ta505 | hxxps://download[.]tuhunaer[.]com/download/telegram-os/index-p[.]html

Resubmissions

20/04/2024, 16:51

240420-vdaqfadd9x10

20/04/2024, 16:44

240420-t8zsdach3710

Analysis

max time kernel
330s
max time network
335s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
20/04/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://download.tuhunaer.com/download/telegram-os/index-p.html
Sample240420-vdaqfadd9x

Score

10^/10

ta505

Malware Config

Signatures

TA505
Cybercrime group active since 2015, responsible for families like Dridex and Locky.
ta505

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\Registry\User\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\NotificationData	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2718508534-2116753757-2794822388-1000\{2555CBC8-9E17-4F65-A142-46DD4E00375A}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2718508534-2116753757-2794822388-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\setupno-p.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
4708	msedge.exe
4708	msedge.exe
4488	msedge.exe
4488	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
128	msedge.exe
128	msedge.exe
5052	msedge.exe
5052	msedge.exe
4760	msedge.exe
4760	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
996	msedge.exe
1900	msedge.exe
1900	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 55 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4760	msedge.exe
1900	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 3040	4708	msedge.exe	80
PID 4708 wrote to memory of 3040	4708	msedge.exe	80
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 4780	4708	msedge.exe	81
PID 4708 wrote to memory of 2276	4708	msedge.exe	82
PID 4708 wrote to memory of 2276	4708	msedge.exe	82
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83
PID 4708 wrote to memory of 4900	4708	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://download.tuhunaer.com/download/telegram-os/index-p.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb85753cb8,0x7ffb85753cc8,0x7ffb85753cd8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5052 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6936 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,8214272443731108857,13009678898372698737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7052 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 de9124e3fddde204df6a6df22b8b87a51823ba227d3e304a6a6aced9da00c74c
MD5 6e15af8f29dec1e606c7774ef749eaf2
SHA1 15fbec608e4aa6ddd0e7fd8ea64c2e8197345e97
SHA512 1c9c9acd158273749e666271a5cdb2a6aebf6e2b43b835ebcc49d5b48490cbbf4deddef08c232417cee33d4809dec9ddac2478765c1f3d7ed8ea7441f5fd1d15
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 30bd1e1bafb4502c91c1fb568372c0fb046d32a4b732e6b88ce59ea23663e4ce
MD5 3e5a2dac1f49835cf442fde4b7f74b88
SHA1 7b2cf4e2820f304adf533d43e6d75b3008941f72
SHA512 933ac835894ce6cb8aac0261153823c96b6abec955173653dd56e534d644efd03aec71acb4f8cb0b9af871962296ec06cd03e570a0ac53098b8cd55657543786
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 24KB
SHA256 d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d
MD5 b82ca47ee5d42100e589bdd94e57936e
SHA1 0dad0cd7d0472248b9b409b02122d13bab513b4c
SHA512 58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383
SSDEEP 384:WVO9Au5n8w8JCE3z7e7Ttbu5+Esl5fnOoHYSDzExWCI3+IEesI1uBVm5ih5DTcOU:fWkn0RSdu59s3nOc5zExGd5Mt4OU
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 198KB
SHA256 f6562ea52e056b979d6f52932ae57b7afb04486b10b0ebde22c5b51f502c69d1
MD5 319e0c36436ee0bf24476acbcc83565c
SHA1 fb2658d5791fe5b37424119557ab8cee30acdc54
SHA512 ad902b9a010cf99bdedba405cad0387890a9ff90a9c91f6a3220cdceec1b08ecb97a326aef01b28d8d0aacb5f2a16f02f673e196bdb69fc68b3f636139059902
SSDEEP 3072:UpHreF1T30JYH13kQCsC42wpBFKjFyjd2twH1XCR42UiRxGNMm6t/9durtK:UpLE5EWHxj7dFKjqd8wgR42UYGNg1sxK
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b
Size 27KB
SHA256 a20310738269ab7907af99cf6abaaf81a876fd59dd36d9ccbd8fdbd4407489df
MD5 322ec754f369b14aa8898467033c49a4
SHA1 c6d01ad92e6e8a7e4a61a656f2bc931f1a5994cb
SHA512 6b2f26ba17a1a9172acacf71d8b69743f866579da7dde85789b2984e5d618c57d872fabd41f487b217c2d4b10409853fa2a03e3b77c9cdfd4ebb2ad313631b0b
SSDEEP 768:Hwvtp6V+cO0ZzMRHMuYuyfsyh9ZTUdEbS/BGxck5I92zJN:QcO0eRHbpgsynhDMBmckm929N
MD5 SHA1 SHA512 SSDEEP

