hxxps://is[.]gd/hhOqmU

Analysis

user interaction
yes
max time kernel
217s
max time network
218s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
24/04/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://is.gd/hhOqmU
Sample260424-qk212sbs21

Score

8^/10

discovery installer persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
152	3384	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
2696	tsetup-x64.6.7.6.exe
5684	tsetup-x64.6.7.6.tmp
4428	Telegram.exe
3176	Telegram.exe

Loads dropped DLL 3 IoCs

pid	Process
4428	Telegram.exe
5392	msedge.exe
3176	Telegram.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1915139326\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1677064048\regex_patterns.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1163533922\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2095800988\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1677064048\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1915139326\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ja\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2095800988\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5392_200535463\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_417484675\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_2095800988\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5392_1677064048\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.6.7.6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tsetup-x64.6.7.6.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3384	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/files/0x0003000000000337-620.dat	innosetup
behavioral1/memory/2696-634-0x0000000000270000-0x0000000000348000-memory.dmp	innosetup
behavioral1/memory/2696-673-0x0000000000270000-0x0000000000348000-memory.dmp	innosetup
behavioral1/memory/2696-755-0x0000000000270000-0x0000000000348000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134215104333651436"	msedge.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\ = "URL:TonSite Link"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\shell	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2605425648-1229640847-2920638550-1000\{7080E84F-A2DD-41C1-9A14-A913752F8B01}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2605425648-1229640847-2920638550-1000_Classes\tg\URL Protocol	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4428	Telegram.exe
3176	Telegram.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5684	tsetup-x64.6.7.6.tmp
5684	tsetup-x64.6.7.6.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4428	Telegram.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5684	tsetup-x64.6.7.6.tmp
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
5392	msedge.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe
4428	Telegram.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4428	Telegram.exe
4428	Telegram.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5392 wrote to memory of 5736	5392	msedge.exe	83
PID 5392 wrote to memory of 3384	5392	msedge.exe	84
PID 5392 wrote to memory of 1948	5392	msedge.exe	85
PID 5392 wrote to memory of 1948	5392	msedge.exe	85
PID 5392 wrote to memory of 1948	5392	msedge.exe	85
PID 5392 wrote to memory of 1944	5392	msedge.exe	86
PID 5392 wrote to memory of 1944	5392	msedge.exe	86
PID 5392 wrote to memory of 2864	5392	msedge.exe	88
PID 5392 wrote to memory of 2864	5392	msedge.exe	88
PID 5392 wrote to memory of 2864	5392	msedge.exe	88
PID 5392 wrote to memory of 2000	5392	msedge.exe	89
PID 5392 wrote to memory of 2000	5392	msedge.exe	89
PID 5392 wrote to memory of 2000	5392	msedge.exe	89
PID 5392 wrote to memory of 4320	5392	msedge.exe	92
PID 5392 wrote to memory of 4320	5392	msedge.exe	92
PID 5392 wrote to memory of 4320	5392	msedge.exe	92
PID 5392 wrote to memory of 3924	5392	msedge.exe	93
PID 5392 wrote to memory of 3924	5392	msedge.exe	93
PID 5392 wrote to memory of 3924	5392	msedge.exe	93
PID 5392 wrote to memory of 2616	5392	msedge.exe	94
PID 5392 wrote to memory of 2616	5392	msedge.exe	94
PID 5392 wrote to memory of 2616	5392	msedge.exe	94
PID 5392 wrote to memory of 3748	5392	msedge.exe	95
