24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 84:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Trojan.Generic Sample 45cf579fb674… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 45cf579fb674…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","keywords":["Malicious","Dropper.Trojan.Generic","malware analysis","sandbox report","threat intelligence","45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37"],"about":{"@type":"SoftwareApplication","name":"tletgtup.exe","applicationCategory":["peexe","executable"],"identifier":"45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Trojan.Generic","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T480,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "tletgtup.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "tletgtup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "=VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "=VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")26:T6cf,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "tletgtup.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "tletgtup.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "tletgtup.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "tletgtup.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "tletgtup.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "tletgtup.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "tletgtup.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "tletgtup.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "tletgtup.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "tletgtup.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "tletgtup.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")27:T698,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")28:T6e0,"cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cscript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CSCRIPT.EXE") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CSCRIPT.EXE") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE")29:T9d3,"tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867170753 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867232321 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867448757 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867459080 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867663863 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-867671973 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-868293015 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-868318548 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-870149972 [PID: 2028] "tletgtup.exe" queried SystemProcessInformation at 00000000-00002028-00000C15-870160330 [PID: 2028] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-870676781 [PID: 5884] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-870686647 [PID: 5884] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-871164111 [PID: 5884] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-871176699 [PID: 5884] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-871460280 [PID: 5884] "cscript.exe" queried SystemProcessInformation at 00000000-00005884-00000C15-871469510 [PID: 5884] "msiexec.exe" queried SystemProcessInformation at 00000000-00007080-00000C15-917147599 [PID: 7080] "msiexec.exe" queried SystemProcessInformation at 00000000-00007080-00000C15-917156574 [PID: 7080] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937214875 [PID: 5544] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937227049 [PID: 5544] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937448011 [PID: 5544] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937456480 [PID: 5544] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937896168 [PID: 5544] "zgqmQcC2.exe" queried SystemProcessInformation at 00000000-00005544-00000C15-937904779 [PID: 5544] "zgqmQcC2.tmp" queried SystemProcessInformation at 00000000-00003768-00000C15-938998878 [PID: 3768]2a:Td68,"Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\log_start0.txt" to "%PROGRAMFILES%\(x86)\Telegram\log.txt" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\key_datas.hLUgcz" to "%PROGRAMFILES%\(x86)\Telegram\tdata\key_datas" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.vujVqm" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.ylfyIb" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BFhhNR" to "%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.NIGiRR" to "%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.AhbOhd" to "%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.ZIDVdU" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BlBrZN" to "%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BmVDSk" to "%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.adLBvH" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.tgXjRv" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JDBNMI9NN5IPU1ASRVYG.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\2af3362609d41f25.customDestinations-ms" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\D877F783D5D3EF8Cs.NXBOCn" to "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\D877F783D5D3EF8C\configs.AGsuGb" to "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8C\configs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\D877F783D5D3EF8Cs.AyilRI" to "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\D877F783D5D3EF8Cs.tmrvYN" to "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\settingss.ykZlYP" to "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss" "Telegram.exe" renamed original file"C:\Program Files (x86)\Telegram\tdata\6B61835E29CEE158s.mSqlho" to "%PROGRAMFILES%\(x86)\Telegram\tdata\6B61835E29CEE158s" "zgqmQcC2.tmp" renamed original file"C:\ProgramData\MicrosoftDevKit\is-695HK.tmp" to "%ALLUSERSPROFILE%\MicrosoftDevKit\Guard.dll" "zgqmQcC2.tmp" renamed original file"C:\ProgramData\MicrosoftDevKit\is-NBT1Q.tmp" to "%ALLUSERSPROFILE%\MicrosoftDevKit\Microsoft.Photos.exe" "zgqmQcC2.tmp" renamed original file"C:\ProgramData\MicrosoftDevKit\Microsoft.Photos.exe" to "%ALLUSERSPROFILE%\MicrosoftDevKit\MicrosoftPhotos.exe"2b:T4ee,"Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1"")2c:T10c05,Contains base64 string in header "POST" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aefd" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "keep" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "aliveContent" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Type" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "bing" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "like" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Encoding" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "gzip" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "Language" in header "POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1Host: aefd.nelreports.netConnection: keep-aliveContent-Length: 958Content-Type: application/reports+jsonOrigin: https://www.bing.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 164Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 108Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/dns" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "apv3" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "stel" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "padding=" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "like" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "36Connection" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Keep" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Encoding" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "gzip" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Language" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "72Connection" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 100Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "56Connection" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 232Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "80Connection" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/dns" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "apv3" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "stel" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "padding=" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "like" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "36Connection" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Keep" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Encoding" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "gzip" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Language" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 284Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.91:80Content-Type: application/x-www-form-urlencodedContent-Length: 288Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "52Connection" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "92Connection" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 92Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "60Connection" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "76Connection" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 268Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 212Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 116Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 220Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 272Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "40Connection" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0"2d:Tbafc,Found XOR loop in file "Telegram.exe" at offset 1369885; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 1808860; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2100331; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2158684; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2158697; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2389060; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2475020; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2561620; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2676604; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2776470; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2776506; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2789918; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2919595; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2926555; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2931703; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2947371; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2971101; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2972907; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2974167; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2977321; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2981011; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2982899; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2984627; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2985075; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2985465; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2986159; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2987099; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2988517; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2989931; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2991407; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2992791; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 2997273; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3008389; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3028451; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3036295; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3036949; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3045757; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3046967; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3054089; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3503838; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3504714; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3722109; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3784971; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 3998766; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4197537; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4205755; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4209699; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4733068; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4826389; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4835259; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4835569; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4956260; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4956296; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 4969708; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 5055260; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 5068635; code bytes = 30d0 Found XOR loop in file "Telegram.exe" at offset 26433; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 159461; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1480020; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1542709; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1542901; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1578608; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633120; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633142; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633164; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633236; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633332; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1633441; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1653325; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 1653998; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2247785; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2443020; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2906451; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2928231; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2929567; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2946437; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2956111; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2963519; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 2966913; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 3485022; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 3485549; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 3959079; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 3959613; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4195991; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308240; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308262; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308284; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308356; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308452; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4308561; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4522446; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4522973; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4850565; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 4859072; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5014106; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5048992; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5074853; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5102307; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5114196; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5131483; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5134452; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 5202843; code bytes = 33c1 Found XOR loop in file "Telegram.exe" at offset 