize
104KB

MD5
d8eb1fede1aa1f08d6946c17de7d3c48

SHA1
3998d1e4c4ff740109a0d870a09ff84a2d69c9de

SHA256
bcdf9970c9de4417991d69356a3259ceb7fdd03eba26ebf40d6c90fdd9eeac8f

SHA512
ee1cb44986a4aa0192dfd99c986f349f277e5ad116c68d96a48eeb1b00b01a50797299fb0deb43e87cbdf01fd6aa72c0f1196df9ef06e05466da50ea8224d37b

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebChannel.dll

Filesize
104KB

MD5
d8eb1fede1aa1f08d6946c17de7d3c48

SHA1
3998d1e4c4ff740109a0d870a09ff84a2d69c9de

SHA256
bcdf9970c9de4417991d69356a3259ceb7fdd03eba26ebf40d6c90fdd9eeac8f

SHA512
ee1cb44986a4aa0192dfd99c986f349f277e5ad116c68d96a48eeb1b00b01a50797299fb0deb43e87cbdf01fd6aa72c0f1196df9ef06e05466da50ea8224d37b

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineCore.dll

Filesize
66.0MB

MD5
199a79657be76e7ed7667cfd800e0bdd

SHA1
25132c23927aa25e34f5cc59fc8a05a8e18bd1fb

SHA256
0fc298ddaf1ef6875eb043fd2456f682431d2188f360014a5bdee6739b7343ca

SHA512
a5171ed74010403800cbf7fc03b68d1836de10684188b002d9955adf3d151ecb85d9fbc719a844430fe13d91012dade5bc65f8d6077cdadcf447ecf625ff2495

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineCore.dll

Filesize
66.0MB

MD5
199a79657be76e7ed7667cfd800e0bdd

SHA1
25132c23927aa25e34f5cc59fc8a05a8e18bd1fb

SHA256
0fc298ddaf1ef6875eb043fd2456f682431d2188f360014a5bdee6739b7343ca

SHA512
a5171ed74010403800cbf7fc03b68d1836de10684188b002d9955adf3d151ecb85d9fbc719a844430fe13d91012dade5bc65f8d6077cdadcf447ecf625ff2495

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineCore.dll

Filesize
66.0MB

MD5
199a79657be76e7ed7667cfd800e0bdd

SHA1
25132c23927aa25e34f5cc59fc8a05a8e18bd1fb

SHA256
0fc298ddaf1ef6875eb043fd2456f682431d2188f360014a5bdee6739b7343ca

SHA512
a5171ed74010403800cbf7fc03b68d1836de10684188b002d9955adf3d151ecb85d9fbc719a844430fe13d91012dade5bc65f8d6077cdadcf447ecf625ff2495

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineWidgets.dll

Filesize
204KB

MD5
a215940ce5c2b159c95315e08e718467

SHA1
d45d867afe80e1b6919dafc477436ec3547bc34a

SHA256
02a7982ed67b43b258b34b3ed181da4e07947c23f2f336eb3d1b30c7f1c2d219

SHA512
c82095aca5360491c6ff9b12f4b0b75f6e44db7fe2acd48c816f294bbbab7d1ce525c189d296e896631027bf94e97c00f897a1a2d3d7045106261e0586dcec4e

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineWidgets.dll

Filesize
204KB

MD5
a215940ce5c2b159c95315e08e718467

SHA1
d45d867afe80e1b6919dafc477436ec3547bc34a

SHA256
02a7982ed67b43b258b34b3ed181da4e07947c23f2f336eb3d1b30c7f1c2d219

SHA512
c82095aca5360491c6ff9b12f4b0b75f6e44db7fe2acd48c816f294bbbab7d1ce525c189d296e896631027bf94e97c00f897a1a2d3d7045106261e0586dcec4e

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WebEngineWidgets.dll

Filesize
204KB

MD5
a215940ce5c2b159c95315e08e718467

SHA1
d45d867afe80e1b6919dafc477436ec3547bc34a

SHA256
02a7982ed67b43b258b34b3ed181da4e07947c23f2f336eb3d1b30c7f1c2d219

SHA512
c82095aca5360491c6ff9b12f4b0b75f6e44db7fe2acd48c816f294bbbab7d1ce525c189d296e896631027bf94e97c00f897a1a2d3d7045106261e0586dcec4e

