471b70bb147160ad5ee934d6200ae1aedba9d8b9e1bf9a8dbb0f1ccc2439aa51

Analysis

user interaction
yes
max time kernel
253s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
67.html
Size 36KB
Sample261027-vjdpaaeb26
SHA256 471b70bb147160ad5ee934d6200ae1aedba9d8b9e1bf9a8dbb0f1ccc2439aa51
MD5 738ad8589f9a1897110ced08bca9e66e
SHA1 1de769abf5e74435a1e2bdd45062c10834e46e3c
SHA512 afb33375c2278164f7d1d3b2b9e94a975200e7c599af9a781459baa56d86f69b7f956c74189a0f7e78f19ed0fbf15a0643abe29cb37fea3ea3dfe1eb34ae29be
SSDEEP 768:UN9g9FLV/k58GP2zTzTzTBT/TZT4TNToTJT9TXTeTGTuTv8TKT7T0T4TXjTaTCTu:kmFLVc58GPWPX9LtkhEFZTC6awW/4Mja
TLSH
T1B9F252DB53F0C62D689355EDEBBF2131B921D04B6244A940B65C4335078BDDAFCABE88
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
132	2748	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Telegram.exe

Executes dropped EXE 3 IoCs

pid	Process
5028	td-setup-win-x64-7.3.3.exe
868	td-setup-win-x64-7.3.3.tmp
372	Telegram.exe

Loads dropped DLL 1 IoCs

pid	Process
372	Telegram.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Telegram.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Telegram.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Telegram.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	td-setup-win-x64-7.3.3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	td-setup-win-x64-7.3.3.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2748	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5028-475-0x0000000000AD0000-0x0000000000BB2000-memory.dmp	innosetup
behavioral1/memory/5028-514-0x0000000000AD0000-0x0000000000BB2000-memory.dmp	innosetup
behavioral1/memory/5028-562-0x0000000000AD0000-0x0000000000BB2000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe

Modifies registry class 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\shell\open\command	Telegram.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{04C1F43A-9BD1-4BFD-B592-EC5814C5D9FB}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\ = "URL:Telegram Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\URL Protocol	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\URL Protocol	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\shell\open\command	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe\" -- \"%1\""	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\URL Protocol	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\ = "URL:Ton Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\DefaultIcon	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\ton\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tg\DefaultIcon	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\shell	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.ton\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\shell\open	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tonsite\shell\open\command	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\ = "URL:TonSite Link"	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tonsite\shell\open	Telegram.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Roaming\\Telegram Desktop\\Telegram.exe,1\""	Telegram.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\tdesktop.tg\shell	Telegram.exe

Modifies system certificate store 2 TTPs 2 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	Telegram.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	Telegram.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
372	Telegram.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe
868	td-setup-win-x64-7.3.3.tmp
868	td-setup-win-x64-7.3.3.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
372	Telegram.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
868	td-setup-win-x64-7.3.3.tmp
372	Telegram.exe
372	Telegram.exe
372	Telegram.exe
372	Telegram.exe