Submit Download

d73fd361b451d219_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d73fd361b451d219_0
Size 19KB
SHA256 83487ab4e3f12ca27f1714fa87763efd8233c2934e094f815d07f84f04a19b72
MD5 b12aeb4abc9cd13313d46b99e49de3d0
SHA1 afc2fc2300f9a0629843ca142a46b940af47d256
SHA512 068a363afe1aa0b48ed3c08f172bec9e77d654b5113db9c8134537027a90589a4d157ec88767e5056c94eab22b1aa93ec6c657429ec7976563af54eedd02821d
SSDEEP 384:sJHE610ZNodN7X9fo6Gfx+VfvBZbIPGIu/9xJMD5RjTORps0E30cIMWoXdiGZ0ZB:sJk610ZY7XNo6Gfx+dvBZkPGt/97K5lK
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9e7888972b9c1cdf59e23297b3ccd74eb4c3d8861b5133791dbb331f8329466f
MD5 0025b3f50d4301fdd953ec8453a7742e
SHA1 81e37375e277c137007f164d08db272ce3f43d54
SHA512 269d01a2d7314227dd60ee3af52f537143fcaf1ee429a22d11e6b6147fbd578529c09aed50495db26f9d50aec360d0df1f984ae8599c6733cfe4af971edab5cb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f2420d0ebf89865e3998ea2c612f894b1cc78eaf1bc5af2e97ee2b4fd7bbe774
MD5 1573a388882a930ba87380c62b51d108
SHA1 bbf06805ec96593589cb692394949ac2b48bd494
SHA512 389427686bdd042e228a03ff26e95e6aff23f178314387cf73294538fb758bd8f55819502567f386a86f7e4438f5ca828184b6aa1beaa67c792e53cafba4fdad
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 e7fa9fef0d2f1a70c896f4d4d971101ceb04af5efb2349dfb4208ad361eb5348
MD5 6a071726ed7b2ba313b732b07364bdc1
SHA1 4e9763169e5de2dbc205f20fe13103e54a2a29ad
SHA512 4ed3c3a00ae3ddb3b35e3650d85ee99f9a077e836a556d95c9c83529f1c6c8e0e6765d9be048f05ab2d503f106a7b812e116be1c57caf5217598627eb7a18619
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 989510048af31df7df2d5b6624a7c6605d41151cfac20f6d987ce19337cb0ae3
MD5 2bbae2c48517d416c089cf0d60176ea3
SHA1 f12f56b17a17575877fe24e5f6109740824992d9
SHA512 1134ab69a6c8285def1eaf31cfe49c26e74c506027407bfcd3ebf6c7939d1507ec9b93a79972ebb2467eaf8824941b96b5aaadcb2e64df17aa3cab2dadc8ce8a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b75d4f430f573d44231f00ad190484dd3bc6f8d2a6aa6ef239bd655b171a9d66
MD5 8f38d373cd6385cb2a2d995132bfcaf0
SHA1 b4b6ce7a30679f3e19ecf29f260c0e5ab18607a5
SHA512 c800c5cd0c288b538442bff1d400864c2a3cccd621b46bc7a28f6b4c91cfcd7ff15360ea73e17b9b4312e1434f9e7597719b18e69826d40c0bcd6df06446379c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b270d6a3876f06fe8021acd83e9895eda72d6cca73421da8299a0944f7ca69e1