PID 5392 wrote to memory of 3748	5392	msedge.exe	95
PID 5392 wrote to memory of 636	5392	msedge.exe	96
PID 5392 wrote to memory of 636	5392	msedge.exe	96
PID 5392 wrote to memory of 696	5392	msedge.exe	98
PID 5392 wrote to memory of 4044	5392	msedge.exe	101
PID 5392 wrote to memory of 4044	5392	msedge.exe	101
PID 5392 wrote to memory of 4044	5392	msedge.exe	101
PID 5392 wrote to memory of 5448	5392	msedge.exe	102
PID 5392 wrote to memory of 5448	5392	msedge.exe	102
PID 5392 wrote to memory of 5448	5392	msedge.exe	102
PID 5392 wrote to memory of 4900	5392	msedge.exe	108
PID 5392 wrote to memory of 4900	5392	msedge.exe	108
PID 5392 wrote to memory of 4900	5392	msedge.exe	108
PID 5392 wrote to memory of 4472	5392	msedge.exe	113
PID 5392 wrote to memory of 4472	5392	msedge.exe	113
PID 5392 wrote to memory of 3552	5392	msedge.exe	115
PID 5392 wrote to memory of 5588	5392	msedge.exe	116
PID 5392 wrote to memory of 5104	5392	msedge.exe	117
PID 5392 wrote to memory of 3468	5392	msedge.exe	118
PID 5392 wrote to memory of 3468	5392	msedge.exe	118
PID 5392 wrote to memory of 3460	5392	msedge.exe	119
PID 5392 wrote to memory of 3460	5392	msedge.exe	119
PID 5392 wrote to memory of 5612	5392	msedge.exe	120
PID 5392 wrote to memory of 5612	5392	msedge.exe	120
PID 5392 wrote to memory of 5612	5392	msedge.exe	120
PID 5392 wrote to memory of 3112	5392	msedge.exe	121
PID 5392 wrote to memory of 3112	5392	msedge.exe	121
PID 5392 wrote to memory of 456	5392	msedge.exe	123
PID 5392 wrote to memory of 456	5392	msedge.exe	123
PID 5392 wrote to memory of 3324	5392	msedge.exe	124
PID 5392 wrote to memory of 3324	5392	msedge.exe	124
PID 5392 wrote to memory of 3324	5392	msedge.exe	124
PID 5392 wrote to memory of 1848	5392	msedge.exe	125
PID 5392 wrote to memory of 1848	5392	msedge.exe	125
PID 5392 wrote to memory of 3584	5392	msedge.exe	126
PID 5392 wrote to memory of 3584	5392	msedge.exe	126
PID 5392 wrote to memory of 3584	5392	msedge.exe	126
PID 5392 wrote to memory of 4452	5392	msedge.exe	127
PID 5392 wrote to memory of 2696	5392	msedge.exe	128
PID 2696 wrote to memory of 5684	2696	tsetup-x64.6.7.6.exe	130
PID 5392 wrote to memory of 1312	5392	msedge.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://is.gd/hhOqmU
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7fff0f23c188,0x7fff0f23c194,0x7fff0f23c1a0
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17593288055766634809,1917089365896617675,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,10921483105219086572,7357070247789534621,262144 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,6845573941754702975,11675998389645144927,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4387973120806181566,8604461567449006332,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,9296328643265052882,9900422513848830429,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4968,i,7048782348621602421,622444561128400533,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3404,i,9831685522574612805,11633709505807519906,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3504,i,2833247614103335882,12301156299512215866,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,14438564425894525652,1352733226562004308,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6038309877314270833,7414346471500907388,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15912931044446770401,1696375881358248291,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,15912931044446770401,1696375881358248291,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6576,i,14437553532256142486,14260400768033251506,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3520,i,18369631554696465973,16073354419720228503,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5884,i,3171341313533291673,8998817969648202961,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,14927659692195428493,14575211230708197319,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13324161588369397547,1836289685499289641,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,5771452616448564347,2238523837657676753,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,866304526165191677,17961182657907