Suspicious use of SendNotifyMessage 36 IoCs

pid	Process
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
372	Telegram.exe
372	Telegram.exe
372	Telegram.exe
372	Telegram.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
372	Telegram.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 860 wrote to memory of 2924	860	msedge.exe	85
PID 860 wrote to memory of 2748	860	msedge.exe	86
PID 860 wrote to memory of 1928	860	msedge.exe	87
PID 860 wrote to memory of 1928	860	msedge.exe	87
PID 860 wrote to memory of 1928	860	msedge.exe	87
PID 860 wrote to memory of 4640	860	msedge.exe	88
PID 860 wrote to memory of 4640	860	msedge.exe	88
PID 860 wrote to memory of 3472	860	msedge.exe	90
PID 860 wrote to memory of 4428	860	msedge.exe	91
PID 860 wrote to memory of 3472	860	msedge.exe	90
PID 860 wrote to memory of 3472	860	msedge.exe	90
PID 860 wrote to memory of 4428	860	msedge.exe	91
PID 860 wrote to memory of 4428	860	msedge.exe	91
PID 860 wrote to memory of 4876	860	msedge.exe	92
PID 860 wrote to memory of 4876	860	msedge.exe	92
PID 860 wrote to memory of 4876	860	msedge.exe	92
PID 860 wrote to memory of 3112	860	msedge.exe	93
PID 860 wrote to memory of 3112	860	msedge.exe	93
PID 860 wrote to memory of 3112	860	msedge.exe	93
PID 860 wrote to memory of 396	860	msedge.exe	97
PID 860 wrote to memory of 5008	860	msedge.exe	98
PID 860 wrote to memory of 396	860	msedge.exe	97
PID 860 wrote to memory of 5008	860	msedge.exe	98
PID 860 wrote to memory of 2092	860	msedge.exe	100
PID 860 wrote to memory of 4304	860	msedge.exe	108
PID 860 wrote to memory of 4304	860	msedge.exe	108
PID 860 wrote to memory of 4304	860	msedge.exe	108
PID 860 wrote to memory of 2440	860	msedge.exe	109
PID 860 wrote to memory of 2440	860	msedge.exe	109
PID 860 wrote to memory of 2440	860	msedge.exe	109
PID 860 wrote to memory of 2992	860	msedge.exe	110
PID 860 wrote to memory of 2992	860	msedge.exe	110
PID 860 wrote to memory of 2992	860	msedge.exe	110
PID 860 wrote to memory of 4508	860	msedge.exe	111
PID 860 wrote to memory of 4508	860	msedge.exe	111
PID 860 wrote to memory of 4508	860	msedge.exe	111
PID 860 wrote to memory of 4680	860	msedge.exe	113
PID 860 wrote to memory of 4680	860	msedge.exe	113
PID 860 wrote to memory of 4680	860	msedge.exe	113
PID 860 wrote to memory of 1316	860	msedge.exe	114
PID 860 wrote to memory of 1316	860	msedge.exe	114
PID 860 wrote to memory of 1316	860	msedge.exe	114
PID 860 wrote to memory of 3020	860	msedge.exe	115
PID 860 wrote to memory of 4516	860	msedge.exe	116
PID 860 wrote to memory of 2664	860	msedge.exe	117
PID 860 wrote to memory of 2588	860	msedge.exe	119
PID 860 wrote to memory of 2588	860	msedge.exe	119
PID 860 wrote to memory of 2588	860	msedge.exe	119
PID 860 wrote to memory of 1992	860	msedge.exe	120
PID 860 wrote to memory of 1992	860	msedge.exe	120
PID 860 wrote to memory of 1992	860	msedge.exe	120
PID 860 wrote to memory of 4264	860	msedge.exe	121
PID 860 wrote to memory of 4264	860	msedge.exe	121
PID 860 wrote to memory of 4264	860	msedge.exe	121
PID 860 wrote to memory of 4760	860	msedge.exe	122
PID 860 wrote to memory of 4760	860	msedge.exe	122
PID 860 wrote to memory of 2308	860	msedge.exe	123
PID 860 wrote to memory of 2308	860	msedge.exe	123
PID 860 wrote to memory of 312	860	msedge.exe	124
PID 860 wrote to memory of 312	860	msedge.exe	124
PID 860 wrote to memory of 2520	860	msedge.exe	125
PID 860 wrote to memory of 4160	860	msedge.exe	126
PID 860 wrote to memory of 4160	860	msedge.exe	126
PID 860 wrote to memory of 4160	860	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\67.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff7337c188,0x7fff7337c194,0x7fff7337c1a0
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,8489607679190852295,16794532986935900949,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,5682847737193903631,2609651180343193291,262144 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,2666984028996792207,5402377010410459820,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7174856743068826468,9660861217046517564,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,2442896393574834500,13907724740716528718,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12788932549461663099,931820658703338197,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17591347457342441473,5701213981559334773,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15503946814373829749,1510849397072474873,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,10780066180624702283,8320565487615077367,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14679613021496079985,601319667817522652,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,14679613021496079985,601319667817522652,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4240,i,5744279519906114841,18011942762760553173,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5900,i,10668340938670757613,14613048009284368617,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3528,i,1006690138196138982,2093666583814027219,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4456,i,11626870655022439616,6883569945380049811,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6488,i,11865469013441614420,11708758107730931208,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6264,i,3087272529752651211,6475854442071996938,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,6138724130686316220,14445309515619784670,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,15884809036556380668,6877802526793745763,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,15743172223009074937,4374801456253076666,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6800,i,9363090412087073308,16519486492678104239,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6804,i,7426852373023871031,17491716623847341764,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6736,i,6147649386006917174,5151604340111985998,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,13347071514209053887,1902074354223891815,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,16942917137203627131,3442412712920032158,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12329597798961085850,12161264199912913866,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5200,i,937179595321913165,14226089182258059838,262144 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5464,i,5284783093961473332,3797822217632986578,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5608,i,3394694802970285485,3040504473502486517,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,15183168240827523499,13490110006184475862,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6300,i,1522104869922933032,3221886713749773158,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7372,i,4438822217173488312,17305213542352975920,2097152 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,171854836340605958,9838435546086239697,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:8
  2⤵
  PID:4548
- C:\Users\Admin\Downloads\td-setup-win-x64-7.3.3.exe
  "C:\Users\Admin\Downloads\td-setup-win-x64-7.3.3.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5028
- - C:\Users\Admin\AppData\Local\Temp\is-LBHIM.tmp\td-setup-win-x64-7.3.3.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-LBHIM.tmp\td-setup-win-x64-7.3.3.tmp" /SL5="$A0210,62010997,864256,C:\Users\Admin\Downloads\td-setup-win-x64-7.3.3.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:868
  - - C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
      "C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops desktop.ini file(s)
      Reads the TCP/IP host and domain name from the registry
      Enumerates system info in registry
      Modifies registry class
      Modifies system certificate store
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7688,i,8234141598456130857,4507491290173968601,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=7684 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,14213988871375472406,2658354024293636495,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,17904892138574188571,1783092542909524527,524288 --field-trial-handle=2224,i,12781040281353639510,14830381963789351108,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