MD5 ffbc6d754fcc8962d122c52a803847c9
SHA1 3929e30dfc18248b27bc9667b4c80401a4831d80
SHA512 7fb97ce6da138d38644a14a51c201b034a8d4508486a7f069dbbe14d7b5da174d574a829f4c62e704c39faae4f9d2091625fa6b80813a7395ab55fffe208fcd9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 ce60a7a604ba6c4ace6de76580a4bbfb359d7d8c73f260c21dbc687b0134fa9f
MD5 7ebe31098e24f9f29f99ff0c235a0384
SHA1 2e8569d8ebbfc269cf9d0a7eeef6c5aa73534717
SHA512 9b20caabfa99a52a0a27bb8eab27e52def6582347cdd48db77d741b38bd144d68b3e7bc11553972dcbde491928d37cde2b3869350efd76d22098b565d301b659
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 0835a5f8542588d37cddf6c17904fd641f5fb2fca6899243dfae24bce0d73333
MD5 0122419ce16f8de78ffa202bde2cfa4c
SHA1 7e732502efdb2e7dac47bb8f96769ba9bbb169fb
SHA512 fcbd427e24bcba31c9760aa9eff2e179b93f61a48ab4e50dae71498bcdb9a01d030d6c43848fb50e96415ebd45e70f06a32db71685fb1db9c0bd44350cac4190
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 021ceb9c8eee18132950e839e592548cecb0497aa2ba74ef6f0df01b77eb7032
MD5 bd9d31e68314b6ff5143362176959b2d
SHA1 e54774c6489092df2ed83b5927fe8d783efbfb14
SHA512 73981444081e948428eec6745d12703f8d67ccaa54476253448165dbf4bf48c905bb9e5ee6c862f314d99703ae20b1b2a9591477aeb7c645d7486d80f64f7e44
SSDEEP 96:nYk3Yvxm/YQYmtwYPky6c1wSv0MoiVmdHIvJvt0WQyV+VuziX3wI3:nYk3YE9lPk5iv0MAIhvtLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ab494d0a012bcc31a09fd6561de7e30bba3b1f9015154f03825b346584e17a50
MD5 6fc1ea7713e6431303d698c5ce9874bc
SHA1 d24086e3911cc3fa973ee85481c40e249d070646
SHA512 d688a9d8b7a42e9339a49da10f54f60ced9d48c6ce14539fa8349bd362539f290282d66975aedd64adb01534af6a47e947ca9f9627e9327c4fe42518e9134925
SSDEEP 96:nYk30vxm/YnmtwYPky6c1wSv0MoiVmdn5uXn1jILyJvt0WQyV+VpAiX3wI3:nYk30EjlPk5iv0M+5uXnhILYvtLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cbe542b247b08aef9aedfc692aac5fbd359758ee7118692bf22837e64fdf18f0
MD5 03b155531e093907ddadb2baa2621055
SHA1 281bf2acfef8f53e7aece2c2b0eb87baa2d97889
SHA512 e5ca01f28a3f3e54d112242cddb08cd90c6106948784171021c5f52945bc1866b1313d2bbee9c32de0ca1507166a13610d205c56fb22ab8a621146dbfb51cce4
SSDEEP 192:nYk3YEDlPkJigiF0M+5uXnKuV8X2w2IevtLy93:nYeYQPkJg0mFEevtu93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 53d6fa48ce3fdd4965eb32741bfe8b0810435680854070f6dea0c2dc7a61b1d3