364905,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,6889494126886222170,623701583007526675,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,4173198904200797480,14869962076084078750,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6656,i,7426463666282424274,16029058010916973335,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:5612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17146017569032547732,9584111983921937190,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,3124758727425886459,3493445796250777941,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5444,i,9066617036804367050,5326696933557564488,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4385745630027623167,2940510686308556100,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3684,i,11649854157481062663,16883654254827601136,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,10096503961340372651,6360407620060186449,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:4452
- C:\Users\Admin\Downloads\tsetup-x64.6.7.6.exe
  "C:\Users\Admin\Downloads\tsetup-x64.6.7.6.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Temp\is-AK2VM.tmp\tsetup-x64.6.7.6.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-AK2VM.tmp\tsetup-x64.6.7.6.tmp" /SL5="$601DE,50278530,826880,C:\Users\Admin\Downloads\tsetup-x64.6.7.6.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:5684
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,2792335985239817529,12674986394802526205,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7248,i,11887199116534195517,2975582793023545021,262144 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,8213378904876708634,6012250856066215718,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,10580011707267071684,5500649415518813999,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4884,i,374520104281393711,5946691612300147791,2097152 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
  "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe" -- "tg://join/?invite=v2TFbWGW-AFkYTJh"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: AddClipboardFormatListener
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12705604264978888674,12599392756711200055,524288 --field-trial-handle=2832,i,2448065256858957281,18317444209469129310,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1877fbc0c43a45e793044a62162a5fb8c5c9dacc6820f192e229549bf23e282
MD5 d7f6a0a3a239b65bbc4d7200cee11fea
SHA1 bc633583358feec3947b57794222463c529d6a40
SHA512 ac97a2816b8d8e6c559e30dec4991e0c20f54b4e6f42611680d63a9ff163e987f62a0d16d6d81e1b2ad20caa1759922ad0c71c527bcd24a2b835bea2edb0a9ba
TLSH
T171D08008A2777C30C4A8D470244F7B453919C5774653571558723D685C6305114469D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 693630de12772afbca58d0e311382ac6546952d2c7417697c9cf04290bb383f7
MD5 650f9e39d68dc868fc760e52f68f7fb5
SHA1 8b7b2b313c1da23b2f296a7f87709a346e2744fb
SHA512 98ea53683e8cb8bc12fffcf18d524224e29f680dfca75b769a7dd80a6420fb8b47b781e800f0fc1baa2bdb4aa711d5432260a9c09219b84450a279883f25dcbf
TLSH
T140D08004A2737C30C494D470248F7B453A29C5774653571558723D785C6305118469D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ea1cc23b661de43499d399bcc0143872d0c9f805733ba4483d325d4116f1f068
MD5 7117e8bbb3067d48ee599ab52dc9befe
SHA1 48a94765bf3b5d943085f34f0123d606746f0343
SHA512 e92f28ef5b4eeec9bcc20253771eb86586532974ba6daa7a74958a296dda5e0763f8ff68c9c60f45d3e9e8cb76b716459be633ede8c8d5d34e0ce881b90b2fd1
TLSH
T176E02B9ACC10EC3B09FD07186150478AE78053272B61454F3E3E83098FF063A454AC5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32f08c16f53b7af61689551ee807fb5522a694bdaaf340fb49a4b71b2da22e0d
MD5 a89779c1387be77f14c4ed566efc1c67
SHA1 5e1fd79982415884f5aa9a5a369d078d38ff846a
SHA512 749229c5db4881453393af3b62288f665db0218b8c841d6805f5f2a16d959eba2e11f8122d5bd8354084638c0e13b83c0fb854d849a5c1efcf118941e0e89c68
TLSH
T1A2710C766247C529F3E10DB40AF72086727543B4C7C78F1603C7A8FE4A75B939980576
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f72d3ff60ab6a266c63538851813a3917016fc50ffb93f0466551e5985b010d
MD5 a42e090c3f854476a0c86926cb8e5d4a
SHA1 518d4758bf71f2e03b4af52e74e3f71f06f6ccda