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5Widgets.dll

Filesize
4.4MB

MD5
e0be43fee11c1a9ba5c1f28b2b3dc875

SHA1
2fbfd08c39fbefa4c855f1fd6f8c75748796a9cf

SHA256
a8a34fa960cd1dfb3500b5d2b486d9ad60125e2b78fa7dbb08141f3861092330

SHA512
3a150ab899569afb4c7cd29c269ff03f966217f459a03bbc4e626ca2ae772398eacf053f21dbafc74a5c48426f9bc6f4782ae039c894484f98cf786cfd3498ee

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WinExtras.dll

Filesize
440KB

MD5
05116916bf374eb876bbc1cb1eb36eaa

SHA1
dca6d33eb8886c12a09157531b9b138d644afbc0

SHA256
29ac8950ee5b77f411360ecab4e4cac8b27c722b27cf1520fc2d942bf5dd2f9c

SHA512
087a072faac64ad0967a1a5d1fe49fae3165910328b6ff5a44f38e5970b9c15a2e357be03ec159206cd73928568e3b4b230e2808995f5ebc593ccf559cddd526

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WinExtras.dll

Filesize
440KB

MD5
05116916bf374eb876bbc1cb1eb36eaa

SHA1
dca6d33eb8886c12a09157531b9b138d644afbc0

SHA256
29ac8950ee5b77f411360ecab4e4cac8b27c722b27cf1520fc2d942bf5dd2f9c

SHA512
087a072faac64ad0967a1a5d1fe49fae3165910328b6ff5a44f38e5970b9c15a2e357be03ec159206cd73928568e3b4b230e2808995f5ebc593ccf559cddd526

Download Submit
C:\Program Files (x86)\Telamon Cleaner\Qt5WinExtras.dll

Filesize
440KB

MD5
05116916bf374eb876bbc1cb1eb36eaa

SHA1
dca6d33eb8886c12a09157531b9b138d644afbc0

SHA256
29ac8950ee5b77f411360ecab4e4cac8b27c722b27cf1520fc2d942bf5dd2f9c

SHA512
087a072faac64ad0967a1a5d1fe49fae3165910328b6ff5a44f38e5970b9c15a2e357be03ec159206cd73928568e3b4b230e2808995f5ebc593ccf559cddd526

Download Submit
C:\Program Files (x86)\Telamon Cleaner\VCRUNTIME140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Program Files (x86)\Telamon Cleaner\config\autorunConfig.xml

Filesize
3KB

MD5
5e0448c43fd855cf4ad0ccfc04b77442

SHA1
ee918515ca9b8030e372000c5c7b7f4866fccdfb

SHA256
b315ac33908b2db0fae4d5fb29247942cda974016f05765406e63c34476678a6

SHA512
a7e8aaf0cb76d2ed99de4bf47b99fc237352554c90abfc699371ca1046905c91f3acc9a311b4604a29cc6eb716284be96c37988781d231b9e196c0e64cc8724a

Download Submit
C:\Program Files (x86)\Telamon Cleaner\config\autorunConfig.xml

Filesize
3KB

MD5
7cb88d3d43729feb43d157378dd599ad

SHA1
9ec198a301c8d525eeea22072bc19e3fd644b9a1

SHA256
e2a065010539526115892ca4277c34d502498356273aca086a0a97139375bedc

SHA512
a3c5068522c7e6245d3220b8f788c1b0dafc79f0dd037ea434e1b06275032a4726e179267dd5106d4c6f4562f185588d25748ab5275612ed9317564e5c292d51