840850; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2188532; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2200890; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2206752; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2519260; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2689539; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2904566; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2925318; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2940236; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2942394; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2953810; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2954082; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2959094; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2972868; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2974128; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2979180; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2980972; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2982860; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2984588; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2985036; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2986120; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2987060; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2988478; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2989892; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 2991368; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3006838; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3035738; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3046344; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3049274; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3051810; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3053056; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3054574; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3054872; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3180405; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3180416; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3180541; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181216; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181227; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181238; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181715; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181726; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181846; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3181867; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3182976; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3182987; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3183158; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3183954; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3183965; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3184007; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3184106; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3184198; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3184209; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3184357; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3187548; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3187580; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3187769; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3188688; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3188723; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3188854; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3189234; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3190972; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3192021; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3192063; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3192170; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3192283; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3193769; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3193994; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3194029; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3195189; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3195363; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3195374; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3245188; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3537794; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3610748; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3623372; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3635722; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3676748; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3716716; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3722082; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3724809; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3726689; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3738121; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 3740001; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4012089; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4069267; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4095148; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4107498; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4185039; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4198652; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4201314; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4204556; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4209674; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4214832; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4215186; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4217865; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4219745; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4602578; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4693676; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4706026; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4768532; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4826360; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4826804; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4828656; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4835542; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4835758; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4837897; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4839778; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4873929; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4873943; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4873965; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4873979; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4873999; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874023; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874037; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874057; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874079; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874097; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874133; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874159; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874191; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874213; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874239; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874253; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874291; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874307; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874323; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874351; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874367; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874387; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874413; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874425; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874435; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874445; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874463; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4874481; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 4876107; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 5002800; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 5006300; code bytes = 8030 Found XOR loop in file "Telegram.exe" at offset 5140260; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 726048; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 729503; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 730315; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 731047; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 731781; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 732767; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 746909; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 750969; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 754907; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 758455; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 759017; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 763389; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 768439; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 774189; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 777349; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 778463; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 781945; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 789551; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 791597; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 793627; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 796171; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 827973; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 943894; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 956440; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 987480; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1062250; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1076794; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1176025; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1228411; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1278450; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1325696; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1406553; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1408742; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1452439; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 1725132; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.exe" at offset 148174; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 729689; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 741557; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 742473; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 761629; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 768557; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 787439; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 834137; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 944600; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 967540; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 967643; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1046516; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1090608; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1132418; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1187566; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1196547; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1221954; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1244895; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1245027; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1266322; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1267008; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1274472; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1286540; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1321325; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1324401; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1386417; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1391551; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1479544; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1576516; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1605597; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 1743726; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.exe" at offset 122173; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 122200; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 122635; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 122662; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 122911; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 122935; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123162; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123243; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123266; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123290; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123318; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 123342; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 295460; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 727058; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 727600; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 729304; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 730292; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 731028; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 732740; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 739036; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 742376; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 743024; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 746058; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 757864; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 759006; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 764148; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 785798; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 789512; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 791562; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 793588; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 794786; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 796132; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 872471; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 881239; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 970025; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1110932; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1168357; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1301998; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1386905; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1412467; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1550408; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1598238; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1607846; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1638333; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1715693; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1751062; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1788890; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1866665; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1918797; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1981488; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 1992485; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 2013157; code bytes = 8030 Found XOR loop in file "zgqmQcC2.exe" at offset 2016060; code bytes = 8030 Found XOR loop in file "c7130ec1.dll" at offset 18826; code bytes = 33c1 Found XOR loop in file "c7130ec1.dll" at offset 104582; code bytes = 8030 Found XOR loop in file "c7130ec1.dll" at offset 106690; code bytes = 8030 Found XOR loop in file "genteert.dll" at offset 5580; code bytes = 33c1 Found XOR loop in file "genteert.dll" at offset 9942; code