SHA512 1e3b474f6baf7ba919ad6a9a9e9a321c3a13911e55c01444652ab2d476c10e8a0909373be71c8c9797c4a107061a053afcb0f4df5e47ed4dec2aa3275b91bb49
TLSH
T1D5712C766293C529F3E10DB44AF72086727543B4C7C78F1603C7A8FE4A76B939980672
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588875.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588875.TMP
Size 3KB
SHA256 d2c4a9c27eacdf4b0bd44423ad2812af84aded9ccdb559b865346ab3ef5f0042
MD5 b8d8686eab3943df9c97d5e7e32649be
SHA1 2fbeb7dda6f562a58b401c2443c7379b94603622
SHA512 005ac70ff62146ed0c2a0d6cf81137f3b55c652b678757df2995886e155de850f4dbf4860b7886d10959388b190aee5792f67918bd9b7d3263704ff9d09060fb
TLSH
T1BB711B766297C528F3E10DB40AF72086727543B8C7C78F1603C7A8FE4A76B438880572
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c930742e754975228be5f114093e1f5ea5d9efdbbbbd5bec3cdd2ea92a426b9c
MD5 5878de3c05cf0fea77e9ff1893738189
SHA1 79c8fa8d1b8efc0de3520f2750a46552a8c1cd75
SHA512 abbf47f3d5cbce15b68114662c41e6af283f9b3cf7a2192e53b23dcb3a770960e61b0f46e579389f57b7fc4a0702813aa95d1bf7eb1bdb3b66abbbd0ac9e9c53
SSDEEP 96:DkOAx5akxVzZwtSj63OwqbwN9QiVqhaiwpJwMDIqDPzm:DvAx5akxVlwtSj63OwqbwN9Qi0haiQJM
TLSH
T1B091AEF783E4866D9E1299F0EB183E2BCE6C0915432C395B8DE4AF4B93E2470D20595F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 718c50e6bb147dee07d160c1ca34e7309a8fd894da4d3856d4339e8b941f1d4a
MD5 67b52a115953a9a2578bff18b78e1e94
SHA1 663c2dfeee61984d792167e443eab37feca3608d
SHA512 73f4dece7d3d6ee7fcee0964c91ccf8407f2cedd7035912969116762e9aa7df3edd33f6f54cdd12545a7fd62aa53725ba5868cfa85c08ff9f4b632bea00e4ac2
SSDEEP 96:DkOAx5akxVzZwtBMj63gawqbwN9QiVqhaiwpJvm:DvAx5akxVlwtBMj63gawqbwN9Qi0haiP
TLSH
T1BE91AEF7C2E4866D9E5259F0EB183E2BCE6C091543283D568DE4AF4B93E2470D20595F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 db2781ee714b38d1686c194b1d7f43869f07eea092618f04898c300f12e7b724
MD5 e0b91966a1e5dbcc79c9e4aade3ddb0c
SHA1 da8dc01f7933e910796408236f26ae9ec48954c6
SHA512 1af135158d259509fef839352a8bd29ab62d8ab672ac64bc93b32555718a4f122d6594e2a5f47650d983b30bf8f6ee9332909da716b9d159463f2ce150b1fafb
SSDEEP 384:sxZNiqpi/f0soEJ2fguTlzLHbyj4XliAYVLehk:sFtpi/fwEJ2fVl/Hbw4iAYV1
TLSH
T19F82F84AAA38593BCCE7D219B545BB67E3F5512295804E489AFC8F0C04D7BED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 fa9080fd6a4ec2cafded9d67e57be7325ee28a25fa05be14d6cb5579d3532620
MD5 8ad6958f01dfb0a24c81211fa709b535
SHA1 df38285cd16a941ee165913c23cf4dcb5be37d20
SHA512 9715ada8749fa5924c2c5505ecfdbc5d6c42a150c62abee803e5d11f0c2a6f3bd93d9c43b233ee6cb194fea6cacfd469994baebfa7ada701bf840b49642b4985
SSDEEP 384:sxZNiMi/f0s2EJ+fguTl7+Hb44/qZYVLjL:sFPi/f+EJ+fVlKHb4qqZYVL
TLSH
T18472F8066A38597B8CD7D219BA45BB53E3F94523D5804E489AFCCB0C04E6EED320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 eda35583c741bb48a3b02283a5fc96269c7ca5a9c083842ec71e028de42e3313
MD5 775c5af6dc4a72286235c466799a1d27
SHA1 6532fbc96caee20d371f58598b7f55d9e8bd7445
SHA512 68ac1fd81aad167cf62662d042ef6d1ac3645966fb1ca003f70cf70c2d35ede00ae684a59e5d004b6b571b606af87cfe2cffd30449518e2727d5aea4e94cbc9e
SSDEEP 768:Q1Mj2O97pLuL/OmWvOKvC8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaj+xLlh7WxLroV:Q1Mj2OrE/OmWvOKvCu1jabj+xLLqx4VT
TLSH
T162F2FB3B280CCB7E4F804E9CDC2A7E9A7DE801CB96D8895447FA884C03C66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3760ade8aedd698be79a465f2568dfe4ca23ae25484e1e0d8f300dcd91eb9504
MD5 d41d840ae47c286d9129720c469ad31f
SHA1 49c23df1dcb8b7760399685cb1c233198759d7c2
SHA512 b95baee7fec543fde1c2e25c3d4196874e7a4e6acce8772f87f933cd9618f474bd0cf0fcb8bdc9efeea197918ed70874ba32aabbed20350927473445b09eb349
SSDEEP 192:sh1WlDub/kDnmtTYB19srn97bQHSr/54UdaVtq/5bfsRLw91X:sHWJujkjmxYpYTslwjX
TLSH
T18AB22455313A02903A7E69CA81D5B96F46C330737118E42B7BB944AA4F6BE20DDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 2KB
SHA256 b3f2db5ddf1032a7cba2a4951f74f03f53372a55c919fb2af03c11ecdeac06ab
MD5 c258de18e7bf1e89f6e6181f71b240e1
SHA1 c3876d43d71790d7684bc94289ce0ba563b2e3a4
SHA512 fa76123ed95e3ff40e2daded7c4ffae2b1af42e68aa29e73b18bec50c338bbc1e24b71b4e0151e731f00ab811aa8b6017b5f6b5698187ae70f267dabba7e9147
TLSH
T1FD5127C193B564D97F89A9C2C3197513A5E53E6A260E9C72232EC4F44F44C248E7FE35
MD5 SHA1 SHA512 TLSH