Download Submit
C:\Program Files (x86)\Telamon Cleaner\libcurl.dll

Filesize
272KB

MD5
b2233cefad05c0e103903d375bf4051d

SHA1
bf7ce266ba1b2c46e297933ff70e8f67e4d4aab5

SHA256
f18ae7bc8509d6a13231c36167fc905a40e866f5ce43aeb21a5e6db5536e8284

SHA512
c1fa1d2de28ce4748c7e9b358fd51593985cda46418ad85c964e954e31632b3bba431a7bd6b98cdd8cb37a56ace2445e8b3b92e82f360f100ff71e03d8a6d70d

Download Submit
C:\Program Files (x86)\Telamon Cleaner\libcurl.dll

Filesize
272KB

MD5
b2233cefad05c0e103903d375bf4051d

SHA1
bf7ce266ba1b2c46e297933ff70e8f67e4d4aab5

SHA256
f18ae7bc8509d6a13231c36167fc905a40e866f5ce43aeb21a5e6db5536e8284

SHA512
c1fa1d2de28ce4748c7e9b358fd51593985cda46418ad85c964e954e31632b3bba431a7bd6b98cdd8cb37a56ace2445e8b3b92e82f360f100ff71e03d8a6d70d

Download Submit
C:\Program Files (x86)\Telamon Cleaner\libcurl.dll

Filesize
272KB

MD5
b2233cefad05c0e103903d375bf4051d

SHA1
bf7ce266ba1b2c46e297933ff70e8f67e4d4aab5

SHA256
f18ae7bc8509d6a13231c36167fc905a40e866f5ce43aeb21a5e6db5536e8284

SHA512
c1fa1d2de28ce4748c7e9b358fd51593985cda46418ad85c964e954e31632b3bba431a7bd6b98cdd8cb37a56ace2445e8b3b92e82f360f100ff71e03d8a6d70d

Download Submit
C:\Program Files (x86)\Telamon Cleaner\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Program Files (x86)\Telamon Cleaner\msvcp140.dll

Filesize
439KB

MD5
5ff1fca37c466d6723ec67be93b51442

SHA1
34cc4e158092083b13d67d6d2bc9e57b798a303b

SHA256
5136a49a682ac8d7f1ce71b211de8688fce42ed57210af087a8e2dbc8a934062

SHA512
4802ef62630c521d83a1d333969593fb00c9b38f82b4d07f70fbd21f495fea9b3f67676064573d2c71c42bc6f701992989742213501b16087bb6110e337c7546

Download Submit
C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe

Filesize
4.2MB

MD5
dc78e45182188abc85b2ac6acf566f8c

SHA1
2e1a182d3bb6d8e514893865146549d62f1bf59e

SHA256
3fa2780f05049b2fbdfe3eb115a1bbd09d9efcdecd19840c0fe091c9b0681d09

SHA512
56110931a27016ee9990f61e4c35d1da2974e24532c7b436f847a4c122875574f50c0ce5f4b95acd184717a2017e57715951ee577c604906cebb64ed3eb42f80

Download Submit
C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe

Filesize
4.2MB

MD5
dc78e45182188abc85b2ac6acf566f8c

SHA1
2e1a182d3bb6d8e514893865146549d62f1bf59e

SHA256
3fa2780f05049b2fbdfe3eb115a1bbd09d9efcdecd19840c0fe091c9b0681d09

SHA512
56110931a27016ee9990f61e4c35d1da2974e24532c7b436f847a4c122875574f50c0ce5f4b95acd184717a2017e57715951ee577c604906cebb64ed3eb42f80

Download Submit
C:\Program Files (x86)\Telamon Cleaner\tt-cleaner.exe

Filesize
4.2MB

MD5
dc78e45182188abc85b2ac6acf566f8c

SHA1
2e1a182d3bb6d8e514893865146549d62f1bf59e

SHA256
3fa2780f05049b2fbdfe3eb115a1bbd09d9efcdecd19840c0fe091c9b0681d09

SHA512
56110931a27016ee9990f61e4c35d1da2974e24532c7b436f847a4c122875574f50c0ce5f4b95acd184717a2017e57715951ee577c604906cebb64ed3eb42f80

Download Submit
C:\Program Files (x86)\Telamon Cleaner\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Program Files (x86)\Telamon Cleaner\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Program Files (x86)\Telamon Cleaner\vcruntime140.dll