bytes = 33c1 Found XOR loop in file "genteert.dll" at offset 57374; code bytes = 8030 Found XOR loop in file "genteert.dll" at offset 57682; code bytes = 8030 Found XOR loop in file "guig.dll" at offset 5620; code bytes = 8030 Found XOR loop in file "guig.dll" at offset 5717; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1535616; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3051887; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3057947; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3063517; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3073777; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3081093; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3083709; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3084263; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3086573; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3091747; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3101597; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3106071; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3107707; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3115241; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3117213; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3126835; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3133271; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3133875; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3135129; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3135751; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3137745; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3139311; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3139925; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3142253; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3150123; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3151083; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3156511; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3157235; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3157985; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3162875; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3165367; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3169463; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3176469; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3178451; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3180727; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3187559; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3188659; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3190917; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3197075; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3198899; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3200629; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3202101; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3202585; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3205385; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3209987; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3225311; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3228025; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3230009; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3231791; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3232649; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3241327; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3242859; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3245585; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3247053; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3249307; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3260487; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3263311; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3268909; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3273891; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3289011; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3291053; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3293103; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3295131; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3297139; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3299169; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3301183; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3303087; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3306759; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3308075; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3309131; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 3310095; code bytes = 30d0 Found XOR loop in file "zgqmQcC2.tmp" at offset 198398; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 380905; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 1057762; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 1057865; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2243651; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2243684; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2243717; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2243750; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2243913; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 2244155; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3051223; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3060709; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3079479; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3080079; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3081703; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3087989; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3090505; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3098133; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3100513; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3123949; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3128899; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3142383; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3152761; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3183837; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3203147; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3207975; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3213185; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3214891; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3241549; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3244335; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3268063; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 3283451; code bytes = 33c1 Found XOR loop in file "zgqmQcC2.tmp" at offset 163257; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 163284; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 163719; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 163746; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 163995; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164019; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164246; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164327; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164350; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164374; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164402; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 164426; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 337020; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 429580; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1218293; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1245768; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1250202; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1253198; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1263502; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1287460; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 1411337; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 2091588; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 2129159; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 2238359; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 2560187; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3049490; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3050030; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3053880; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3055352; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3056966; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3063502; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3064048; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3070626; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3072702; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3073738; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3085960; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3089536; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3096000; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3099238; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3113798; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3122224; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3133252; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3135716; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3145782; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3150084; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3151044; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3156472; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3157196; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3165328; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3169426; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3183734; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3184232; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3185964; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3186464; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3187060; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3193668; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3200590; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3202096; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3208224; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3209972; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3227986; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3231752; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3232620; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3237758; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3239162; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3241292; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3249268; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3253208; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3254040; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3274464; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3275502; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3277444; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3279294; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3282550; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3288972; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3291014; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3293064; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3295092; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3297100; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3299132; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3301144; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3303048; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3305916; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3306720; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3308056; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3310056; code bytes = 8030 Found XOR loop in file "zgqmQcC2.tmp" at offset 3311811; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 61132; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 1157601; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 1170880; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 2506128; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 2573953; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 3062856; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 3160628; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 3304920; code bytes = 30d0 Found XOR loop in file "shiCBF2.tmp" at offset 386972; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 388286; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 388856; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 457146; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 484899; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 497241; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 585532; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 585595; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 585627; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 603636; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 760375; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 1989204; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 2593016; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 2595192; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 2745896; code bytes = 33c1 Found XOR loop in file "shiCBF2.tmp" at offset 236554; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1026005; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1028087; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1032451; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1066308; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1256604; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1375869; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1404943; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1404990; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1869111; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 1952835; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2504394; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2529874; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2604708; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2782012; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2822919; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 2823895; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 3203400; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 3313455; code bytes = 8030 Found XOR loop in file "shiCBF2.tmp" at offset 3317007; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 9483; code bytes = 30d0 Found XOR loop in file "MSICC80.tmp" at offset 223278; code bytes = 30d0 Found XOR loop in file "MSICC80.tmp" at offset 422049; code bytes = 30d0 Found XOR loop in file "MSICC80.tmp" at offset 430267; code bytes = 30d0 Found XOR loop in file "MSICC80.tmp" at offset 434211; code bytes = 30d0 Found XOR loop in file "MSICC80.tmp" at offset 183591; code bytes = 33c1 Found XOR loop in file "MSICC80.tmp" at offset 184125; code bytes = 33c1 Found XOR loop in file "MSICC80.tmp" at offset 420503; code bytes = 33c1 Found XOR loop in file "MSICC80.tmp" at offset 236601; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 293779; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 319660; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 332010; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 409551; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 423164; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 425826; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 429068; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 434186; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 439344; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 439698; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 442377; code bytes = 8030 Found XOR loop in file "MSICC80.tmp" at offset 444257; code bytes = 8030 Found XOR loop in file "is-695HK.tmp" at offset 52154; code bytes = 33c1 Found XOR loop in file "is-695HK.tmp" at offset 144156; code bytes = 8030 Found XOR loop in file "is-695HK.tmp" at offset 148246; code bytes = 8030 Found XOR loop in file "is-NBT1Q.tmp" at offset 34988; code bytes = 30d0 Found XOR loop in file "is-NBT1Q.tmp" at offset 47534; code bytes = 30d0 Found XOR loop in file "is-NBT1Q.tmp" at offset 35694; code bytes = 33c1 Found XOR loop in file "is-NBT1Q.tmp" at offset 58634; code bytes = 33c1 Found XOR loop in file "is-NBT1Q.tmp" at offset 58737; code bytes = 33c1 Found XOR loop in file "is-NBT1Q.tmp" at offset 67168; code bytes = 33c1 Found XOR loop in file "is-NBT1Q.tmp" at offset 98712; code bytes = 33c12e:T487,file/memory contains long string with (Indicator: "GetCommandLine"; File: "c7130ec1.