012925f7-e439-4444-9a85-d1f27263d32e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\012925f7-e439-4444-9a85-d1f27263d32e.tmp
Size 26KB
SHA256 f3a3800e3d16f46cc6601e466f8f233987dff57b9d001dc06d6975b84364348d
MD5 10ea706daa5ac8d006939457ac45fd52
SHA1 3c0a462991d59b5c52bc84a25b72297b26c97be3
SHA512 f063b5200620703d0ac88552af928950f34dc4cdfd7dbe3985ae2e3862e0cb2fdc4f779be5eecfbb30b59ffff61f95200fe7303cf6ec0477667aef80a9a12106
SSDEEP 384:9iFpQkUSv4HsN+8TUNTUlIRfLxMpbphHh//WIC1JEvaTZc2HLIIlY:0FLwrwgGB/8EvaTZc2HLLq
TLSH
T1B2C207F258D7983ADAAE9B53A37E3D039E7CC063F5845A60B788591CCD960BFD206811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e5d7b72-35d2-4a9a-8e07-396175881770.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0e5d7b72-35d2-4a9a-8e07-396175881770.tmp
Size 8KB
SHA256 2149bdcd13f889784c1338520db817efaf3c90144860c7c2cd649949583c0797
MD5 39a90604431894a00bdc0a26a0f92bec
SHA1 0d423cb6fbc261fad63fd7b722942ca02bd1d329
SHA512 fd48f137e13836a0b697e54c7cbb3c48776251558cdb2116603ffaa324e16d3fb795731ca99e10e66b3201aed3aa8b2523754c591be3a4edcd55d9a25c2a7b36
SSDEEP 96:KqONkLQsjpfbUmjH5ih/cIPURHl8h4otop5FaDlBKP4v+Y1xf//ojdhxlDeYu7MR:BONz6JUm0QmiUyGbso//WA7MBC+PU6
TLSH
T1D802F838AC68BCBB8EF39E45F04737239FA4107BA6951F80DAE82E2D01D755C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

712fa9d4-73bb-4060-b132-8e72ce3bfb72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\712fa9d4-73bb-4060-b132-8e72ce3bfb72.tmp
Size 26KB
SHA256 8fc9fa1e03a9a045f91ae3cbf5455feb657d5e7bc4f21df0233c6037c084f0cc
MD5 3322004bf2fa2679d57fb287b889873c
SHA1 e3905238a787b49ffc1fc16df99c6eece658638b
SHA512 fd366d182f9a1dc4ec0c87d2ccb4ef7d40fc9356149297e2fe90d6555b0742d7357b5d95aa1739efa6c511039eb1e06b597458535d28346e9f0dc03cb06415c3
SSDEEP 384:9iFzQkUSv4zsNW8TUNTUlIlraxMpbxjjh//WIC1hEvaTZc2HLIIlY:0FdETwgzF/2EvaTZc2HLLq
TLSH
T157C207F258D7983ADAAE9B53A33E3D038E7CC063F5845A50B7895A1CCD960BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7533425a-ba42-483d-9e7a-2e6288833324.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7533425a-ba42-483d-9e7a-2e6288833324.tmp
Size 26KB
SHA256 ff6fc3fec655a108e3f6a219f7969e9f29cd471d703ab222fd079b3574f6df6b
MD5 3634253c8f99b4ec1e70f0ba00c799b5
SHA1 d365074877ee48f3e13c5c2635d08c5ed08ec86e
SHA512 c6145601832f0d08eafffea179a7ee02a3ca59b6c22647dbe53954a37043d7a2dbab92857e39f392c1f4d3c676d84c2d8362d93ee2170b1c07ec61a684418660
SSDEEP 384:9iFAQkUSv4ssN+8TUNTUlIRfLxMpbvhHh//WIC1bEvaTZc2HLIIlY:0Fo7rwgwB/CEvaTZc2HLLq
TLSH
T16FC217F258D7983ADAAE8753B37E3D039E7CC063F5845A50B788591CCD960BFD206811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fad2c15-2ab8-45ba-b283-22017782f382.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fad2c15-2ab8-45ba-b283-22017782f382.tmp
Size 8KB
SHA256 eb093461c8151781059bed9bce819f51c42e3516d30f839afaf16590d016f013
MD5 637aefcffed1ad71efba4fa840f52346
SHA1 c92619ee1922abc09bc3eab539941350460aea62
SHA512 0a1af69eecc199b695c0f8ed814bb303045656f93c6d64d4d6238d95764391f37bdf277bea4adc3fc3f6af1dd0dde1ceb8b828451e276c8654dc944ae2a946c1
SSDEEP 192:zON/6JUtQmiUyPbVo//WA7C1Gez3NxrqjU6:zON/6+r8Vo//WIC1lEU6
TLSH
T11C12FA35A868AC7B5EE3E555F04736239F744167D7896F90DADC3B2C02EB49C530B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

916b7d88-e986-4f53-8a39-fa28453f6e08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\916b7d88-e986-4f53-8a39-fa28453f6e08.tmp
Size 18KB
SHA256 fbcb3f49eebc876090e274960d52abf57ae4f0d113a5724cbf242b2d33333fe9
MD5 9c41d1684bd7d1bbae92d0beb4b6af39
SHA1 c30a6fbbd710974151f507aa921db2c04a4940d4
SHA512 be0703aa47374ea4546d48982d649458518ec8096baefe0e76538393ac9a739cf91af93788d37b75a0bf29690ad496f82986707bbdc50d4fa571fd7c2b209a27
SSDEEP 384:8QkUSv0sNlUWaxMpbxpnh//WIC13EvaTZc2HLIIlY:80Oh/KEvaTZc2HLLq
TLSH
T194827E31A879AC7B4EE7D561F04B36139F748067D6C85F60DADDA72C02DA198230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

