Setup[.]exe | Triage™

resource
Setup.exe
unpack001/$TEMP/data/file1_parts/vMeZ429PmCUI.part
unpack001/$TEMP/data/file2_parts/aQLz7LlC4ujL.part

Setup.exe

IMPHASH 573bb7b41bc641bd95c0f5eec13c233b
SHA256 8c65239167f3ec609a5a992ed143b68b3c1b3a5985cf8a6d3f528081de15d0ee
MD5 7e29dd50712b2f02b0464b835e6f30af
SHA1 4a997e8b82985ca758503c6ac6825c77b9fd394b
SHA512 3c59106561167810cf88bf30b4bc4249853f948033b3837ada8150cd695cfbae8d8dda2184c91b11100dfe68288f1c33aa0f513e96291e265122ef3350acbc68
SSDEEP 98304:a+h77Dw34jm8qq2VsIWvhL1fdf8nWSD5CzbNzhLnfdVvgj:a4T3j48h5fgW0KVhYj
TLSH
T1A51633171202BCF1F2FA633251A825457CE4AE675275EFB9C508435FB9A33E81A6C723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

13709

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW WriteFile ExitProcess GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject CopyFileW

$TEMP/Setup.vbs

SHA256 53b88103c0cb16ea2393b91dfcfc1eb73f411b66d0d966c43bacc85386429bb5
MD5 25646a3a8ab2874778c2fb1320bee5a6
SHA1 a1267a7f64ce2df44c43b24739b696e4b1b457fa
SHA512 a9034afabba6cbccb11e5d7eac63d3c2d9294fa323e079b0aa8dfcdd0bc226f713db0c3b9e5108a7d5fb008b441db5ce985970bd25794ad0842ed865e0625db2
SSDEEP 6144:/mWIHTu6oUIKqdN4Arf8rqfJz0G7MLQDi:5kTcUI88phXbO
TLSH
T1DE1406FC5CAB3157B4789043E0BF60747D6ECC5BA7841190BCB9D362615A09EA2C29EF
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/.runner.ps1

SHA256 12979b0e9cb1019bae8a0b40aebbebf4e8a0464a93ee157c6c8e87d03e3c4d5d
MD5 e375cde3d84e71b590b1580362755022
SHA1 c0e0b17e9def5230347ff4ee3b55d3107972349e
SHA512 1c5089e4785529b1eb40f5fcc981f86ddf7d6b1284eaf4cc4a057842a428b438e1c48c49097b4feba8d0ab453d25f0296f63a80cbff7df413f091b2275e2086d
SSDEEP 6144:Ttoxk7H1nz0nJ3IhIgVFpq95qbAyrwFEoKrhJp8Rn:TtpVz0nJ3IhIg5YELoKrhgn
TLSH
T16864072033CFD8D2DBF11958C577E870EE69F77121A9DC88B99DB30BD60484623A64DA
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_info.json

SHA256 2ffd41e2c5b8f6aec0d13dd0f161e0904b0dcab635829de3ba8e7394c489d118
MD5 05a4f693dbfc650fec5f2261bea88862
SHA1 bb8bd966897cbd6c212719237ac31015542a8bd5
SHA512 20b23183569d4481224fabed55ada84a8f55aae0f15729b6215daaa28a8034e1efbd279f9fd6d1f9b539e9f68bed1e8c0c20c4289bfbba2f7cd6bc97bbc0a547
TLSH
T1CE21260EC399DC122679A7A219691F02F281E31B1152DF5337FE2ACC4FB2D210191AF9
MD5 SHA1 SHA512 TLSH

$TEMP/data/file1_parts/9TXEMqbnluzw.part

SHA256 5456fb74cd3f9c55393ba8590b1ecffda9127537e5c254e62e0ffd17082d8811
MD5 7ef774efd2095bbd12a19bd947c18721
SHA1 3d1064bce33610e74892d377e597e0af54e1ebd5
SHA512 eaf364c3296e8e20715b296ee238812531f78672ee4f746f0d371db1b9da46b97d246d866969f11088a1335b1882f4e272303e56887af47246dc1bf79b971155
SSDEEP 24576:5HkgIvkk9M7TmSiP4pLlzf7BgjgTdxKDb:ZIvFimSu4p5rCgxxKf
TLSH
T14A25297E164153ECD9CD966DA9AF21A9B150326C83346FFBB1D00F700A369903BB91DB
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/A22mX6i2QQiZ.part