Submit Download

domain_actions.dll

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Domain Actions\3.0.0.18\domain_actions.dll
Size 83KB
SHA256 d35c8efcb710239f009633bcc5ae904ac6dafa985d451bedf791cf6909f014d4
MD5 956f610121cd5827fd5549097b79cd9f
SHA1 dbd23f99895a3a92fbe04c3c35d475a6f6998fd0
SHA512 3cc4712f64474497495d229ddd743c6bf25c30c3fbfca2525f46227d99a59a0f9e80e2119ffb40bc8a707b539f65f907e2e1565ea937e0387db47cf7269944e6
SSDEEP 1536:sNGnmI1FOxAdgxBf8paY3JQzQik428fKagFVbydki8yyafuzWk:sNG91FPgrfrPza428fIenya2Sk
TLSH
T16D83F180DF58411BF86F4835E0B269857A78E6B50FE092DF2376C9590E12FD1AF39705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 354be622df1966b5521feefa4d4532b58ca92c1c986c45cb37ed0cdcb58f3559
MD5 1a251e60c32d1ef7c47f74b6b5bd7f13
SHA1 20ae4ad57a7409785aa27558a098d8ed813d98db
SHA512 c58e737a2593a47881affa61bc1f07719e1ec24845f665089e126fdfa9d694c84c32847880662820c3c262ebd09501c3e32bcc701e4cd73a408d2575e1c1c30e
SSDEEP 384:nzXiFVjccCs+Bt0S39msNiu8TUNTUlI4AmOgU+7LCqzZfniY93NXU0+g6XlN7dpB:zSFFccQQTuwg/5NYU0+plN7dp0oky3r
TLSH
T15EE2C4F598D7897AE99E4B47A33D6E029AFCD153B5881994FBC40E0DCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2fd312b0def55028acd2289c22938b44dc0f372de7ed5c97c990f6b9471292c2
MD5 aaca076e87c430e7ad7482c68df7ed41
SHA1 1c7ac0012bf480c0de145790fb7b14fc24cd79d2
SHA512 61933c53dead6182943ce9f9ac8c163057373006f90bf1ee65a3eb8542a776c9111ca950b84ab2e28b58e619edfc0be27d1ad33477b7bc95c09f8039592241e5
SSDEEP 384:nTMiFavqMg3sNO8TUNTUlImkrOgU+TYTzz4foY93NXU0+g/sRYV/Vw1mR67iCrNP:T3Fayv3jwg277YU0+0sRYk1mc7nR
TLSH
T13FC24C36EC58C9BBEDEA8FD9EB0A7A07DEE00167C59C49D4D6D81E0E00D719E170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 adde50c119a5e55613a8a1820d8595ffc1c5fd7bd6f51840fe4708c48453460f
MD5 146bc9928537bcc93f3c3d0ee123805c
SHA1 08d02204dc1736c7a16558e01981f740a67e8a37
SHA512 41f0b7dd8b1e38d3a45125f0e8aa9c8ef6e4b15c30228255b18a5331cd305a92661564f4918131e0d37742699f63317a02e00c5c200d48a0402850ae07401e29
SSDEEP 384:nfMiFavqMg3sNg8TUNTUlImkrOgU+ZgMrz4foY93NXU0+g6XlNhdRYV/Vw1mR67R:f3Fayv3twg2AjYU0+plNhdRYk1mc7nR
TLSH
T13DC24B36EC58D9ABEDEA8FD5EB0A7A03DEE01197C58C49D4DAD41E0E00D71AE170B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a1ba85da238b7e1d0317d16d735fa3ab7486b860d0fc9dd2ab0d48fc651f1bec
MD5 eeae170e5c827ef6461d5a2f7c583062
SHA1 1c2cbf52904eed7b5a426192bcb81edfae8135dd
SHA512 dd148f5d828434c6f2c5392ffb81ca09703f179115924c981f34c9d3a31640a1cab4d9d92452e1de4cbf4ce02de12903b1a1c9eec751f2e0980e56f3669a2227
SSDEEP 384:nzMiFJjccCs+Bt0S3isNU8TUNTUlI4kmOgU+DjCqz4foY93NXU0+g6XlNVdp09+d:z3FJccQCdwgbhyYU0+plNVdp0oky3r
TLSH
T1BBC25B36EC64CDBBEDE78F89B75A7643AEE01163858C19D4D9C95E0E00871EE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 f3ebb08d5cefb9befa7d418da50dc00af734a803d975b7efdb83adaf8980b2cb
MD5 89e5d7a349c9954662f6618017bc2e4d
SHA1 763f3096671b1943dded761d3097ad2337b1319f
SHA512 80c12f00ecbadb03b66e4be76e3bfdf991cae8429af087526a3b06bbc80b301511511b2312b6a0e0fe87064f0b19dca723fbd1203b747934bd210466a9baf8aa