MD5 10dcf7ce987cde1479ca7fa725428ba5
SHA1 14516cfbb1dadffa2a8e72ade59063664a1b314e
SHA512 6718ebdb0da2a51c9b3ab0c3a6d18187cb4de7db018ef5ffec47defed1a66b7682a624461d97cccba5d8004f792b66baaddfb054a229f4cdb0e02341f93d55b8
SSDEEP 192:nYk3YEDlPkJiTRF0M+5uXnKuVKyQ8X2w2I9CtLy93:nYeYQPkJC0mF8E9Ctu93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 056943da927541b85483041452d6fa8cedc28a1ead5b57d65fcb63e4ee8bf085
MD5 ed2e9987270ab4b498a6689b2e770960
SHA1 8f422a14e5ad12d5b34a7ec6c15e0fa03951bb49
SHA512 f36745a99f82997c630a26c5bef0dbbc6868ab3745f837c5b5ed5e69575f7fb8547f2ca25299c5a1034da4bfa383f6aa55ca162db345b9bf160d1da950106f92
SSDEEP 192:nYk3YEslPkJiTRF0M+5uXnKuVWr7sVJF9ItCtLy93:nYeYBPkJC0mFaVtCtu93
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\1894e369-6121-4fae-a49a-2a6d5b187924\index-dir\the-real-index
Size 72B
SHA256 6ef2bacb2e27801a3bfb6db67689de6227d28f94e954c217c39c7b2b3a4ec72f
MD5 cae441d68a8aa9669c8dd0c9ea83e65c
SHA1 42bd2501db50ddf6e68e028fff7b217567186c55
SHA512 dccd3d3e208891e833cf271e36ddecbca861fbc4c05b23e1b2533062eed3c32211fd247476498bf0f213b7b2a17920a3a679c3659a97e37f82f79c11fe03ec71
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5b970c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\1894e369-6121-4fae-a49a-2a6d5b187924\index-dir\the-real-index~RFe5b970c.TMP
Size 48B
SHA256 4f40bbde89371165635046d0711cb1520418df953a3709548b4395dc6661f3af
MD5 700007517021eac3b648d5770cc8267f
SHA1 a3a7d54772a658a95c8acf144471495b1a96b73d
SHA512 7e0273875500e035ae867a31f6a13fef7cb34e8efc86eb6248059d9ce1ecb6bd699f0bed5da8d8f77d24c6dc347859ba57b104e77375c69b33bf4255445a8090
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 95B
SHA256 b6ba6d6a93d69b5803b86862d56865400d14096aaca2a8c71d62823ad8819b9d
MD5 b9c5f4d18e5dcaad683acd0ee07840bf
SHA1 276cb777bb545d07bd9fe3224428525a3bc11dcb
SHA512 f1711c0a5a675a9ccdbfb257565d7b4d7f3890c929747c204ec47acb40dd4228a65177f81a86fea7e41f672d318e19b5f8db20abb80a0a438f38a93f6baae8e9
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 89B
SHA256 73e8edc9e0c2577a5b4bfe9247a1b28f743f1f31ec73d9dcf8a4d50a8e916027
MD5 76db7053f386c76c871fa425cc611d9e
SHA1 236b6ff34162d657ec380a9d775c0f59ab07cd38
SHA512 6e49d5ab2f732c3040fd3815b9cc5adfa078e26c0d6c78f54dc73924d7be06ad65a8228ab83451b7821cfce4dcb16394adbfb76affdee0c2cb75a24a218c6efb
MD5 SHA1 SHA512