SHA256 7a0b4235bfb2a035dd0047204cfb13e5dea9510010a91a57f429617c1a108f31
MD5 cca60a9c668a2a2681719f597eece869
SHA1 6226c61abea8f84c3a35bb2117c43776d02f4f85
SHA512 bb051b55c06d494f701b190a53afb1c48b6fc402fb7162cb40ff301f1911d4e0009f95be40a0cca155ad436ad71a005717f1089a17699738ac93af67e33b06ec
SSDEEP 768:YKM2YXPelyMXM6is7PFpPFWN9GgdbBJPfzejFIrRNHvDUoYiWT7ezUDELiJktOTr:9U6is73YfGgdBJHze+1Z0DELik+Ma
TLSH
T11F548EB367900088C9F600B7A07AD52A6D7F63B473941A35C498A16D8C7CAFD75FB386
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/Kxnm0tCGjfpS.part

SHA256 b5955947a015a39c38fc3550c7df3fe4c0b75db82655cdae0a3e26817c5b1819
MD5 44a4055836004ce7a322baeb6f9fc9a7
SHA1 bb44095882216ebfb3bd23776b9cac5d1a692ec0
SHA512 f7bbfd8adb4fdb6a88e904b39c9615385fec63ea3dd18737e5c24ff0c9505290a21a730c8fe6715ea199b04ded68913f409f4f94c6d41c9090a5f67f4fbbbc47
SSDEEP 6144:5WbCUwMWKBQyY/k0GFB45Pl+lucx0tZBCAUyNrJ6RQ9X/prh2RAnw/p:5UbwMzY/K45tsX0t5pJ6RQt/eunw/p
TLSH
T139E4B52E241403DCDC2DCA1E94DF21EAA4A4363C55386F3FF1805E225EF69987F95A87
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/PZNk3GFdnv5e.part

SHA256 14e658dec8cc89a74bfdc08dfc887845e22828db949624b8b1c4d739cc55fa33
MD5 a7b5fdb32019fe64080e28eded4bf582
SHA1 85f813a5167ec416e6dd729feec80a0c6a0aa317
SHA512 ea11eb8658ccb933b4322e43da66d5a864f25619ea94fc9b2eb0e93e2fa1e607fe7039f6a50029fab6e14b81d13addb66a3e534a598a41d80f7c513b00a78fd4
SSDEEP 12288:REf8xT3HMYQ7ql9izmtu5s50UiZ1GkUqpF:3umaPUijGk
TLSH
T1CCE4F67B111403ECDA6C8969A49F21E9B4A1333C03386FBFF4859E315EB59443BB964B
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/TVhTUNlxa8aE.part

SHA256 9c0caca60f6a55e0632e2ebe6bcc171462d530444ed043895c6738f03723206a
MD5 2c8bf0c7a8cf81fa4ee975d851b14048
SHA1 b92ba9a59dc683ee59ca3e20320f6944d664a400
SHA512 2ac4fd2371550f662634462d6c84542e7b5f2e0d584ade0abd9b3dfc677662ab97b9109dd7ec41d5f6a3e14536bbf8f00096215b82744e4e60d815fc8388f501
SSDEEP 6144:D2DjbN3cArYvCprP8AWZu3JxZ40ih8FgfwV/9jHUWhyY42nbaALZn1+gWMm:ibPAQCZu3JOh8FswV/9jHUWhyY42nbax
TLSH
T121648E9EAAEA01F89537E068C32F92A7FB71301D4374B9EB47E145951713BE0A13E712
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/XFmw5hRXAmeS.part

SHA256 17ba935c7b31b8c0abbd017d69377da8e9c4742063dfce0d5a0025c6aa182990
MD5 3962e631e231ead7c9e8f040cdc524a3
SHA1 eb900533d790a0fa625cdbc71148a6d2cdcce4de
SHA512 37f942b75d3d083795f2c89dc2f3e6ffd39fc99f171956cb8ba1138290c9827a0cb21ae004a077354dc517f714c70de02332388c6960efe15b730ac79c87354e
SSDEEP 3::
MD5 SHA1 SHA512 SSDEEP