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "genteert.dll") file/memory contains long string with (Indicator: "GetCommandLine"; File: "MSICC80.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "is-695HK.tmp") file/memory contains long string with (Indicator: "GetCommandLine"; File: "_setup64.tmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "tletgtup.exe") Found string "/GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp")2f:T59f,file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "guig.dll") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "MSICC80.tmp") file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; File: "_setup64.tmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; File: "tletgtup.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")30:Tb60,file/memory contains long string with (Indicator: "sendmessage"; File: "guig.dll") file/memory contains long string with (Indicator: "sendmessage"; File: "MSICC80.tmp") file/memory contains long string with (Indicator: "enumwindows"; File: "is-NBT1Q.tmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "tletgtup.exe") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "tletgtup.exe") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "/SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "CEnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "CEnumWindows" (Indicator: "enumwindows"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "CFindWindowW" (Indicator: "findwindow"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")31:T364e,"tletgtup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02cfe74b4ea9e00226e4f740000a404000000002d6e4f741bf46cf12d000000ecb7f47438eb9e00b1ce980018d4f302d8b2f202070000008000000078ea9e000000d002fcea9e0070c85074576fa785feffffff2d000000d0cc037527000000ccea9e00856a51741c2356740ceb9e00f85f517408000000bb695074b2695074a3f56cf12d000000ecb7f47427000000d0cc0375e0ea9e002d000000d0cc03752700000010eb9e00856a51741c23567458eb9e007e8a0275ee8c0275738a02751d8a35ed2d000000ecb7f47427000000d0cc0375c43ca404583ca4041d8a35ed20eb9e00fc5240750cec9e00e08402757d909598feffffff738a0275 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000070e19e0038cfaa777c36f202dce19e00010000003036f2027c36f2023036f202040000000400000000e0da7400100000dce19e00010000003036f202cd97aa779c97aa775ed0b893b50fd1743036f2020000aa77000000001c013c740000000080eed7740100000000000000f8e2da74000000000400000080a930744840d974f8e2da74e0e19e0080e8c776a048f30280e8c776dce19e000000000080e8c776b4acabfdfeffffff00000000000000000000000005000000b035f30202000000020000000a000000a035f302b035f30200000000d4f4404460e49e00ddf3ce7454e29e0000000000a035f3020a000000f8f3ce74a035f302 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000053002a004100700070004400610043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c004300610063006800650073000000330034002d004300360034003700450033003700430041003000440039007d002e0031002e007600650072003000780030003000300030003000300030003000300030003000300030003000350030002e006400620000004fe6ce74e99cab770000000000000000ffffffff000000000000000000000000e037f502f437f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000aa776838f502000000004d33aa779ad1b8937c0000000000f20288e29e00d08bf202d08bf2027f070000c000f20202000002ece09e006c550039010000006c5500396c5500008084f5020000f2020200000200000000000000390000000000000000fc1d0000000000000842a404ff0700006c5500006c5500000000f202000000000000000062000000f8aaffff6400000009abffff6838f502000000000f000000a5aaffff030000030842a404a0e59e007ce59e0081f1e6740842a404b8ea9e0048e79e00c5f1e6740000f2029834aa77f038f502a8e59e001c60e37404000000a0e59e005c83bc760042a404a090ea74000000000000000000000000 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502de7df502c87df502000000000000000000000000000000000000f502c87df5020000000000000000ffffffff0000000000000000000000002688f5023c88f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502987880574f8c6244bb6371042380b10900000000008c624450a0b676000000000000000000000000ffffffff000000000000000000000000deb0f502f6b0f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502987880574f8c6244bb6371042380b10900000000008c624450a0b676000000000000000000000000ffffffff000000000000000000000000e6b0f502fab0f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502987880574f8c6244bb6371042380b10900000000008c624450a0b676000000000000000000000000ffffffff000000000000000000000000cec1f502e6c1f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502987880574f8c6244bb6371042380b10900000000008c624450a0b676000000000000000000000000ffffffff000000000000000000000000cec1f502e4c1f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff0000000000000000000000002881f5023e81f5022881f502000000000000000000000000000000000000f5022881f5026c81f502000000000000000000000000000000006cce9e000000a977eace9e0046ce9e0008000000cefdb893d0d09e00eace9e00ba9aa977ba9aa97700000000eace9e00a0ce9e0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000c87df502987880574f8c6244bb6371042380b10900000000008c624450a0b676000000000000000000000000ffffffff0000000000000000000000005ecef50276cef502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000024e19e003300000078e29e0078d4f402fce29e0084e29e00889aca7668acf302854ad476aa9aca763fa38cb7000000000842a404fce29e0060d4f402d8ccf5020000f2020000000000000000000000006002f2021f000000c000f2010000000028000000000000006002f20228000000c4e19e005243ad774300000018e29e0073f6ce745ae29e005c00000000000000fdfeff7f82f8ce74000000000c3ba9fdfeffffff0000000000000000000000000500000058a7f50202000000020000000a00000048a7f50258a7f50200000000d4f4404460e49e00ddf3ce7454e29e000000000048a7f5020a000000f8f3ce7448a7f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f50268da9e0030000000000000000100000000000000aed3f50268da9e0068da9e005db14377aed3f502e4502c7450da9e00c8de9e00c31444770000000013010000aed3f502e614447744df9e00b2d3f502a1fd000000000000000000005cda9e00e4502c7430da9e000000000024000000000000004014f302587051774014f3020000000024000000000000005cda9e0050fff202ee502c7448df9e0002000000070000000800000002000000000000000000000000000000a6dc9e000100000001000000e0100000f0cef502e6144477d0df9e000ecff502000001000000000000000000ffffffff0000000000000000000000004098f5025498f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000006000000140100000100000100000000000000e0e09e00854ad476df87cc765ba18cb720c9f30258b8f302d0b9f502000000000000bb76ad53a58900000000000000007ce49e0082262b74653417fdfeffffff00009e00881acf74b31acf7420c9f302000000000842a4040000000088e49e008b84cc76330000000000000000000000807fcc76b485cc7640000000ee13aa77080014002650dd01b8b9f50258b8f30220c9f3020842a404a0e59e007ce59e0081f1e6740842a404b8ea9e0048e79e00c5f1e6740000f2029834aa77f0cef502a8e59e001c60e37404000000a0e59e005c83bc760042a404a090ea740000000068acf302854ad476 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000009cde9e00b0de9e00d8de9e0050a0b67600000000000000000000f502e8de9e00d8ec437710d9f50200000000f4de9e00e21d2b74000000000842a40438dc2a7410d9f5020200000000000000000000000000000000009e00000000001c010000e01000000100000090df9e0054e09e00000000000100000044df9e005243ad774300000098df9e0073f6ce7416e09e005c000000000000001bffff7f82f8ce74000000000c5fa9fdffffffff000000000000000000000000090000001c81f50201000000010000002b000000c880f5021c81f5020000000054c94044e0e19e00ddf3ce74d4df9e0000000000c880f5022b000000f8f3ce74c880f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f602e8d79e00300000000000000001000000000000003602f602e8d79e00e8d79e005db143773602f602e4502c74d0d79e0048dc9e00c314447700000000130100003602f602e6144477c4dc9e003a02f602a1fd00000000000000000000dcd79e0090d99e00bf2aaa774d33aa7732eab893760000000000f202e0d99e004014f3020000000024000000000000000200000250fff2024e460008c8dc9e002d00002d07000000080000000200000002000002000000004e46000826da9e000100000001000000e010000078fdf502e614447750dd9e0096fdf502000001000000000000000000ffffffff00000000000000000000000028dbf50240dbf502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f5020000000002000002000000000f45004a24c9f3022c00002cb39f8cb758de9e003587cc760200000228dbf5020f45004a908ff50258de9e004c87cc765c87cc76e39f8cb720c9f30228dbf50280b9f50280b9f5020000000020c9f3021c0000000fbbffff1e000000ffffffffa8e8f502c884cc760b000000febaffff0000000000000000da7bf202b485cc760000f20210d9f502e01000000100000068b9f5021e0000008802f2020000f20220e39e00fce29e0081f1e674800000002b000000c000f2028802f2020000f2020000000090e6f5022c0000001c60e3740400000020e39e00680000000042a4042b000000000000002c00002c58e0f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000a520c9f302908ff502000000000000000038e19e008b84cc763300000083a08cb704e8f502807fcc76b485cc760b00000027bcffff0d000000efffffffd8e0f502a8e8f5020d00000029bcffff00000000000000000000f2021c0100000000f20202000000f0230000020000000000f5020d0000008802f20204de9e005243ad774300000058de9e0073f6ce74fade9e005c000000000000002dffff7f82f8ce740000000024dca8fdffffffff00000000000000000000000006000000e202f60201000000010000003a0000007002f602e202f6020000000094c84044a0e09e00ddf3ce7494de9e00000000007002f6023a000000f8f3ce747002f602 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f602a8d69e00300000000000000001000000000000007615f602a8d69e00a8d69e005db143777615f602e4502c7490d69e0008db9e00c314447700000000130100007615f602e614447784db9e007a15f602a1fd000000000000000000009cd69e0050d89e00bf2aaa774d33aa77f2ebb893940000000000f202a0d89e004014f3020000000024000000000000000200000250fff202e64300a588db9e004d00004d0700000008000000020000000200000200000000e64300a5e6d89e000100000001000000e0100000b810f602e614447710dc9e00d610f602000001000000000000000000ffffffff00000000000000000000000020fbf50236fbf502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000024e19e003300000078e29e0048def502fce29e0084e29e00889aca7618acf302854ad476aa9aca763fa38cb7000000000842a404fce29e0030def50230d0f4020000f2020000000000000000000000006002f2021c000000c000f2010000000000000000000000006002f20207000000c4e19e005243ad774300000018e29e0073f6ce745ae29e005c00000000000000fdfeff7f82f8ce74000000006c38a9fdfeffffff00000000000000000000000005000000f8a9f50202000000020000000a000000e8a9f502f8a9f50200000000d4f4404460e49e00ddf3ce7454e29e0000000000e8a9f5020a000000f8f3ce74e8a9f502 (UID: 00000000-00002028) "tletgtup.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000f60268da9e0030000000000000000100000000000000ee0ef60268da9e0068da9e005db14377ee0ef602e4502c7450da9e00c8de9e00c31444770000000013010000ee0ef602e614447744df9e00f20ef602a1fd000000000000000000005cda9e00e4502c7430da9e000000000024000000000000004014f302587051774014f3020000000024000000000000005cda9e0050fff202ee502c7448df9e0002000000070000000800000002000000000000000000000000000000a6dc9e000100000001000000e0100000300af602e6144477d0df9e004e0af602000001000000000000000000ffffffff000000000000000000000000e89af502fc9af502 (UID: 00000000-00002028)32:Tbb9,"tletgtup.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002028) "tletgtup.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000300ad002152017fd48e99e005916aa770100000008000000010000000000f2020000000010000000000000000000000002000000020000000000f202010000000800000006ec287468e99e00ee13aa7701000000ee13aa77080000000000000008000000195aa589a0eb9e00ad9cc3730000f2020800000001000000 (UID: 00000000-00002028) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f26f0000000000a8f96f0082262b74777863d1feffffff64f96f003ce22a74650c00008cf96f004fe22a7400000000e99cab77000000000000000000000000000000006b1220a55af9a598b4f96f009be8287406000000bb1220a5a0c33801a0c33801b5e82874000000000600000000000000000000000000380100000000 (UID: 00000000-00005884) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000006802000002250000000000000000000098ed6f000000000000000000000000000ceaac77ad49d07468020000ffffffffc8ed6f000000000000000000bced6f00c4ed6f0001000000000000000200000060f66f0038ee6f0000000000000000000030000000001d01eced6f0086c53801680200000400000000000000 (UID: 00000000-00005884) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000c6008000000000000000f853407524d86f00ee13aa7780000000ee13aa77000000000000000080000000f0624d737f381ffb44d86f0050724f740000c6000000000080000000f0624d7302000000002f4d7360d86f00fb624d730100000080044e73885f517400000000de1b346590d86f00b8644d73f42e4d73 (UID: 00000000-00005884) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000001ed8e3030000003c3b497302000000c01a4a73489cc600409cc600541ed8e3d8be6f003c3b4973c4bf6f0010104a734c1ffc90feffffff32124a734c124a73c01a4a7340bf6f00d47d4973c01a4a73735f51740100000094cb4b73885f5174c07d4973fe7c346570bf6f00880c4a73343b4973403b49730000000000000000 (UID: 00000000-00005884) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000018000000000000005ce8ac772ce16f008c0200001ce86f00702e2674bd7b93f5feffffff642a267463242674b4e16f005806000040e86f00180000000ce86f00000000002ce86f001de32a7464010000b4e16f005806000040e86f00180000000ce86f00230320a50000000000000000d0e86f000600000000000000 (UID: 00000000-00005884) "Telegram.exe" called "GetVersionExA" with parameter 9c0000000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003176)33:T7d3,"tletgtup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tletgtup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zgqmQcC2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "zgqmQcC2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "zgqmQcC2.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T421,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "tletgtup.exe") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "tletgtup.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "tletgtup.exe") Found reference to API "GetFileTime" (Indicator: "GetFileTime"; File: "tletgtup.exe") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "tletgtup.exe") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")35:T7a2,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "tletgtup.exe") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "tletgtup.exe") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "tletgtup.exe") Found reference to API "/GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "/GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "/GetWindowTextLengthA" (Indicator: "GetWindowText"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "CEnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "CFindWindowW" (Indicator: "FindWindow"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")36:T420,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "tletgtup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "tletgtup.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "tletgtup.exe") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "tletgtup.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "tletgtup.exe") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; File: "tletgtup.exe") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")37:T70c,"Telegram.