SSDEEP 384:nzXiFejccCs+Bt0S39usNiu8TUNTUlI4AmOgU+bLCqzZfnB293NXU0+g6XlNZdpB:zSFIccQATuwg/9+2U0+plNZdp0oky3r
TLSH
T1F6E2C3F598D3897AE99E4B47A33D6E029AFCD153B5881994FBC40E0DCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 7b619923c1781c7afd18fcdb0e15d99fe839215aab2d69a22e0c20282f9933a6
MD5 e813936cdf18f29b0cf7c48f6a4e0c74
SHA1 203004dfbd73451779d7948a0e707af9461be99f
SHA512 983665385d09b0614d9aec390d2535513c65ac3c9cf365d4e8f3430d2fba4e73419d1fa7ad9ae9b273c8b39a1a0fe5fd4f80bbc79634809ddf9596d8d1468e34
SSDEEP 384:nzXiFOjccCs+Bt0S39fsN8u8TUNTUlI4AmOgU+YLCqzZfn0293NXU0+g6XlNxdpB:zSF4ccQNBuwg/Y72U0+plNxdp0oky3r
TLSH
T1AEE2C3F598D3897AE89E4B47A37D6E029AFCD153B5881994FBC40E0DCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c031bbe641cd3427527fb9b9c448087bbceec3971ca91298900a632c96f3ddf1
MD5 a272f3cff194579c39645be7a0f2395d
SHA1 ccef2f3a458d92f32a3a7e339a3bfe5c1265f8e7
SHA512 e581212293e7d9be7f59ce3234a65ee125752ba375a2445b11074c3cd0d16477d2ad9fa92393323ba274ddf9db60803abd1d340e3090686dbaaa1eed0a00e945
SSDEEP 384:n9MiFJjccCs+Bt0S3u3sNU8TUNTUlI4kmOgU+QjCqz4foY93NXU0+g6XlNVdp092:93FJccQO3dwgbYyYU0+plNVdp0oky3r
TLSH
T1B4C25B36EC64CDBBEDE78F89B75A7643AEE01163858C19D4D9C95E0E00871EE170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 4002d27d6b47f1eb5f5a643756338ee441c483b216e1f7593695a52229829804
MD5 893bf272818de90484525308f9155f5c
SHA1 65c68fd61c6ed0b4470b328d74aae133f129ea1e
SHA512 b21d817692e0824aba3ca1096876998eb93e9a158b5d265c7e547d10ed0e8608f86e831d05f9160853d0b1e38c5bf4e6ed8a870b3966f206231cbecd1b8c1047
SSDEEP 384:nzXiFajccCs+Bt0S39usNiu8TUNTUlI4AmOgU+VLCqzZfnBY93NXU0+g6XlNvdpB:zSFUccQATuwg/P+YU0+plNvdp0oky3r
TLSH
T1CBE2C3F598D7897AE99E4B47A33D6E029AFCD153B5881994FBC40E0DCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 3a6c87bfaf6ed843f74fab927954ade73c74a06142839c1d222aacc8e0be108d
MD5 2b39907e812245683563b47d5c7af6b2
SHA1 0a05eb5334d19a53fa3320c120706080c0f546a2
SHA512 d43f595fc2815f31754341c1e3c2dd507e78259d8dc1f8d284babc2dd6f5e4ffaafd29d097e1545a57bbeddcf837a5b18f36a142fc8e831d994289977174825e
SSDEEP 384:nzXiFJjccCs+Bt0S39GsNU8TUNTUlI4kmOgU+DLCqz4foY93NXU0+g6XlN7dp092:zSFJccQIdwgbpyYU0+plN7dp0oky3r
TLSH
T11FE2C4F598D7897AE99E4B47633E6E029AFCD153B5881994FBC40E0DCC860BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4cf4aa704415be93b11453aed64730c52b688cb382cbdffaef6a8ab3e34df91f
MD5 9778d67c804b997de1d6d65f1df36788
SHA1 951b51d60c1b44d47af09416304839422fc9224b
SHA512 ead4cfd164bd1bca55c7b80b375c9dfecc75f09ed77d73f8c0454e1359761f93f82435610191cab882c00e8750d1384990bd5bdfa170cb1996f790fd510c281f
TLSH
T185E00202D200009FD13DA33400C31F302EE28420177302495630056C3C733403B24780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8dd51e43b37ea098006c227232cddc1303eb77b53b995bfbd66a862eef595225
MD5 d87b22452eeae1b17f04357c6b6af517
SHA1 49a45e6b6d2ec5cff03a12f4ab467a09d30557b0
SHA512 3e58a7ff69b720c73abe22801c77a51fb22ced39dbd49fca532cb27788ddd3ccaff37c04b3cfea7ce6da8b4cb431b888ff2973e47d2e31a038b5aeeb3d2b2ca4