0fca90c1-b2b7-4b0c-9809-006d7274b5e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fca90c1-b2b7-4b0c-9809-006d7274b5e0.tmp
Size 9KB
SHA256 fc4d5f9330c44eff168a75f21ae8f73c1aeb6cc34e6c39198fdeed5d2519dab0
MD5 6e4c14582b1a6153931460f666aaae52
SHA1 85b737996283f6c5345b158d6f6b182cf6d16e87
SHA512 7cee4481850ec36103b9c8501168fabdd8529b8fa6de14ff0fe181fd31168b7a2d3da37ff3a3dd940ec53ff62961690fdf59e36b22be7f3393101fcb4445e55e
SSDEEP 192:sxZ4RjWg/fdszpIdpdfHW6+WNGY36WYR+TIgrJ:sxZ40g/fdszi1HbGXto9
TLSH
T14922C9116E38A97B4CCBD20EBA25BF53D6F9503251D41E58FAFC961C05E66DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155ef4bb-5a36-4a94-81b9-1df67a255590.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\155ef4bb-5a36-4a94-81b9-1df67a255590.tmp
Size 10KB
SHA256 efa80c3aae1aadf10ad4d3debf91744d030d3f5e73f803d2fd5a71bab40c34b6
MD5 45cbf0a1e2b412fd81f111c3bf7d1134
SHA1 62f68351153842e4cab526ae17b27375732c13bf
SHA512 958de7792f10d737cec21bd417484f74ab9822f74f78816d9ec0ee25181fdd8878dd5439840a1be8ee26dc39852eba749681dd9fe510f24b5a196a696ade5719
SSDEEP 192:sxZ4RjWg/fdslpIdpd7sHW6+WNGY36ByR+TIg5uJ:sxZ40g/fdsliCHbGXwoc
TLSH
T17C22C9516E28697B8CCBD20DBA15BF53E6F9503291D01E58FAFCD61C05E66CD620B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

501353a7-4043-4dc5-a842-ea6464a3168c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\501353a7-4043-4dc5-a842-ea6464a3168c.tmp
Size 10KB
SHA256 92c68c8eca7a8a9fcb456ea2f1dd455808cac1b8b25aff938dfaffe48fda4a21
MD5 e9abcff17b6f922e37cb4a61477d6b30
SHA1 163e0a1469913e47d8afcc66252f5081ddf37b4f
SHA512 c16b4aa54a7d6817d915db83a6c5eacdae13736a4071f3f55b8b1dd8147c0db5188e2876d83b6aaf6b2b7ac694e203fb5a5abe8f17a3950bfeec22caef0f6ab3
SSDEEP 192:sxZ4RjWg/fdsDpIdpdfHW6+WNGY36WYR+TIg58J:sxZ40g/fdsDi1HbGXtou
TLSH
T18322C9116E38697B4CCBD20EBA15BF53D6F9503291D41E98FAFC961C05E66CD520B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54192a62-a52e-46af-ae2f-5469fc943113.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54192a62-a52e-46af-ae2f-5469fc943113.tmp
Size 10KB
SHA256 d996bb47f52eac120b9f7164a390433a7183a73dcd9123e48229d3e7b4963b36
MD5 67112666edabcf09ade9dc5df99499d4
SHA1 878b4592cad3e56c698e99cacb88fd391c5bb538
SHA512 a49f0921cb99ac4285664fe43fa46b4096fe8eabdcc9a97cdae3a01def3a62b3b3fec108fac450b4c745bf119a83a8445c5995b30b8afaa008a95c79a32e2a69
SSDEEP 192:sxZ4Rjng/fdslpIdpH7YHW6+WNcRU/Y361l3+TIg5uJ:sxZ4tg/fdslikHb9/Xroc
TLSH
T13632E9526E38697B8CCBD20DBA15BF63E6F9503291D01E54BAFC9A1C05E76CD620B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77a290fd-061b-4e33-95ba-18b467058f5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77a290fd-061b-4e33-95ba-18b467058f5b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