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")38:T51d,"Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")39:T5e3,"tletgtup.exe" called "CreateDirectoryA" with parameter %TEMP%\gentee27 (UID: 00000000-00002028) "tletgtup.exe" called "CreateDirectoryA" with parameter %APPDATA%\Telegram (UID: 00000000-00002028) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram (UID: 00000000-00003176) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram\tdata (UID: 00000000-00003176) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram\tdata\emoji (UID: 00000000-00003176) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram\tdata\temp (UID: 00000000-00003176) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\spoiler (UID: 00000000-00003176) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8C (UID: 00000000-00003176) "zgqmQcC2.exe" called "CreateDirectoryW" with parameter %TEMP%\is-421G2.tmp (UID: 00000000-00005544) "zgqmQcC2.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-B4JP8.tmp (UID: 00000000-00003768) "zgqmQcC2.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-B4JP8.tmp\_isetup (UID: 00000000-00003768) "zgqmQcC2.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-B4JP8.tmp\installer (UID: 00000000-00003768) "zgqmQcC2.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\MicrosoftDevKit (UID: 00000000-00003768)3a:T2819,"tletgtup.exe" called "LoadLibrary" with a parameter %TEMP%\genteert.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter %TEMP%\gentee27\guig.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter Oleaut32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter Ole32.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter mpr.dll (UID: 00000000-00002028) "tletgtup.exe" called "LoadLibrary" with a parameter riched20.dll (UID: 00000000-00002028) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00005884) "cscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005884) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Shcore.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-security-systemfunctions-l1-1-0 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\(x86)\Telegram\modules\x64\d3d\d3dcompiler_47.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\user32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHCore.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\psapi.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\d3d9.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter d3d10warp.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter setupapi.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter msdmo.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\dwrite.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\gdi32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Windows.Web.UI.Interop.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Windows.Web.UI.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Windows.Web.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Windows.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter User32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter WTSAPI32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\winhttp.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Advapi32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter d3d11.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter dcomp.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter ComBase.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter coremessaging.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00003176) "Telegram.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003176) "zgqmQcC2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005544) "zgqmQcC2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00005544) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter %TEMP%\is-B4JP8.tmp\c7130ec1.dll (UID: 00000000-00003768) "zgqmQcC2.tmp" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003768)3b:T138fa,"tletgtup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_init (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_deinit (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_load (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_set (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_call (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CompareFileTime (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetDateFormatA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetTimeFormatA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter MoveFileExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CharLowerBuffA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter win_getproc (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter win_exdata (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter win_init (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter win_register (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter dlg_box (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter guig_init (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter dlg_boxindirect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter freepicture (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter loadpicture (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter paintpicture (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter InitCommonControls (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DrawTextA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetWindowTextLengthA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter LoadImageA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateFontIndirectA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32A (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter WNetGetUserA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter GetShortPathNameA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter BroadcastSystemMessageA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter RegisterWindowMessageA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CharToOemBuffA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter gentee_ptr (UID: 00000000-00002028) "tletgtup.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002028) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005884) "cscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00005884) "Telegram.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHAssocEnumHandlers (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHOpenWithDialog (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter OpenAs_RunDLL (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHQueryUserNotificationState (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter PSStringFromPropertyKey (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowCompositionAttribute (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CommandLineToArgvW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoGetAgileReference (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolTimerEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolWaitEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoOriginateLanguageException (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoCaptureErrorContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoFailFastWithErrorContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoTransformError (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetErrorInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetErrorInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetCallContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetObjectContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SysAllocString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IIDFromString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DuplicateToken (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadToken (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockShared (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter InterlockedPushEntrySList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter InterlockedFlushSList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TrySubmitThreadpoolCallback (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateThreadpoolIo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter StartThreadpoolIo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CancelThreadpoolIo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CloseThreadpoolIo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateThreadpool (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolThreadMaximum (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetThreadpoolThreadMinimum (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CloseThreadpool (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetCurrentProcessExplicitAppUserModelID (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3DCompile (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3DDisassemble (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AddClipboardFormatListener (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RemoveClipboardFormatListener (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDisplayAutoRotationPreferences (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetDisplayAutoRotationPreferences (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnableMouseInPointer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerType (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerDeviceRects (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerTouchInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerFrameTouchInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerFrameTouchInfoHistory (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerPenInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetPointerPenInfoHistory (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SkipPointerFrameMessages (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetAwarenessFromDpiAwarenessContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SystemParametersInfoForDpi (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetProcessDpiAwareness (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetClassInfoW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterClassExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterPowerSettingNotification (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateDCW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter BuildTrusteeWithSidW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SystemParametersInfoW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowLongPtrW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateBitmap (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RtlFirstEntrySList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSysColorBrush (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LoadImageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter Direct3DCreate9 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter NtQueryWnfStateData (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RtlSubscribeWnfStateChangeNotification (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetTimer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter OpenAdapter (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3DKMTEnumAdapters2 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowPlacement (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetSystemMenu (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnableMenuItem (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsWindowVisible (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterDragDrop (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CoLockObjectExternal (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowRgn (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SendMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter MonitorFromPoint (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowTextW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter PropVariantToString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceRegKey (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInterfaceRegKeyW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInfoList (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInterfaceW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceAlias (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DMOEnum (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DMOGetTypes (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DMOGetName (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TraceEvent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTraceLoggerHandle (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTraceEnableLevel (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTraceEnableFlags (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter AddFontMemResourceEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateFontIndirectW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTextMetricsW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetFontData (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EnumFontFamiliesExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RemoveFontMemResourceEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetOutlineTextMetricsW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCharWidthI (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetTextFaceW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TryCreatePackageDependency (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DllGetActivationFactory (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCharABCWidthsI (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsIconic (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsChild (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipFillRectangleI (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipSetSolidFillColor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipDeleteBrush (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoActivateInstance (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoRegisterActivationFactories (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RoRevokeActivationFactories (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsGetStringRawBuffer (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsIsStringEmpty (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsStringHasEmbeddedNull (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateDIBSection (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateIconIndirect (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ConvertInterfaceLuidToNameW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ConvertInterfaceIndexToLuid (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ConvertInterfaceNameToLuidW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegNotifyChangeKeyValue (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter Shell_NotifyIconW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter MoveWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipDrawLineI (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdipDeletePen (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TranslateMessage (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DispatchMessageW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSANtohl (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSANtohs (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowFromDC (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter D3D11CreateDevice (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WindowsCompareStringOrdinal (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateDispatcherQueueController (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CreateRectRgn (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter DwmEnableBlurBehindWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCapture (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RevokeDragDrop (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter timeSetEvent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetUpdateRect (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GdiFlush (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetGlyphOutlineW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetTextAlign (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter timeKillEvent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CertOpenSystemStoreW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ToUnicode (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCharABCWidthsW (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00003176) "Telegram.