$TEMP/data/file1_parts/g8ZqtBo45ioR.part

SHA256 1284af234404404f41ebfe28294cbd357c01662d3b81bd4e55851d4e04b3026a
MD5 847419370d39cfa597ed13cc64094738
SHA1 69a98b4edde8864240f90c4a0f2829b585371a49
SHA512 d32213b24a5b85d87ce1f3d1217e6d70da3b940b0079ffdbbf94ac51bee06df642425b00f49e6ce7fc0fcf3c908b19a38612b7d71c406acec4b8f8eb8735868d
SSDEEP 3072:WyCxWac1h4OxAvZimrltcnmKTHpCyOUV0oB00u36DrWNsdN2A6NUIRVxIIGIX:WSh4OaNOVBB00YaS62FG+
TLSH
T151846C0EB48954C2DD338E3B8D03C2E4951278515AC15E7B33F8A74B2F5664AFF9E918
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file1_parts/vMeZ429PmCUI.part

SHA256 bf41e300830c68fbc0fa163161fea5eac3090e8dd3e5aa7c1951ad2bc0c2d6e0
MD5 85f7f3dc39f36976f5d9aa294d616119
SHA1 8f8d34963b69736001f922915880d5bd38b40d86
SHA512 36c24470c24d4fa1aa3beb4c4dd824c7c7a831cd8ae528808cca1654d0474dadfc31899573260ae1b7bf0c3ca45f8df49611037506ab7ee061606f743c236057
SSDEEP 3072:EaVAoTlgme4kUwyaxMvvrSLsej7e8JhV11wQspWYOYsWPQ7MeWPtVBwRszt4sSBM:/s7uMRg3oNsVydBsCC2kxSke0
TLSH
T12F44613E644543ACD96DC94EC8DF60ED81A0362CA1394F7AF4916F210EB6A683FD54CB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

2930736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

775KB

Virtual Size

775KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

203KB

Virtual Size

239KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/data/file1_parts/yuaDDOrDHtrv.part

SHA256 c48d6314440f7c2ff37f517128c17a6e349f5ff56868035a76f02dc340188955
MD5 7745b38a0076f0213cc642d62f620e19
SHA1 9a5732ec3a3c3ddd2c9cbc7b88f459dcdac06cba
SHA512 b100845ac62e368a041ceb43ec9877200d50d25b870bca4356531288497d085bdf8bdf9d8291d606a509d4a4ed39fee1eb91a54bb79d851471e90fc76f3f9c3c
SSDEEP 3072:fO2o0geVfq3Ci1KZYzCQaJniaG/BMNWafnz:fO2o0gGfq5sA5D2NW
TLSH
T18A547B782AEC01F9F0769179CD464606D5F374120721DBDF03A04BAA1F2BAED293EB52
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file2_info.json

SHA256 48f595a162ee3705ab9ffffef8c0368f2e6c77194788291adbe609c3eccca92a
MD5 3ba7ac0f84bd705e482818a3390c4ce8
SHA1 5d20cb0cf51c51c3f55c29b43b4f238ced5fa130
SHA512 ce3ff80ffc42525d4c33a65aed586e02d1bd94e5e51608333bff07c4f99577ca16a36d256cfa4f3ec2367a9dcf89d7ea2b89df6f48eadfac2e1597e0d39e8229
TLSH
T181F0E916D74CCC96623DD3A14C2A1702F5A1AB1B2161AE4333FE568D4F72971414F7BE
MD5 SHA1 SHA512 TLSH

$TEMP/data/file2_parts/FL3P5eWtT4SV.part

SHA256 6a6c75dfadbcd1fdb62b49394535aa219d18326b89318858ae3bfddd037a5f0c
MD5 92260fc0e9a140e3a166f47d37f28ed5
SHA1 d0415cfb81665a9da1fecead1feed8013928c6c7
SHA512 43b01c8dab0344f1d42deeee988521a0632009df771ed44a50de0fc1a35439f22f33a929cc9b38843ee23d8620efa21af84963bc212b10d70f2ac5c84bd411d6
SSDEEP 192:unFGYhNU7PMn4jMaWz59KDAajJOq7GXqL83ss3EXz+:unFGYhN2PM4jNWt9KUajJOEb83ss3Ej
TLSH
T11B2466A7A398CFB4F155F136A77904F3E854D476DAEAC2A91C8D423501AEA15E2F3C0C
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file2_parts/Pip5qPhhCYEn.part