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5957ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5957ab.TMP
Size 392B
SHA256 bacac781f2bc6c6c865648201c77b8d29936f31b88c7fddd8e9c09ce04572f95
MD5 6a6fdeabb89372ea7bf8d51b556c8af2
SHA1 ee5585bc258ce386cbc2775170b12a92ec7d199a
SHA512 b537c0b38cc250cdef5e3148414f90208018b83af08cad0b7c5f58a85af1c3c46fa7a35e1dfe2808217b1e2b94792c81362679586e89a800e717874e399ac79c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 5f02319376547f39fbc935eeaf3ee10db8f464055deb68f304b21130e2b76620
MD5 b0d3a8a4989e50bdc108e9c02ad1c00e
SHA1 394517405da7f3cd5b0c66134bad5f2185222984
SHA512 fb4d5a6d817c8cca1ba3d255b704f56e91b56db1774fb2f3ad1134b143fde3fc1ec1591dd4054eead5699a7009f2fce3a81ce81e95d5e514fa7b8b63983b3b86
TLSH
T1B64161D00C3E66C1D4BD0A7E708B38FC95D8CA2AF5A0347D2854EA84463951D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 c8b780b0ed32b6a7b78296d7cfc9e21cf2a50ba064dfdf3bd349a98ff8b492de
MD5 15a5865e5cda44cab9a55fac267fa858
SHA1 eeed38402d9f2e562ec0056e11d6daf89bb28fff
SHA512 bc1f75964b8f688f17b193e51bc24728cbcbd45a6f284546b1b55a9bd56e91363d737bd2afb57835ed81197e7097d7b7163d6db296846cdc1e0992dea68d4cb7
TLSH
T182413FE05C3D66C1D4BD0A7E709B38FC95D8CA2AF5A0347E2864EA84463A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 0587487771567cc5d8b4ae57dd81dffaa758f1a63af4ba0249ef367f663c05f1
MD5 392d6d28c53c21c761e1793d220e9c55
SHA1 c00d48a027c6e325cc1282998cdacb8911d9cf65
SHA512 38d63be51de8bc075539c1e2cc7178915514c9b7f0b9eeb1c2634894e477643ed0f8d917efd8bbf0364c10d55086e2c5088a577bdbe972201165029806dfeec3
TLSH
T1724173D14C3E66D1D4BC0E7EB08B78FCD4D8C62AF5A4347E2C68EA84463A91D648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 01bdd428fcbc4cfe1c07d592d6ecddc2071460e05b6220be3a356447a7d7cfac
MD5 3da4a6d12fa036b070a1a7868013aefe
SHA1 666f3696d7853942e19fceb48a455403da8ac937
SHA512 c6f8313851bc392a8779076efa4ad81a7b378dda56e81de468b96059ee23850fe672b3593cdb1a46212b94337cb7b78f5c3f90958a30d2585d6229f085cd7d8a
TLSH
T1054141E04C3D66D1D4BD0ABFB48B34FC85DCD729F564347D2864EA944A7A61D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 61fbce4093a0f729d767f514d9d069fcfc9b488389e2d4977ca9d0b6129af3e8
MD5 f84ee992318c36793007d2d46624c901
SHA1 9da1b163d079d25b5ba22549ef9619f80d2ad8c1
SHA512 6b6dbe04846b346c5284bbd946a500ee496e9abf85cbdff5b61ece9f5fbaf6d0283524ebc42b7c66152a1d15999cecaf6a98b0e75a8f42282dd9e4ec6f9229ac
TLSH
T1E34131E14C3D6AC1D4BD0ABE749B34FC95DCC729F5A0343D2C64EA84467961D248443F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f02f8d387a5eac3e2dcb7356364198c430b51557043825edd66bf90e996f9b28
MD5 16502c4c5a91136841cd7ec2186889f9
SHA1 471c3f8a7441013fb74c013c67726bde2286c5c6
SHA512 f4a4ffa43cf5dace3bf23e09e936a71485ca0e1526e9a6a224cc7a968467c9b16a605e3f4d3c209d5fed0c1096defd2e71be2978f76b8e85525d2053aa3d40dc
TLSH
T19141E998BAE91148F3B76E56ABB6A86D487FBD332F06949D00510D4E0663B40DCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download