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00003176) "zgqmQcC2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00005544) "zgqmQcC2.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00005544) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetMachineTypeAttributes (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter GMzamrWAqLU57 (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003768) "zgqmQcC2.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00003768)3c:T16ce2,Found reference to API (Indicator: "lstrlenA"; File: "tletgtup.exe") Found reference to API (Indicator: "WriteFile"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTempPathA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileSize"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcmpA"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcpyA"; File: "tletgtup.exe") Found reference to API (Indicator: "VirtualFree"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetStartupInfoA"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcatA"; File: "tletgtup.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "GetProcAddress"; File: "tletgtup.exe") Found reference to API (Indicator: "ExitProcess"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateFileA"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteFileA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetLastError"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateMutexA"; File: "tletgtup.exe") Found reference to API (Indicator: "FreeLibrary"; File: "tletgtup.exe") Found reference to API (Indicator: "wsprintfA"; File: "tletgtup.exe") Found reference to API (Indicator: "MessageBoxA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount64"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API (Indicator: "WNetEnumResourceW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SHGetMalloc"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "OemToCharBuffA"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetIconInfo"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetScrollInfo"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetCursorPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCursorPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenuState"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetKeyState"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetCursor"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "KillTimer"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WaitMessage"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateIconIndirect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetDCEx"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetTimer"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "WindowFromPoint"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "BeginPaint"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "OffsetRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMenu"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "SetScrollPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetScrollPos"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "DrawFocusRect"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ReleaseCapture"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorW"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "ScrollWindow"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API (Indicator: "StrToInt64ExW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "tletgtup.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "tletgtup.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "tletgtup.exe") Found reference to API (Indicator: "EqualSid"; File: "tletgtup.exe") Found reference to API (Indicator: "RegCloseKey"; File: "tletgtup.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "tletgtup.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "tletgtup.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadResource"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateEventW"; File: "tletgtup.exe") Found reference to API (Indicator: "LocalAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapFree"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapCreate"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFilePointer"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapDestroy"; File: "tletgtup.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "tletgtup.exe") Found reference to API (Indicator: "CompareStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "tletgtup.exe") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTickCount"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "tletgtup.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "tletgtup.exe") Found reference to API (Indicator: "GetVersionExW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateProcessW"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "tletgtup.exe") Found reference to API (Indicator: "IsValidLocale"; File: "tletgtup.exe") Found reference to API (Indicator: "SuspendThread"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API (Indicator: "SetLastError"; File: "tletgtup.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "tletgtup.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "FormatMessageW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "tletgtup.exe") Found reference to API (Indicator: "SwitchToThread"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "tletgtup.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "tletgtup.exe") Found reference to API (Indicator: "SetEvent"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCPInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "tletgtup.exe") Found reference to API (Indicator: "VirtualQuery"; File: "tletgtup.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "tletgtup.exe") Found reference to API (Indicator: "LCMapStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "tletgtup.exe") Found reference to API (Indicator: "TlsSetValue"; File: "tletgtup.exe") Found reference to API (Indicator: "Sleep"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "tletgtup.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "tletgtup.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "tletgtup.exe") Found reference to API (Indicator: "LockResource"; File: "tletgtup.exe") Found reference to API (Indicator: "FindResourceW"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrlenW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetVersion"; File: "tletgtup.exe") Found reference to API (Indicator: "FindClose"; File: "tletgtup.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCPInfoExW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "tletgtup.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "tletgtup.exe") Found reference to API (Indicator: "ResetEvent"; File: "tletgtup.exe") Found reference to API (Indicator: "GetLocalTime"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "tletgtup.exe") Found reference to API (Indicator: "TlsGetValue"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "tletgtup.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "GetACP"; File: "tletgtup.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "tletgtup.exe") Found reference to API (Indicator: "ResumeThread"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlUnwind"; File: "tletgtup.exe") Found reference to API (Indicator: "SizeofResource"; File: "tletgtup.exe") Found reference to API (Indicator: "GetStdHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "ExitThread"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "tletgtup.exe") Found reference to API (Indicator: "VirtualProtect"; File: "tletgtup.exe") Found reference to API (Indicator: "RaiseException"; File: "tletgtup.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "tletgtup.exe") Found reference to API (Indicator: "VariantClear"; File: "tletgtup.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "tletgtup.exe") Found reference to API (Indicator: "SysFreeString"; File: "tletgtup.exe") Found reference to API (Indicator: "VariantInit"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "tletgtup.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "tletgtup.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "tletgtup.exe") Found reference to API (Indicator: "VariantChangeType"; File: "tletgtup.exe") Found reference to API (Indicator: "VariantCopy"; File: "tletgtup.exe") Found reference to API (Indicator: "MessageBoxW"; File: "tletgtup.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "tletgtup.exe") Found reference to API (Indicator: "CharUpperW"; File: "tletgtup.exe") Found reference to API (Indicator: "TranslateMessage"; File: "tletgtup.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "tletgtup.exe") Found reference to API (Indicator: "GetUserNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetOEMCP"; File: "tletgtup.exe") Found reference to API (Indicator: "SetStdHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "tletgtup.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "tletgtup.exe") Found reference to API (Indicator: "MoveFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "tletgtup.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "tletgtup.exe") Found reference to API (Indicator: "EncodePointer"; File: "tletgtup.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "tletgtup.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "tletgtup.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "tletgtup.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "tletgtup.exe") Found reference to API (Indicator: "FlsGetValue"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "tletgtup.exe") Found reference to API (Indicator: "FlsSetValue"; File: "tletgtup.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "tletgtup.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "tletgtup.exe") Found reference to API (Indicator: "FlsAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "tletgtup.exe") Found reference to API (Indicator: "DecodePointer"; File: "tletgtup.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "FindNextFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "tletgtup.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "tletgtup.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "tletgtup.exe") Found reference to API (Indicator: "FlsFree"; File: "tletgtup.exe") Found reference to API (Indicator: "TerminateProcess"; File: "tletgtup.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileType"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "tletgtup.exe") Found reference to API (Indicator: "HeapSize"; File: "tletgtup.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "tletgtup.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "tletgtup.exe") Found reference to API (Indicator: "SysAllocString"; File: "tletgtup.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "tletgtup.exe") Found reference to API (Indicator: "CoUninitialize"; File: "tletgtup.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "tletgtup.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "tletgtup.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "tletgtup.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "tletgtup.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "tletgtup.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "tletgtup.exe") Found reference to API (Indicator: "AllocConsole"; File: "tletgtup.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "tletgtup.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "tletgtup.exe") Found reference to API (Indicator: "FindNextFileA"; File: "tletgtup.exe") Found reference to API (Indicator: "CompareStringA"; File: "tletgtup.exe") Found reference to API (Indicator: "CharLowerA"; File: "tletgtup.exe") Found reference to API (Indicator: "CharToOemA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalLock"; File: "tletgtup.exe") Found reference to API (Indicator: "MulDiv"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalFree"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcpynA"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "tletgtup.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "tletgtup.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "tletgtup.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetMessageA"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadCursorA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegisterClassA"; File: "tletgtup.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "tletgtup.exe") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "tletgtup.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "tletgtup.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "tletgtup.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "tletgtup.exe") Found reference to API (Indicator: "OleUninitialize"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "tletgtup.exe") Found reference to API (Indicator: "OleInitialize"; File: "tletgtup.exe") Found reference to API (Indicator: "CoInitialize"; File: "tletgtup.exe") Found reference to API (Indicator: "WTSRegisterSessionNotification"; File: "tletgtup.exe") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; File: "tletgtup.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "tletgtup.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "tletgtup.exe") Found reference to API (Indicator: "RegFlushKey"; File: "tletgtup.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteObject"; File: "tletgtup.exe") Found reference to API (Indicator: "SelectObject"; File: "tletgtup.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "tletgtup.exe") Found reference to API (Indicator: "GetObjectW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteDC"; File: "tletgtup.exe") Found reference to API (Indicator: "GetStockObject"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDIBits"; File: "tletgtup.exe") Found reference to API (Indicator: "BitBlt"; File: "tletgtup.exe") Found reference to API (Indicator: "StretchBlt"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "tletgtup.exe") Found reference to API (Indicator: "RoundRect"; File: "tletgtup.exe") Found reference to API (Indicator: "SetDIBits"; File: "tletgtup.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "WriteProfileStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateMutexW"; File: "tletgtup.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "tletgtup.exe") Found reference to API (Indicator: "CreatePipe"; File: "tletgtup.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "tletgtup.exe") Found reference to API (Indicator: "MoveFileExW"; File: "tletgtup.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcmpW"; File: "tletgtup.exe") Found reference to API (Indicator: "FreeResource"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenProcess"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenMutexW"; File: "tletgtup.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "tletgtup.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "tletgtup.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "tletgtup.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "tletgtup.exe") Found reference to API (Indicator: "FormatMessageA"; File: "tletgtup.exe") Found reference to API (Indicator: "CopyFileW"; File: "tletgtup.exe") Found reference to API (Indicator: "TerminateThread"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "tletgtup.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "tletgtup.