SHA256 c59c2efa1ea79a8dd0b73b9178f3fa4b79d8a6a18d006befc97b88c4b661f8ed
MD5 fc76ad201c3336ad5ac8fbd7148a1c16
SHA1 573c9111a9b46645b1f08b762a652670538fe9ed
SHA512 b7a56734757d828061ffc32f70a18ba98ec83f439d808ebe90a6c352b19d999b23a80f475dd267d4d8d17cfed9c82c9ed8fe2fcd654839dc3bec4830693cd71f
SSDEEP 12288:9jInhMRI/pUoPzmQgiRsqGr1zvvDvKvlsD8kVEuSm:ZOakbkTHSv48kVEuSm
TLSH
T129C4E0DB70ACD7F7F4370574073A81D0E61DD61419F6C7262E8A8138AE284C7DE6AE26
MD5 SHA1 SHA512 SSDEEP TLSH

$TEMP/data/file2_parts/aQLz7LlC4ujL.part

SHA256 8e1541436a20f73c6e790c813ff08c11b8c0834ad3412c2892ce3a145e4eed6c
MD5 f64a8ce040ef2c5ec6c6818776a28a18
SHA1 da953645ca6510fc4698a6ca16f58abaff0188ea
SHA512 4e41852d54c65f982876429e89740cd2119aebf6cace4ab805006c74ec607f195ec153eb15c73f116a58dc78f8db963f36e18b0dfc612db2abd480bd026e9be2
SSDEEP 6144:K9+OU/ROh+wugRafYZMq/G71dJSLmYUetoj75rJeQ7l:KJaoh6gMfYZRO5OGetGHeQ7l
TLSH
T12144C097B48582FAC02BD0B587D98222D666F05A8F3475FF47E84B620F25ED11B3D386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

83744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

582KB

Virtual Size

581KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

177B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

272KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$TEMP/dummy_padding.dat

SHA256 9a2879e57e5b24855f0462deb93cfbe28f15fdda877d913450a469ece75f9111
MD5 d1f73d81250b39b3f7bf0afb45de95bf
SHA1 234d9a2264e2a3b34d08c97b1842f12994f42b62
SHA512 681d63971e155786822f7945932229af33aff4a225bf5f2dfad2c50e6df701bf28996365bb41700b0e15ed643df8b97b491a19c6892f436cbff19ac6062fd84f
SSDEEP 49152:+y6feVbRdDYP34jbC8QrqZwVsyN1WvhZl7m0AQfaCf8nZyfHkW1aVt3JE:777Dw34jm8qq2VsIWvhL1fdf8nWSD5E
TLSH
T12AA5338F065A7D8274B86A238164BA067C10BA695385E9FDCC18477DE7B22FC493DF13
MD5 SHA1 SHA512 SSDEEP TLSH

Sharing

General

Malware Config

Signatures

File Explorer

Setup.exe

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$TEMP/Setup.vbs

$TEMP/data/.runner.ps1

$TEMP/data/file1_info.json

$TEMP/data/file1_parts/9TXEMqbnluzw.part

$TEMP/data/file1_parts/A22mX6i2QQiZ.part

$TEMP/data/file1_parts/Kxnm0tCGjfpS.part

$TEMP/data/file1_parts/PZNk3GFdnv5e.part

$TEMP/data/file1_parts/TVhTUNlxa8aE.part

$TEMP/data/file1_parts/XFmw5hRXAmeS.part

$TEMP/data/file1_parts/g8ZqtBo45ioR.part

$TEMP/data/file1_parts/vMeZ429PmCUI.part

$TEMP/data/file1_parts/yuaDDOrDHtrv.part

$TEMP/data/file2_info.json

$TEMP/data/file2_parts/FL3P5eWtT4SV.part

$TEMP/data/file2_parts/Pip5qPhhCYEn.part

$TEMP/data/file2_parts/aQLz7LlC4ujL.part

$TEMP/dummy_padding.dat