Filesize
78KB

MD5
a37ee36b536409056a86f50e67777dd7

SHA1
1cafa159292aa736fc595fc04e16325b27cd6750

SHA256
8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

SHA512
3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

Download Submit
C:\Program Files (x86)\Telamon Cleaner\zlib1.dll

Filesize
71KB

MD5
5f76c6adb059326861912520f4c775ca

SHA1
88486f746af48a854245ddd165ebf7b030a0ebf1

SHA256
d985e63ddc5a5c2b1ccdf10d395a8e3e13b3cead5f0cbe688248fafb6b3560a6

SHA512
c263ce22d4922da58a400690090685d4c83fcafa82dd721002474165dd670d7f0e8febdb25e9c6b31ddab3e6915c7e2d6c10d26eee56705473e39ad2c47aa37e

Download Submit
C:\Program Files (x86)\Telamon Cleaner\zlib1.dll

Filesize
71KB

MD5
5f76c6adb059326861912520f4c775ca

SHA1
88486f746af48a854245ddd165ebf7b030a0ebf1

SHA256
d985e63ddc5a5c2b1ccdf10d395a8e3e13b3cead5f0cbe688248fafb6b3560a6

SHA512
c263ce22d4922da58a400690090685d4c83fcafa82dd721002474165dd670d7f0e8febdb25e9c6b31ddab3e6915c7e2d6c10d26eee56705473e39ad2c47aa37e

Download Submit
C:\Program Files (x86)\Telamon Cleaner\zlib1.dll

Filesize
71KB

MD5
5f76c6adb059326861912520f4c775ca

SHA1
88486f746af48a854245ddd165ebf7b030a0ebf1

SHA256
d985e63ddc5a5c2b1ccdf10d395a8e3e13b3cead5f0cbe688248fafb6b3560a6

SHA512
c263ce22d4922da58a400690090685d4c83fcafa82dd721002474165dd670d7f0e8febdb25e9c6b31ddab3e6915c7e2d6c10d26eee56705473e39ad2c47aa37e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0KHVD.tmp\TelamonCleaner_id65101d86a479eog.tmp

Filesize
3.1MB

MD5
fc1d3c0460f3bd018216180cff8a04df

SHA1
440088b9fee86f832c58c487409b4140f4b87935

SHA256
093dd2ca93731a7c4b2bd777a0a0064c0d6e95eafbd1ec5b6143a3f932a0cb82

SHA512
79a4a0b5ed166d353682cc55fa597013234dea019230eccd0f7e04a5bd43d6fc02ae69d3e882ebd122055487c21fb1a4b74c31c64c94b2cdc62a1e2ae7a5837a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\7za.exe

Filesize
773KB

MD5
dfd1cf824c781069def1d239a626d43e

SHA1
bbe24cbae89166de829a7cf91eebfb518d8f45be

SHA256
31fd52f8996986623cf52c3b4d0f7ac74a9dec63fc16c902cef673eed550c435

SHA512
0413adecc5560ddb18133eec70b3a717d82738f304bdbe6eb6e2dad9ada57314c60bbd48ac0aa948af77ae76f7d522ada4f6089fffab88f882872c56bd12ca20

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\idp.dll

Filesize
232KB

MD5
55c310c0319260d798757557ab3bf636

SHA1
0892eb7ed31d8bb20a56c6835990749011a2d8de

SHA256
54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed

SHA512
e0082109737097658677d7963cbf28d412dca3fa8f5812c2567e53849336ce45ebae2c0430df74bfe16c0f3eebb46961bc1a10f32ca7947692a900162128ae57

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-install.zip

Filesize
68.3MB

MD5
14997d6cec67b1867295c9cdb3af1c61

SHA1
ef2b68bafb51ca5e18ef33f8d2caa4a14bc0508e

SHA256
d40afd8c043123fce3f6f9b626c1680ff4a573d23da796b04ab0bee79d6784ec

SHA512
a93a01c490b959455322d554a7f5aedd2a9ee5b512d57465d45b402d6028c443f1c71a6a5179ad89fc34466ccd5a8e9e8d051eac2255b14846209483fd2841f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe

Filesize
595KB

MD5
8c584765972d14ef167f71a701159359

SHA1
c857e7af03f31d24dd8c38e16ba46bbd0f3377fd

SHA256
30c27e256b84348e2b97d5b65a85139af9dfff00713e4d55b103f411a51a62d1

SHA512
988b524f81aceb05786cf96cc84b804f5a9c0ab9d9100f2c822ec9e8fa8eb385ccedf1bedab57ba8b031b79e26c96ae3c7b00d623b4918db40c274f66104f48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe

Filesize
595KB

MD5
8c584765972d14ef167f71a701159359

SHA1
c857e7af03f31d24dd8c38e16ba46bbd0f3377fd

SHA256
30c27e256b84348e2b97d5b65a85139af9dfff00713e4d55b103f411a51a62d1

SHA512
988b524f81aceb05786cf96cc84b804f5a9c0ab9d9100f2c822ec9e8fa8eb385ccedf1bedab57ba8b031b79e26c96ae3c7b00d623b4918db40c274f66104f48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\tt-installer-helper.exe

Filesize
595KB

MD5
8c584765972d14ef167f71a701159359

SHA1
c857e7af03f31d24dd8c38e16ba46bbd0f3377fd

SHA256
30c27e256b84348e2b97d5b65a85139af9dfff00713e4d55b103f411a51a62d1

SHA512
988b524f81aceb05786cf96cc84b804f5a9c0ab9d9100f2c822ec9e8fa8eb385ccedf1bedab57ba8b031b79e26c96ae3c7b00d623b4918db40c274f66104f48c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-UF0GJ.tmp\~execwithresult.txt

Filesize
77B

MD5
070a128aa60b765073d2dd4c5b4f9ca0

SHA1
a9bbb065722881319aed636cb08d99c2d7c0e788

SHA256
f82c59385c1a936a9a67b745b59549581f91c6acdc625b798f689e253ab3cc5c

SHA512
ce7e1596152b88c48bffb6f7cd3f1f504ee7c126c7eeeba0b9aa8d4e9a951081dfe35c646ea63f04ffc55a5b37074b2fac555c8fcd454d8a82105b5e6c50ca29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telamon Cleaner\Telamon Cleaner Uninstall.lnk

Filesize
2KB

MD5
114662158e65415561e54ebc2531584b

SHA1
bd958fc1b4acc0d790f738c70a07ac3a5d215ba4

SHA256
616a3ce73753d0bde7199dfabd4d504436a10a2ae5396c79445fb2518027ab9b

SHA512
2243d4856b7beedd3cfd8e13123aa32c9d8815e65a1b7a99b17f94ad771f4f6e5900444bd31c34f17429c9a7c9099fd082c0ade5bc689becd9014d9424171de8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telamon Cleaner\Telamon Cleaner.lnk

Filesize
2KB

MD5
99f97dd21cab2dc7f153493f4e2e6107

SHA1
01c75a5fd2689221e3ce0b73532c1100c79c4fb1

SHA256
3b8f081caa434065ee0282e8ee1aa38e92da87177cbda813a8915ab213636a4c

SHA512
e29e093cc4569ce7a964bc0a939bb84caf75a0dbe59ad03fdb2af855c436ce1cf2f26e1c0fecb13a805b6a9d29b13a5a05f41cfa44b302e641561423f1a0e9a6

Download Submit
memory/2476-26-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/2476-6-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/2476-498-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/2476-30-0x0000000000D40000-0x0000000000D41000-memory.dmp

Filesize
4KB

Download
memory/2476-120-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/2476-538-0x0000000000400000-0x0000000000729000-memory.dmp

Filesize
3.2MB

Download
memory/4664-19-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4664-1-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/4664-541-0x0000000000400000-0x00000000004ED000-memory.dmp

Filesize
948KB

Download
memory/5008-542-0x0000000003EF0000-0x0000000003F00000-memory.dmp

Filesize
64KB

Download
memory/5008-564-0x0000000003EF0000-0x0000000003F00000-memory.dmp

Filesize
64KB

Download