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "tletgtup.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "tletgtup.exe") Found reference to API (Indicator: "CompareFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "tletgtup.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "tletgtup.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "tletgtup.exe") Found reference to API (Indicator: "CoDisconnectObject"; File: "tletgtup.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "tletgtup.exe") Found reference to API (Indicator: "IsEqualGUID"; File: "tletgtup.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "GetActiveObject"; File: "tletgtup.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "tletgtup.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "tletgtup.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "tletgtup.exe") Found reference to API (Indicator: "UpdateWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "RemoveMenu"; File: "tletgtup.exe") Found reference to API (Indicator: "SetCursor"; File: "tletgtup.exe") Found reference to API (Indicator: "HideCaret"; File: "tletgtup.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "tletgtup.exe") Found reference to API (Indicator: "ClientToScreen"; File: "tletgtup.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "tletgtup.exe") Found reference to API (Indicator: "DestroyMenu"; File: "tletgtup.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "tletgtup.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadIconW"; File: "tletgtup.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "AppendMenuW"; File: "tletgtup.exe") Found reference to API (Indicator: "DrawIcon"; File: "tletgtup.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "tletgtup.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "tletgtup.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "tletgtup.exe") Found reference to API (Indicator: "InsertMenuW"; File: "tletgtup.exe") Found reference to API (Indicator: "IsWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "ScreenToClient"; File: "tletgtup.exe") Found reference to API (Indicator: "DeleteMenu"; File: "tletgtup.exe") Found reference to API (Indicator: "InvalidateRect"; File: "tletgtup.exe") Found reference to API (Indicator: "GetWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "tletgtup.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadImageW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetParent"; File: "tletgtup.exe") Found reference to API (Indicator: "EnableWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "DestroyCursor"; File: "tletgtup.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "tletgtup.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateIcon"; File: "tletgtup.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "tletgtup.exe") Found reference to API (Indicator: "GetWindowRect"; File: "tletgtup.exe") Found reference to API (Indicator: "RedrawWindow"; File: "tletgtup.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "tletgtup.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "tletgtup.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpQueryOption"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpWriteData"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpSetStatusCallback"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "tletgtup.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTimeFormatA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDateFormatA"; File: "tletgtup.exe") Found reference to API (Indicator: "DelayLoadFailureHook"; File: "tletgtup.exe") Found reference to API (Indicator: "RaiseFailFastException"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFileInformationByHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "GetVolumePathNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetVolumeNameForVolumeMountPointW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "tletgtup.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "GlobalReAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "tletgtup.exe") Found reference to API (Indicator: "GetQueuedCompletionStatus"; File: "tletgtup.exe") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "tletgtup.exe") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "tletgtup.exe") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "tletgtup.exe") Found reference to API (Indicator: "GetModuleHandleExA"; File: "tletgtup.exe") Found reference to API (Indicator: "LoadStringA"; File: "tletgtup.exe") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "tletgtup.exe") Found reference to API (Indicator: "IdnToUnicode"; File: "tletgtup.exe") Found reference to API (Indicator: "IdnToAscii"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenFileMappingW"; File: "tletgtup.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "tletgtup.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "tletgtup.exe") Found reference to API (Indicator: "TlsFree"; File: "tletgtup.exe") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "tletgtup.exe") Found reference to API (Indicator: "TlsAlloc"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryUnbiasedInterruptTime"; File: "tletgtup.exe") Found reference to API (Indicator: "RegGetValueW"; File: "tletgtup.exe") Found reference to API (Indicator: "RegOpenCurrentUser"; File: "tletgtup.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegGetValueA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegCreateKeyExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegDeleteTreeA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegEnumKeyExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegSetValueExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegDeleteValueA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RegDeleteTreeW"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "tletgtup.exe") Found reference to API (Indicator: "StrToIntA"; File: "tletgtup.exe") Found reference to API (Indicator: "StrStrIW"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "tletgtup.exe") Found reference to API (Indicator: "CharUpperA"; File: "tletgtup.exe") Found reference to API (Indicator: "CharNextA"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateEventExA"; File: "tletgtup.exe") Found reference to API (Indicator: "ReleaseSRWLockShared"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeSRWLock"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateEventA"; File: "tletgtup.exe") Found reference to API (Indicator: "AcquireSRWLockShared"; File: "tletgtup.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "tletgtup.exe") Found reference to API (Indicator: "InitOnceExecuteOnce"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemTime"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "tletgtup.exe") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "GetProductInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "TrySubmitThreadpoolCallback"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseThreadpoolTimer"; File: "tletgtup.exe") Found reference to API (Indicator: "CancelThreadpoolIo"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseThreadpoolIo"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateThreadpoolWait"; File: "tletgtup.exe") Found reference to API (Indicator: "CallbackMayRunLong"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseThreadpoolWork"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateThreadpoolWork"; File: "tletgtup.exe") Found reference to API (Indicator: "SetThreadpoolWait"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseThreadpoolWait"; File: "tletgtup.exe") Found reference to API (Indicator: "StartThreadpoolIo"; File: "tletgtup.exe") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateThreadpoolIo"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateThreadpoolTimer"; File: "tletgtup.exe") Found reference to API (Indicator: "SetThreadpoolTimer"; File: "tletgtup.exe") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; File: "tletgtup.exe") Found reference to API (Indicator: "SubmitThreadpoolWork"; File: "tletgtup.exe") Found reference to API (Indicator: "QueueUserWorkItem"; File: "tletgtup.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "tletgtup.exe") Found reference to API (Indicator: "IsWow64Process"; File: "tletgtup.exe") Found reference to API (Indicator: "Wow64SetThreadDefaultGuestMachine"; File: "tletgtup.exe") Found reference to API (Indicator: "EventUnregister"; File: "tletgtup.exe") Found reference to API (Indicator: "EventWrite"; File: "tletgtup.exe") Found reference to API (Indicator: "EventRegister"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlGetVersion"; File: "tletgtup.exe") Found reference to API (Indicator: "NtSetInformationFile"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv6StringToAddressExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlAllocateHeap"; File: "tletgtup.exe") Found reference to API (Indicator: "NtClose"; File: "tletgtup.exe") Found reference to API (Indicator: "NtCreateFile"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlFreeHeap"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "tletgtup.exe") Found reference to API (Indicator: "NtQueryVolumeInformationFile"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv6AddressToStringA"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlFreeSid"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv4StringToAddressExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv6StringToAddressExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv4StringToAddressExA"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv6AddressToStringExA"; File: "tletgtup.exe") Found reference to API (Indicator: "NtQueryInformationToken"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv4AddressToStringExW"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv4AddressToStringA"; File: "tletgtup.exe") Found reference to API (Indicator: "RtlIpv6AddressToStringExW"; File: "tletgtup.exe") Found reference to API (Indicator: "LsaOpenPolicy"; File: "tletgtup.exe") Found reference to API (Indicator: "ControlService"; File: "tletgtup.exe") Found reference to API (Indicator: "LogonUserW"; File: "tletgtup.exe") Found reference to API (Indicator: "LsaAddAccountRights"; File: "tletgtup.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "tletgtup.exe") Found reference to API (Indicator: "EnumServicesStatusW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetServiceObjectSecurity"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "tletgtup.exe") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSecurityDescriptorDacl"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSidIdentifierAuthority"; File: "tletgtup.exe") Found reference to API (Indicator: "LookupAccountSidW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSidLengthRequired"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSidSubAuthority"; File: "tletgtup.exe") Found reference to API (Indicator: "OpenServiceW"; File: "tletgtup.exe") Found reference to API (Indicator: "LsaNtStatusToWinError"; File: "tletgtup.exe") Found reference to API (Indicator: "GetSidSubAuthorityCount"; File: "tletgtup.exe") Found reference to API (Indicator: "InitializeSid"; File: "tletgtup.exe") Found reference to API (Indicator: "StartServiceW"; File: "tletgtup.exe") Found reference to API (Indicator: "LookupAccountNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryServiceObjectSecurity"; File: "tletgtup.exe") Found reference to API (Indicator: "QueryServiceStatus"; File: "tletgtup.exe") Found reference to API (Indicator: "LsaClose"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTcpTable"; File: "tletgtup.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "tletgtup.exe") Found reference to API (Indicator: "FindResourceExW"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcatW"; File: "tletgtup.exe") Found reference to API (Indicator: "ReadProcessMemory"; File: "tletgtup.exe") Found reference to API (Indicator: "Process32FirstW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTempFileNameW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTempPathW"; File: "tletgtup.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcpyW"; File: "tletgtup.exe") Found reference to API (Indicator: "Process32NextW"; File: "tletgtup.exe") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "tletgtup.exe") Found reference to API (Indicator: "lstrcpynW"; File: "tletgtup.exe") Found reference to API (Indicator: "NetUserGetInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "NetGetDCName"; File: "tletgtup.exe") Found reference to API (Indicator: "NetGroupGetInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "NetApiBufferFree"; File: "tletgtup.exe") Found reference to API (Indicator: "NetUserModalsGet"; File: "tletgtup.exe") Found reference to API (Indicator: "NetQueryDisplayInformation"; File: "tletgtup.exe") Found reference to API (Indicator: "NetLocalGroupGetInfo"; File: "tletgtup.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "tletgtup.exe") Found reference to API (Indicator: "SHGetKnownFolderPath"; File: "tletgtup.exe") Found reference to API (Indicator: "PathFileExistsW"; File: "tletgtup.exe") Found reference to API (Indicator: "wsprintfW"; File: "tletgtup.exe") Found reference to API (Indicator: "BringWindowToTop"; File: "tletgtup.exe") Found reference to API (Indicator: "htonl"; File: "tletgtup.exe") Found reference to API (Indicator: "ntohs"; File: "tletgtup.exe") Found reference to API (Indicator: "gethostbyname"; File: "tletgtup.exe") Found reference to API (Indicator: "WSAStartup"; File: "tletgtup.exe") Found reference to API (Indicator: "WSACleanup"; File: "tletgtup.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "tletgtup.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "tletgtup.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "tletgtup.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "tletgtup.exe") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CallWindowProcA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "TranslateAcceleratorA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "LoadCursorA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetClassInfoA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "EqualSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RemoveDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUserA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "AllocConsole"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "CharLowerA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp") Found reference to API (Indicator: "CharToOemA"; Source: "00000000-00002028.00000000.120041.1000A000.00000002.mdmp")3d:T515,Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "tletgtup.exe") Found reference to API "LockResource" (Indicator: "LockResource"; File: "tletgtup.exe") Found reference to API "FindResourceW" (Indicator: "FindResource"; File: "tletgtup.exe") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "tletgtup.exe") Found reference to API "FreeResource" (Indicator: "FreeResource"; File: "tletgtup.exe") Found reference to API "FindResourceExW" (Indicator: "FindResource"; File: "tletgtup.exe") Found reference to API "dFindResourceA" (Indicator: "FindResource"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "dLoadResource" (Indicator: "LoadResource"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "dSizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")3e:T41e,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "tletgtup.exe") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "tletgtup.