800eb095-4e81-4881-b41e-04af8b748f37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\800eb095-4e81-4881-b41e-04af8b748f37.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94e1625c-e53e-4bf0-b054-7054f063e4c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\94e1625c-e53e-4bf0-b054-7054f063e4c8.tmp
Size 27KB
SHA256 97cdd72780bf205bfa57b057ce93feb2739153fd901e8b5c2c91f3088f5c6436
MD5 3be52dc8f7089502ccdd0aa7c67b42b7
SHA1 a676f6a551b7e3cfc5fb412affdae53757da9ceb
SHA512 25ee6f0d6b16c0fcb5da4f4a01e702e5964b8d2e90c85282fb4b4bb8bf9342f0ba9a138e3f100f5f48bdc3637cefffd1a90701e068ecd4090be24a14bb754fb8
SSDEEP 768:wmKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/DrokC:wmKlm7QWvUYe0u1ja8/L/E/wkC
TLSH
T184C2FB3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d30e36e414fdf7733ef2548c7b4d7221160de8dbde888105fa1e64c1048b2f97
MD5 c935217ec176d6b95af879f8aed0d996
SHA1 2445d81977af9f4fb6ef521f4361cb12f168ab7d
SHA512 5d21cb59374b44d96f63772578171bbf02f300dc84a3ef290622afe9bd93f226e13183fe132520647fb1859ce851dde2a2d1f16bfde6d50eb5afa39e0e16c061
TLSH
T1EEE0268509DAC32FB20C7487816C938DD385265F97C0AA5E1708CAC6724B845B692F90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7136b87c8f899dc64ddd63825d3a625d6e98d90012ad5db7b79ccb504f19081a
MD5 edd700ca793089f6dde062a936690544
SHA1 dbd431416f5845522da847fc8393676c71539ab2
SHA512 1b5c6512a9f3890a70c299c80a0d38bbfc707c7af114b49afdbd3615d1a32672691436f2b78b0df9e08a3149d0308501be0b358aa84d0302bdd2082e735ccf22
TLSH
T1CDE020C804C4C31F511CB44711DC670CD382262A97C46A1F6704CE4CB107540E6D5BD4
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 30KB
SHA256 d4fed893bd2fe8d191ee735cfd4fdb64a9f32b1707a26baae34c3dde9ab25c3a
MD5 61832711e404f73af8debd4796c33faa
SHA1 cf19b7ff0b9bab5aad600de492ba3accee91dc0f
SHA512 48fc778cf0c79e786e6c3437042bb9f7d99ffbc8bf2afaf1c8ef99be5f1b7b2153c4a2260393cf88dc7b08464398663fcb1c6f9c7d94d1bdadde0824e116f87e
SSDEEP 768:jiGepSwRRPBxHxwhNrV0BqsXjZFeBDwYanql7odVouytOJE:jiQwPp5xwrRHsXjWBkpo4VYOW
TLSH
T183D2F10EB730AE6730155CC07AACAE1E090C70875EF50F2C9DA1E927717C8E6A75E61B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 80KB
SHA256 39595a1806156cfcadf3cc4e20c5c3f3eec721386a0551790a15f025ba9402bd
MD5 14e39be019da848a73da7658165674cb
SHA1 e016473c4189a8cc3dbff754a48b3e42d68af25a
SHA512 828a383de549871aa80ec960a7e371ef47da96d01ebb9628d1484ceed9eb698aec5109b3de0b24ff8000610a2c2d633616c9fd28d380656fecbaa930cffed029
SSDEEP 1536:kAXTJvOGTDbA80pK0Mdq3wUAVa6BGS8EE/c0Psh6lufc4Ap7QgqHM7zxFX3xzOEm:kAXdJDn3QRoag8pcM6fdAOgq4xNu
TLSH
T17A830296752BB1D4592B012A9EC1F20294222F713DE7D02C15EE4F6E27DBD21698CEA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 22KB
SHA256 e495703032cf8ee1ca49d907a7b5dc172f70f1c848317549c5306733f4ee54c4
MD5 e3bc6c4e7d7cad828b0eeab584ea2697
SHA1 9ae0f8de9715e62ec53125e57047574f2e8fe6bc
SHA512 1bd5806f953148b7033fe394256bd577b2dd913609bb67e372623c8e5f270ae6f3cde8e0ab5a7c187973a0b7e039e2237d70e7d19b1104927c6d80eade569ffb
SSDEEP 384:wy6o24wp4bJagQQTj8grQg4Cb8VlN/EbqCopUXAy5PIjYZzS6pfHSbcelx3Q1Xhv:b6o5wfGUsv6E2CvXA2uUKbtgv
TLSH
T165A2E1D78475C58C344E7F3D2AE6F40E4766B538AD39A3CE1AAC25BDA41D1BB1E34101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 26KB
SHA256 8c4f25fb1d65b0a88d682515c0124e7cdb41493c0865c724be599ac6c763b81d
MD5 ce9d1ee6113e2cf4a97ba3586451043b
SHA1 e30fa87ab74c896e8bc42c4222906f183d743936
SHA512 9cc45106137ac5142da65f90d88216f6608e88db2c55f035b9d29c16ed5d212d7037b4734b1622fdbe8026aab21360db1e6a8e71422aa92c8f049b761f75b046
SSDEEP 768:76XJJzewLtkQHbUiBELP/I212Chn9sufX6vM0yKEojqS2+FXOx15VzuW4Na:2ZdgytBkP/Z12Cd9v6vOKdz2+Nw5Vzgk
TLSH
T12AC2E1D387CA5E12091701E3EB3C1B570A64A583CE2739F2191B16B4A53968BD25B4FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 30KB
SHA256 32339f355b5b9b8693f9f6370dca7b05fe6042e3b2d94546afa05d569dd6b66b
MD5 348c832a4560adebb39e32b91f392e20
SHA1 5f8743e97e3d0c418d90998072416705f17eb720
SHA512 c225d7794c5c01872bb1af8a0c6af443f54e07f40cb8c03ed79c77a092ab35e03cbf29e2672cd070e93c998f54fe7776f4ff4e948dfd67af8d77039af6638cb9
SSDEEP 768:5q2yiiih0/n1a/WAfZXxZbFtjd3iXn24He5UKnCljV4fx:k2yOh0da+qZW24Ha3n4x45
TLSH
T10EE2F12E4C58BDF8AF09B230D8C62E76CAF216D7C6D2EED0543DAAFD2529590D18C5C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 151KB
SHA256 a8e7368f03b24867920b42fe31331acf8bde1626336affcee9bd6a9d7daf0692
MD5 c798737fd303ec814cf40d8076bd5d5f
SHA1 0d18fd05f16c17652468175fcc41423a3d99170c
SHA512 31ad0a4e439b706ce0da3a541bad7ed5e5340d086bac526b7872ecfeb722edd9767d99baf72307ae6f79649e3be90542e9034b618dd75db7fc46c19eca72da35
SSDEEP 3072:0EqzX0mMLYGYjNWkUBgpF8djK+nrXXfmlCPaPGOZOaO9TMunLe6EatD:0EoX0mMLYR978dW+njXelCPa3bAYualw
TLSH
T1C8E312AA520A418C573142C80BEF712E499FD0C619DF829B35B4DBFA9974D17270CAAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