b242bd1bb4a25207b7836e6099bf4764-{87A94AB0-E370-4cde-98D3-ACC110C5967D}

Path C:\Users\Admin\AppData\Local\Temp\b242bd1bb4a25207b7836e6099bf4764-{87A94AB0-E370-4cde-98D3-ACC110C5967D}
Size 61B
SHA256 2fa5cf4d31762efeea71b351123941584de31fc4eb6ba7a35b35d7f2a2cfc9e3
MD5 5f8805bd666c1f474c01292a7f0d8f2a
SHA1 327b8095224ac04aedfc722c87ec18915e9d9525
SHA512 50795962a2e85792816bdfe7742ed52910c335c90a9b6f9e3dbb16870ef84435847c704e7ca1f14002898b14a1bdac525edf3faf6881ffabc06b0e29a17d6cb4
TLSH
T17DA022ACC2E28C2C0BA0C32380202A0A3000C0023030C0088CB00033FA808080C80008
MD5 SHA1 SHA512 TLSH

Submit Download

tsetup-x64.6.7.6.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-AK2VM.tmp\tsetup-x64.6.7.6.tmp
Size 3.3MB
SHA256 e32dd169fc80b6224009baac2c4045fdc6c371d0d3955b683823f87f9923041f
MD5 24607b1d13c1944ca2007a7769683502
SHA1 38953a13265c51b7058afa5a453954d4af5b913a
SHA512 e161dfe7e3545134b3171d3879e95935761ea4db45eedc286df1746bc7fda23522715b111083b94d6cdf5bcf54639051566e198214914500d37dc8661fd34969
SSDEEP 49152:kuAKxvISKIJhNRQSJ3MhjxIXhEzAWig8l1sXyKFz0ool5+UKLz333j:kuAK6XMXhKAWwLsXa2333
TLSH
T104F55C23F34D603EF06A1A399D379658583B7A606916CC5797FC3A4C8F361802E3A75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telegram.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
Size 1KB
SHA256 843e1e49b925e1962cb16c067cc7331e80886f750e87611691ebbaa8deccb74b
MD5 9f5d626a4517d57d4d05f0b7341623b5
SHA1 a45f0ae7334cff6ac5dc222817c12d362e0b65f1
SHA512 9bb54712f0706fca72891bc71bdbc965b93be7e36b8fff37ac485e3cd0dfc3841df0d3e3707782e7b3172cc590e9bda557c54198da7616a4f2efdfee92a301e1
TLSH
T1B71100446BED4F29F2E2893407F71360C632F800B646D70F4054811C5C14980DBA8B1A
MD5 SHA1 SHA512 TLSH

Submit Download

Telegram.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
Size 1KB
SHA256 28addac48bf4d171edda65f73df1dcf594cb68b86108f974058fa3dc6b9de59d
MD5 5d22cf4f622d6da4d713b9d26336262c
SHA1 8c02520ccd4ac1a761438ad85711f243748608f7
SHA512 7beabf7081ccdb1e1c1dff71b49f8dc066197c009daaace1695748318ae86b5b1feb0b776892f14201901703e54b2e6fcbe8185c81f14e7697117ddc44a99f83
TLSH
T1AB21E1457BDDAB3AF2F689314BB32364C633F841B646C64F4068811C6D18980DBA8F1B
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usertag

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\usertag
Size 8B
SHA256 6d9f501f4f7cefdd3091a0dca07bcddde5bcb33e52d047710f62fae4470e9b43
MD5 85883bd41fa1fc572ebe5aeb1040cd44
SHA1 0a34c8cc257b85a6f472b4f850947c717afdf062
SHA512 f463eac870a99df4013846ba6b7c849bf095655db25bb9771be0c69e01e8260b32d3660c903546a72743e9aff704b5536769adaceda3d4b0cc15faaa031007f6
MD5 SHA1 SHA512

Submit Download

tsetup-x64.6.7.6.exe

Path C:\Users\Admin\Downloads\tsetup-x64.6.7.6.exe
Size 48.9MB
SHA256 8b77909856093627788a8dca744e48a30fa3f28db2cec80dc1c72cebf83f40b5
MD5 afd6cd3c5648ec2b897b65fd589826c2
SHA1 50df3bdfb43a99e2d240e44c5bf910a7451a8453
SHA512 4f73cb5276348eeefd11a6e032216ce02786fc5ec9402aaa38fadd1b4ed36befd45967edaf609da6436ff00af517d7cedeb34497a27456d9206d69d3b0cd08b8
SSDEEP 786432:99Zt9kwnpg6fZIMjqVtQnuEbNEf6plFYgO+Sm7iHt5ZpAnScL6HREF1rR+xq:rf9kwnyMjhuYq6pcgO+V7qtMCU1roM
TLSH
T157B73322F2DF943DE86D4A3345A3A26595FFB71298237D5AC5F544BCCF260602D3E20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-218-0x0000023488ED0000-0x0000023488FFB000-memory.dmp

Download

memory/2696-755-0x0000000000270000-0x0000000000348000-memory.dmp

Download

memory/2696-673-0x0000000000270000-0x0000000000348000-memory.dmp

Download

memory/2696-634-0x0000000000270000-0x0000000000348000-memory.dmp

Download

memory/3176-892-0x000001EE84730000-0x000001EE8485B000-memory.dmp

Download

memory/4428-831-0x0000020DB67E0000-0x0000020DB690B000-memory.dmp

Download

memory/4428-931-0x0000020DB67E0000-0x0000020DB690B000-memory.dmp

Download

memory/5684-754-0x0000000000EE0000-0x000000000123F000-memory.dmp

Download

memory/5684-715-0x0000000000EE0000-0x000000000123F000-memory.dmp

Download

memory/5684-702-0x0000000000EE0000-0x000000000123F000-memory.dmp

Download

memory/5684-675-0x0000000000EE0000-0x000000000123F000-memory.dmp

Download