Submit Download

2cc80dabc69f58b6_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0
Size 118KB
SHA256 acd8f6abde7920f27bc0f94f80202eabaa97e0df769a550d9dca920f6ce3ef6a
MD5 d27f3c69d6901018adf62c2ce39dca76
SHA1 e410389a42cfda398558fc7b99fd704fad479efa
SHA512 e0ee65c5c24cc69511ebf9e64f9348709acc1b9e83ef07ed8d1597231967c65eb7b9c859de5121d8a2589bd342367803e7fa4d88bc76ec2cccd73bcfd2c79406
SSDEEP 1536:2KbSCeDjA8WUR+Dc9NFJ1+ZDpkhzG7I9MUjxPCFmCWZSoe9wElylEp+c6LhmVJZL:jheDXVgH89fjxPCFm2t1f1KPpC5
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 329d9125d3cf04115212bf16f14ea0f169326fac6c45f5d8aeb5668f8e045a29
MD5 9afdf4ab5572550421d33379e881b427
SHA1 60e9c6f49c8fc3a905eca47cfdad98d738b13a62
SHA512 12ccca9e01e4fc8582980575b57422fd4788cb4855ff81771a5738dc5feb6f1f8633f40186cb95365294b794ed314fd5a4e4514e15a052f175a4ff678375a672
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5831e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5831e8.TMP
Size 48B
SHA256 cbeecd4815c780245574c16e85c5e33f9cea9851b8708f57de05199303a2b455
MD5 4cb8b4803482cb04139d90a3beb95a2d
SHA1 9c22d886a0fb1890e66ccd43bc92c73530b4af93
SHA512 1abe2c07c9e7f0443f59e48290af5349331f16a9c7d674351660d95878cc267bf93a2c8d5b333c84697e7f2daabef46c6dc615ff48f8ac8557ad97e463b556ea
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 48037b168c90726a36305172e5dda922a432b76e786485e47079cce7aa94c6b6
MD5 9050852a2a5c96138a15744f3184d07e
SHA1 3b8dc7b0fa4647cf10c6a003ad88fbf5355407f0
SHA512 caff397b500db9b216ac01239612fbd01e9a051050aef5cd4891d24b6c5f9962eb890db67dd4f367070acb3735bff24033af55bb2559026f747231efd54e5b3a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581846.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581846.TMP
Size 872B
SHA256 f9062096d559038c08cb680176cb72c8508ccd7cd6dad54c768d4e2956e4fd80
MD5 5cc26427bedf81c4b72b39dadbbebe4c
SHA1 e2da24663b692efac34abb2cb8967547b89f3490
SHA512 f3c873f6c7c1621b2af839841101bb6eb5efe27b96ecf61d0c2a379aaa1fa7a5720599ac96bff7f89b41a723b8ca6c342dc3ca1b2e060a31d9d5b01619758811
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 39984522a154e769d49c8f3ce29e9a3afda2ece0c3e38b1c71ea59c907b03678
MD5 25b7df37dceaf62d9df08779ebbb7d3a
SHA1 38fa3591f80a7de902f5405cdbd86a283ca813ef
SHA512 b411a4bfaa717ed494af99ebfd66d84cebd22754c2d2c1a10db9408b2f564b37a96578044db70775ddd7d52533998229f7752ac1ed32e91696408fc66fbe4fce
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGELe2RUiKSOKV4HOh8Eo6I8CN:M9iIxuERzA83h09RZxASGI3KwV4HOh6x
MD5 SHA1 SHA512 SSDEEP

Submit Download

iconcache_idx.db

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
Size 14KB
SHA256 0f16e2012cb57adba69284d1123c47829c7b93eddd253ba5bf7570e84f3f97f4
MD5 47e62e08ab06dc2ce4723be470524710
SHA1 cf0c53afc4520f97f4804a6c102b4bc887aaec66
SHA512 0b2dc915665bffa834aafc80b142f48194315eee78a6d9f09a79997b2d1dcfd6117f55a251adce99115ed277a9d8e8337914f5df21d84ccdf69b6cffdf8af510
SSDEEP 48:oG5K8A8cwlo+ertmfIMYhOZVDl6g/tJPPn/smwU05EcsWiKb043utD6cN02Gzo:RhdWXtDM7tLPP8yWvgZtDkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupno-p.zip

Path C:\Users\Admin\Downloads\setupno-p.zip
Size 104.8MB
SHA256 c6218c957cea12177c1e865dff0b7b54017809421c531b95352e2a8e0caba1c0
MD5 2eda3c738183a870592280be2e0b3cca
SHA1 b367268b4fc4da42155e0dbbc3034edc78d46de6
SHA512 3c500dad3bf7fa61846d67356272262e1c102b6e59b97d706a4b1861fe2896466541655cd150cc3d475b409d25afea10b04c3023ed36544ddc97c011d329e3e6
SSDEEP 3145728:Q9me7DcYXd0SbqJ+IKL0u/fop5d5Rk8BZ/:BeUYqSbqsnop35RBz
MD5 SHA1 SHA512 SSDEEP

Submit Download

setupno-p.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\setupno-p.zip:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download