176007e415ab23fb_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\176007e415ab23fb_0
Size 9KB
SHA256 13437668be83b06dedde6487cff1de4241bce4125da306b92ecc672b3bcc2bcc
MD5 1c0f22a4e59d2e88bd1e6c5877bcfa02
SHA1 0590d9ea693977e97509826790052349725690b5
SHA512 3d479ddb0910825dd94db2fb22ae29559d1ab952d6ab753dc082e981d48dd0af836cb954ac2a49bb371d1c3ea845e4f5bb8e86a16642837fddbc68d9d662216d
SSDEEP 192:XENfdN95jXwKrlTmi0InfO+VLzOEHXW0ld+ofghL4H/QjYwLbGQFSa:8fn95jXwcki0InWOLnf4oojYwLJF7
TLSH
T14C122AE92F64E82FED0E13F25161F92B5722D1EA6ED7410B1829A6B4280D7D13EC350E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e6d31e7783aaecf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\8e6d31e7783aaecf_0
Size 241B
SHA256 68180c455e3616e28c6f398777e550ad3b058a6a9b3aed8a398282fb43495d61
MD5 1b663e878903974c7fc639ce98ab3512
SHA1 29a8b2adfc0130c000910362c2684243bb2604bb
SHA512 b1535dcdfbd3ef150fe5c3758a06ddb0cf4497bdc1b4f077e2b03a7191eb20a5fa4bfefef1dbcc444e44cca4044c1c76ffb0be776bd01b113e1b1b10e7e06549
TLSH
T17ED023CB27244880EF0F82F1C58B33638623E0C4FF899C06124A333FB410CA001E152B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b181604c757bedb24f820944070480c740b78abda8f6814f73abc31ef96d9bbc
MD5 dd49d6be385e5fecf926257c2362541d
SHA1 7f7b977ca60418af5c5de124d20dafe0bb5b653d
SHA512 38e01df07effa53430a8b10d98b25a24179d7b35f7914150f2df545dffc3e4d6a2c3a29ec146ac13052be452788b7b5cd66599cb5ca3a42958a88287aa99ee37
TLSH
T1A7510FCE63D44461FBEBA17C81DD3E87363765C2259FAEC235A8C8BB940BBA14118464
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 c2a093ee50d82854681562999a179eafbfc112f684d553065f890792e7a9fd9e
MD5 9870f90dd3da4fec923a1b090fb2e6b6
SHA1 0c927b50be8eb6bb2ef7c8928f76e285fcd592dd
SHA512 2ee8979ca0d8154b32710618150e140204f98ae6d0e95031f64eb58aefd730930ca5fd0fac884cdfb0576cf7e3520e995aa9057dde57d6e9fec4e0932af5e181
TLSH
T176510CCE53D04566FBEBA17C81DE3E87323755C1259FAEC234A8C8BBA40BFA04129460
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 30dd78256188571464a1187fd695cfc8d870b2cafb490bebb1546198b1adf646
MD5 209d17e873b98ec2e73a7d0c97e8aefe
SHA1 31ad61f64bd34feb671539e17ba757d27f8cca5b
SHA512 7b7e146010729d3903d9443a1bda11034befb942f2025f627cf4443bc6cf86673e8161c891425e3ef3d78c080af2007d6249f5c0d2845faac55f2d039e93f716
TLSH
T1E0511ECE13E44462FBDBB17C91DD3D87363755C1199FEED23468C8BB540BBA09128464
MD5 SHA1 SHA512 TLSH

Submit Download

6544614bcfa80f24_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\6544614bcfa80f24_0
Size 256B
SHA256 82f32f7aa6ae2b99a971893876e4b43d6ed55d3244433a4f3a1ebca23be67b69
MD5 a738f0ed19031a14b29aac305bd66a4b
SHA1 3e6d21f6fd3666846ef3d96cb11bdfac988a5337
SHA512 c35483fea1abae07751b84802f601ff3473b76b5be07abc8a729a5931690d36053e8f2cd00033fc5c19bf5fa319e63f07c1912c6803dacb90651c1051e794990
TLSH
T1ECD02BC705384401D2AC55F0C767E786A253E44849ADA111840430B2991083959631D1
MD5 SHA1 SHA512 TLSH

Submit Download

e02c529ce26bf2a0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\e02c529ce26bf2a0_0
Size 39KB
SHA256 42207f52d14a1c1b1b3314983924637a3e1dbe1981ba0214b9caf7f2523cb736
MD5 ab28fbdf6fdfc919e20ad63b7a711c0e
SHA1 8c780d585160d8ee65908391c2b92ffd218f68d6
SHA512 b376bfbf0994747b7b8ff94fafa23f8e42958f307a7aa63568cb4d315b4923af45387507afbf66779ee58f346d50c343df37bc72674f49ced25e71d459aef14b
SSDEEP 768:A0yDGOwMNfTQkORa07NrPXwKGgZh88888888888888888888888888888888888T:eGRkOlNLXwKGBOOqG5
TLSH
T16903A1C5A13737DFC135947978622A111958B31D2F07CAF29634CCFA2BB2E4307AA56E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Size 96B
SHA256 4acc3802bbda7f33a5b08177ce2ccbb6546ba2747e03f721e01da778d31e4a4d
MD5 67e72da1c5b160c2565ff21174826922
SHA1 fd146949d68dbe672d1cf0cb538cb21dcc3caa04
SHA512 9d1b42da53d630376f9d27b63dc8763ec7588300db4ccf18a79b6e48600ce3b9920410d7cc3a6b4a5aef4fd9fc4a77487609c13b84e064b40ac356a6f452f4bd
TLSH
T145B0025109459556E7144E7454CD0C653771C9D533539751447556B485503486985600
MD5 SHA1 SHA512 TLSH

Submit Download

27de5075-398b-4f35-bb3d-1281a17129a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\27de5075-398b-4f35-bb3d-1281a17129a2.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2e2f7638-5c99-4775-a746-f649cfbdd6ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2e2f7638-5c99-4775-a746-f649cfbdd6ca.tmp
Size 1KB
SHA256 047f9bea50b9465d204d86e4e5bfbbff5ccfc16b77c16ab445384cd90e5fea66
MD5 20989a03114fbb5f0b174b7f837ea1c2
SHA1 4bff483f4ec85c3adf112ed01b444d67b7442eeb
SHA512 5b32da292efd976c66119624ce968b03fc3e0ffce3d9236ffc0ae7a68e888149ec416d7379a74fd4547d6c2149af328c8d06ee1a89c22f6f2fb94beb2fe6b6d7
TLSH
T1BB31BEFB87B5477E8A0296F09A25AE2BCE5D0017132C3C5189E47E17A3B3471D002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

ad747f0f-bca5-4c90-9a42-032865f0df9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ad747f0f-bca5-4c90-9a42-032865f0df9a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b40f1126-294b-4dd6-ac3e-c8a467ad19b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b40f1126-294b-4dd6-ac3e-c8a467ad19b4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f1e60adf-00a0-4bc9-9711-9ef257c100f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f1e60adf-00a0-4bc9-9711-9ef257c100f2.tmp
Size 2KB
SHA256 5f8cc353ada21f2665fa3054025fb033d2d9e952a6b7713188fa75fa64a7b2b7
MD5 ad2eac0b3460837a4f4999a376ff5e9a
SHA1 c5be0e4d8dfe7ebdac7e3efe9da4314fd07936d3
SHA512 0f7593e47bc23289a2f7dd4eda6f1c51250af5d63cfe1f2e51e9752cc2523a28f92ba3e699604503e26cad01b66f35ae53852cc6bb8b4e831038356b5acb0c7f
TLSH
T1F341B0FB47B4577E9A1296F09A19AE2BCE5C0117532C3C568DE47E17A3B3470E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 50887af1e6c96e069919c6aaa3c207d3b56352fd5675fd1a758d72b4b995cce7
MD5 5c941c2167d37212fad8574f4dc57f6d
SHA1 35e64977daf2d87d2a62564ecd41b9803354630f
SHA512 58cc11dfad44b22d7aa750cd62ba84c81af2ee7eb04df7235038e1f30cede343522ea34c0c79e74b0aa26c12368c006f86ffca9647afca75315dd875c802e28b
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayLo3uyYCmnb+l+ISKnK9m1cnxw3YNuW4:KIZCK6QK2/eKgIvSIKPaOJ
TLSH
T1969144023177034038BE294942B486AB954275F73058E96FBBAC91E24E6FF145DFDAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2b978d9-0d09-4847-a742-e1e51c77edea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2b978d9-0d09-4847-a742-e1e51c77edea.tmp
Size 11KB
SHA256 5b31b5ff6c0549ef0a552508e49f4bef9b5e901f5bec3bb78e03011276057ed8
MD5 90c7f92b5846b1b63c3b5e0385c142c1
SHA1 0e2f80854af60bec46e86ff5b376120377a092c0
SHA512 def0107d613e49f604eca83bf7e2f7176ecd2ac00c1797e716431352263d3ffd67a3920fd0a4c35a8c1bf414eec87445c0967f7764da61a9be01097a35851f50
SSDEEP 192:sxZ4Rjng/fdslYIdpH7/5HW6+WN5a2jJY36Xl3+TIg5uJ:sxZ4tg/fdslpVHbhJXNoc
TLSH
T10132F9526D34697B8CCBD21EBA14BF23E6F9603291D01E54BAFC9A1C05E77DD620B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9765bd0-c47b-46c5-93a9-83953c7e1c6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e9765bd0-c47b-46c5-93a9-83953c7e1c6b.tmp
Size 10KB
SHA256 1b8bd9afa3140f06c2354aea361a931ceed829452fcc1224d28acf4a9c969b41
MD5 ea076b5ce8fbb32fc7fb46372a4acb3c
SHA1 5a307e249d790d7609e19960002e0a032ecb3481
SHA512 74f2afb6488b0a18f4d0ef46a398bbddea7ac4fdf197422976dbfffac7617b2a7dca0efddd0fb96776ca816290465812b1db46e245503cbb60dcf4e4d09d1b6f
SSDEEP 192:sxZ4Rjng/fdslpIdpd7YHW6+WNcRU/Y36LyR+TIg5uJ:sxZ4tg/fdsliSHb9/X2oc
TLSH
T18C22D9526E38697B4CCBD20DBA15BF63E6F9503291D01E54BAFC9A1C05E66CD620B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62c4f2c7-9131-4fe6-a172-81c93f2098de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\62c4f2c7-9131-4fe6-a172-81c93f2098de.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8299cdc-1ccf-4a5f-b216-b544e8d1d5dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c8299cdc-1ccf-4a5f-b216-b544e8d1d5dd.tmp
Size 18KB
SHA256 0012fc88f0b6b69c7c97d758a30eae59c2f8aed31711c388af3eb9823eb393c9
MD5 4dd0d9736ff1ca355dbe95b3bcf19e60
SHA1 ee90fcf65d3d604401528234fe92dfaa8fc366c7
SHA512 1c33994fef25bb3a78300ea67c18de5ed66da55ff6b53cbb180e47bbc623d9393299ed90ae756ec2144d0ba57204b7df18ba90c3c1c12ac71fc3d59089d66dd8
SSDEEP 384:xQkUSv0sNlUraxMpbxqjh//WIC13EvaTZc2HLIIlY:j0eF/KEvaTZc2HLLq
TLSH
T1D2827E31A879AC7B4EE7D561F04B3613DF708067D6C85F60DADDAB2C02DA198230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

59dc4120-7000-4bde-9400-24c9826ff9db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\59dc4120-7000-4bde-9400-24c9826ff9db.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eddbfdd62b808e9941db32e5de0c2a79ae5453ee8e883adf329e16132bf5fa15
MD5 855cba8a1e244ef018ace42c70766a87
SHA1 14a627cdadabf96bc128f18200e8db2752bfdb9d
SHA512 5999d5724d474d5b3993d756d3855235a5c0884ed4d8b82f79e7dc5baf9112bb59be4f9a8aeea7446f5f43223524d62cb91f7a8e6434fc9a61da1557f01ed7a3
TLSH
T1BF412659B6E91148B3773F4AABB6A82E487F79372E46D05E00110E4F0A22F04C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

td-setup-win-x64-7.3.3.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-LBHIM.tmp\td-setup-win-x64-7.3.3.tmp
Size 3.5MB
SHA256 d875e325db402098eed7e086d9285337c2ca36d67ab53c22d52b72683c0a3513
MD5 ddfc153aa4b2202b4b1944ff62a90b3f
SHA1 8c8ae83f89d07f4c044d59aa75a00e3c8c6bc0fc
SHA512 1198283395b540972b9704f0c55cede79aba06a6fc775b2003d7f345fceca10aa0a6a9ab8b95e837502cab81bc5807f9a8e022e7b764b26cc5a3ff0dfdc09475
SSDEEP 49152:g6RlZSDcbZsSNFZnpZv4sxNhdaodRl4FHKBCU333NQ:g6RHzbv4sxNhnrl5B5333W
TLSH
T15AF57D13F389613ED05B1A3A79379285983F766079128C579BFC3E8C8F752812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Telegram.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk
Size 1KB
SHA256 c8682f4724c45f2334553fca704843c90b821fadb52995166cb9c9348d90699f
MD5 beaba3d98ebdd069cb41b5c94d78f061
SHA1 c6b10e0c8035fd2f1612cc65035cbf53b3163997
SHA512 2f35d69a90c7120b287f18a71c1ff35768d51bb874368aed6f32bd7ed8b6e5685ac5c8f5a02f7157f32e4397ea72ea8cea34cdc2884c7997541b781dc6cc1f5a
TLSH
T1FD1100C033D81B0BF2E259761FB283108A37F8406D09CB5E416482066CB6A11FB6CF6B
MD5 SHA1 SHA512 TLSH

Submit Download

d3dcompiler_47.dll

Path C:\Users\Admin\AppData\Roaming\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

489d6763-08d2-4ebb-a90c-493931b708da.tmp

Path C:\Users\Admin\Downloads\489d6763-08d2-4ebb-a90c-493931b708da.tmp
Size 15KB
SHA256 655f929c14847288624aba7d856c2a239f6f3cbe8a7378bd794d2594bc235b7e
MD5 e53fd20a61c119fdab295383b68057d5
SHA1 e781cd012042f6d8ff7fcd1ad1dee4740ed6e5e6
SHA512 a91559f540eba4fe277a98fb04b2e93b7505e20a689139f2f8c820200efc80634e9cd36b2df04802cca64c28ee7f3dc9ba97904ea62a488dfa192e2ea8c42bcb
SSDEEP 384:7ade31gjGTjIo4wsx99PtbUHu2yTzZL1RVfa:7abgl4nDbbzZL0
TLSH
T17572E813524AE6BFC87DC33201FED85AB577193031074D72DEE8A0799E894916D2BE8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/868-537-0x00000000007D0000-0x0000000000B54000-memory.dmp

Download

memory/868-515-0x00000000007D0000-0x0000000000B54000-memory.dmp

Download

memory/868-561-0x00000000007D0000-0x0000000000B54000-memory.dmp

Download

memory/5028-514-0x0000000000AD0000-0x0000000000BB2000-memory.dmp

Download

memory/5028-475-0x0000000000AD0000-0x0000000000BB2000-memory.dmp

Download

memory/5028-562-0x0000000000AD0000-0x0000000000BB2000-memory.dmp

Download