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "tletgtup.exe") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")3f:T734,"zgqmQcC2.exe" contains export function called "__dbk_fcall_wrapper" at ordinal 2 "zgqmQcC2.exe" contains export function called "dbkFCallWrapperAddr" at ordinal 1 "c7130ec1.dll" contains export function called "GMzamrWAqLU57" at ordinal 1 "genteert.dll" contains export function called "gentee_call" at ordinal 5 "genteert.dll" contains export function called "gentee_deinit" at ordinal 1 "genteert.dll" contains export function called "gentee_getid" at ordinal 6 "genteert.dll" contains export function called "gentee_init" at ordinal 2 "genteert.dll" contains export function called "gentee_load" at ordinal 4 "genteert.dll" contains export function called "gentee_ptr" at ordinal 7 "genteert.dll" contains export function called "gentee_set" at ordinal 3 "guig.dll" contains export function called "dlg_box" at ordinal 6 "guig.dll" contains export function called "dlg_boxindirect" at ordinal 16 "guig.dll" contains export function called "freepicture" at ordinal 19 "guig.dll" contains export function called "guig_deinit" at ordinal 15 "guig.dll" contains export function called "guig_init" at ordinal 14 "guig.dll" contains export function called "loadpicture" at ordinal 18 "guig.dll" contains export function called "loadrtffile" at ordinal 17 "guig.dll" contains export function called "paintpicture" at ordinal 20 "guig.dll" contains export function called "sh_admin" at ordinal 13 "guig.dll" contains export function called "sh_browsedir" at ordinal 7 "guig.dll" contains export function called "sh_regactivex" at ordinal 9 "guig.dll" contains export function called "sh_regtlb" at ordinal 11 "guig.dll" contains export function called "sh_shortcut" at ordinal 8 "guig.dll" contains export function called "sh_unregactivex" at ordinal 10 "guig.dll" contains export function called "sh_unregtlb" at ordinal 1240:Ta8c,"??\C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "??\c:\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "sers\PZMOHcN\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "sers\pzmohcn\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp41:Tee9,"Software\Embarcadero\Locales" in Source: 44596-147-0138BFF8 "Software\CodeGear\Locales" in Source: 44596-147-0138BFF8 "Software\Borland\Locales" in Source: 44596-147-0138BFF8 "Software\Borland\Delphi\Locales" in Source: 44596-147-0138BFF8 "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 44596-3796-0142C228 "SOFTWARE\TelegramDesktop\Capabilities" in Source: 00000000-00003176-00000BC1-948123223 "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp 00000000-00002028.00000001.121962.02F20000.00000004.mdmp 00000000-00002028.00000002.123880.02F20000.00000004.mdmp 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.049C0000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.049C0000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "/ 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, "3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.049C0000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, "\"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.049C0000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp 00000000-00002028.00000001.121962.049C0000.00000004.mdmp 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002028.00000001.121962.009E8000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432" in Source: 00000000-00002028.00000001.121962.009E8000.00000004.mdmp42:T8e1,Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5112:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5112:120:WilError_01" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5112:120:WilError_01" Process msedge.exe created mutex with name "Local\SM0:5112:120:WilError_01" Process msedge.exe created mutex with name "Local\SM0:5112:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:5112:120:WilError_01" Process msedge.exe created mutex with name "Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "SM0:5112:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5112:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\ChromeProcessSingletonStartup!" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3976:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:3976:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7944:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7944:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:7944:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:7944:304:WilStaging_02" Process tletgtup.exe created mutex with name "\Sessions\1\BaseNamedObjects\ci516940532" Process tletgtup.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2028:168:WilStaging_02" Process tletgtup.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2028:64:WilError_01" Process tletgtup.exe created mutex with name "SM0:2028:64:WilError_01" Process tletgtup.exe created mutex with name "Local\SM0:2028:168:WilStaging_02" Process tletgtup.exe created mutex with name "ci516940532" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7484:304:WilStaging_02"43:T5d6,Antivirus vendors marked dropped file "Telegram.msi" as clean (type is "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Last Printed: Fri Dec 11 11:47:44 2009 Create Time/Date: Fri Dec 11 11:47:44 2009 Last Saved Time/Date: Fri Sep 18 14:06:51 2020 Security: 0 Code page: 1252 Revision Number: {A30B958F-ABF8-47C7-81D4-C0C795019237} Number of Words: 2 Subject: Telegram Author: Telegram FZ-LLC Name of Creating Application: Telegram Template: ;1033 Comments: This installer database contains the logic and data required to install Telegram. Title: Installation Database Keywords: Installer MSI Database Number of Pages: 200") Antivirus vendors marked dropped file "genteert.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "guig.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "zgqmQcC2.tmp" as clean (type is "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"), Antivirus vendors marked dropped file "shiCBF2.tmp" as clean (type is "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"), Antivirus vendors marked dropped file "MSICC80.tmp" as clean (type is "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "_setup64.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections")44:T403,"zgqmQcC2.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "c7130ec1.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "zgqmQcC2.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "shiCBF2.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "MSICC80.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-695HK.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-NBT1Q.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE45:T3ff8,"STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.02F20000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002028.00000000.120041.04D50000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002028.00000001.121962.009E8000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432" in Source: 00000000-00002028.00000001.121962.009E8000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000001.121962.02F20000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002028.00000001.121962.02F20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000001.121962.02F20000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002028.00000001.121962.049C0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000002.123880.02F20000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002028.00000002.123880.02F20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000002.123880.02F20000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002028.00000002.123880.04D50000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002028.00000003.124928.02F20000.00000004.mdmp "chine\Software\Class4" in Source: 00000000-00003176.00000000.124508.91F40000.00000004.mdmp "e\Software\C" in Source: 00000000-00003176.00000000.124508.92B50000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003176.00000000.124508.D0798000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003176.00000000.124508.D0798000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000000.124508.D07EE000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000000.124508.D07EE000.00000004.mdmp "chine\Software\Class4" in Source: 00000000-00003176.00000001.126427.91F40000.00000004.mdmp "e\Software\C" in Source: 00000000-00003176.00000001.126427.92B50000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003176.00000001.126427.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}" in Source: 00000000-00003176.00000001.126427.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003176.00000001.126427.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003176.00000001.126427.99818000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003176.00000001.126427.99818000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003176.00000001.126427.D0797000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00003176.00000001.126427.D0797000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000001.126427.D07EE000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000001.126427.D07EE000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00003176.00000002.128347.6F03F000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00003176.00000002.128347.6F03F000.00000002.mdmp "chine\Software\Class4" in Source: 00000000-00003176.00000002.128347.91F40000.00000004.mdmp "e\Software\C" in Source: 00000000-00003176.00000002.128347.92B50000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}" in Source: 00000000-00003176.00000002.128347.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003176.00000002.128347.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003176.00000002.128347.93EB9000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003176.00000002.128347.99818000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}" in Source: 00000000-00003176.00000002.128347.99818000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000002.128347.D07EE000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00003176.00000002.128347.D07EE000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00003768.00000000.124668.008EC000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00003768.00000000.124668.02A70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003768.00000000.124668.73082000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00003768.00000000.124668.734D1000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00003768.00000000.124668.734D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00003768.00000000.124668.734D1000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00003768.00000000.124668.734D1000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00003768.00000001.124917.008EC000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005544.00000000.124552.01381000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005544.00000000.124552.01381000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00005544.00000000.124552.01381000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005544.00000000.124552.01381000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005544.00000000.124552.01381000.00000020.mdmp "s\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{752073A1-23F2-4396" in Source: 00000000-00005884.00000000.120291.00750000.00000004.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00005884.00000000.120291.01381000.00000020.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00005884.00000000.120291.01381000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00005884.00000000.120291.01381000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Caphyon\Advanced Installer\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Microsoft\Internet Explorer\Settings" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Caphyon\Setups" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\JavaSoft\Java Development Kit\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\JavaSoft\Java Runtime Environment\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\TempPackages" in Source: 00000000-00006604.00000000.120963.00CC0000.00000002.mdmp "Software\[Manufacturer]\[ProductName]" in Source: 00000000-00006604.00000000.120963.031D0000.00000004.mdmp "Software\Caphyon\Advanced Installer\LZMA\[ProductCode]\[ProductVersion]" in Source: 00000000-00006604.00000000.120963.031D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006604.00000000.120963.031D0000.00000004.mdmp "ound.Name of tableName of columnY;NWhether the column is nullableMinimum value allowedMaximum value allowedFor foreign key, Name of table to which data must linkColumn to which foreign key connectsText;Formatted;Template;Condition;Guid;Path;Version;Language;Identifier;Binary;UpperCase;LowerCase;Filename;Paths;AnyPath;WildCardFilename;RegPath;KeyFormatted;CustomSource;Property;Cabinet;Shortcut;URLString categorySoftware\[Manufacturer]\[ProductName][ProductVersion]Software\Caphyon\Advanced Installer\LZMA\[Pro@HYE" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp " to HKEY_USERS\" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\ProductOptions" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer\User Accounts\%s" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer\User Accounts\%s\Rollback" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer\User Accounts\" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer\" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\%s" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "System\CurrentControlSet\Hardware Profiles\Current\" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Caphyon\Advanced Installer\Installation Path" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "SOFTWARE\Microsoft\InetStp" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00006604.00000000.120963.077C0000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006604.00000000.120963.07E20000.00000004.mdmp "Software\[Manufacturer]\[ProductName]" in Source: 00000000-00006604.00000001.122882.031D0000.00000004.mdmp "Software\Caphyon\Advanced Installer\LZMA\[ProductCode]\[ProductVersion]" in Source: 00000000-00006604.00000001.122882.031D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006604.00000001.122882.031D0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006604.00000001.122882.07E20000.00000004.mdmp "KEY_CURRENT_USER\Software\AiTemp" in Source: 00000000-00006604.00000002.124223.07E3A000.00000004.mdmp46:T69c,"GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,*" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Tue 29 Sep 2026 15:12:31 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 584 CF-RAY: a42bed36eadc2a0c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,*" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Tue 29 Sep 2026 15:12:38 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 584 CF-RAY: a42bed5f8a8f9a11-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365.......47:T426,Launches browser "msedge.exe" (UID: 00000000-00007028) Launches browser "msedge.exe" (UID: 00000000-00003976) Launches browser "msedge.exe" (UID: 00000000-00007944) Launches browser "msedge.exe" (UID: 00000000-00006460) Launches browser "msedge.exe" (UID: 00000000-00006424) Launches browser "msedge.exe" (UID: 00000000-00005300) Launches browser "msedge.exe" (UID: 00000000-00007484) Launches browser "msedge.exe" (UID: 00000000-00006708) Launches browser "msedge.exe" (UID: 00000000-00000192) Launches browser "msedge.exe" (UID: 00000000-00005256) Launches browser "msedge.exe" (UID: 00000000-00003636) Launches browser "msedge.exe" (UID: 00000000-00004436) Launches browser "msedge.exe" (UID: 00000000-00008064) Launches browser "msedge.exe" (UID: 00000000-00007872) Launches browser "msedge.exe" (UID: 00000000-00001468) Launches browser "msedge.exe" (UID: 00000000-00006936) Launches browser "msedge.exe" (UID: 00000000-00007868) Launches browser "msedge.exe" (UID: 00000000-00005880) Launches browser "msedge.exe" (UID: 00000000-00007680)48:T3350,"tletgtup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74170000 "tletgtup.exe" loaded module "%TEMP%\GENTEERT.DLL" at base 10000000 "tletgtup.exe" loaded module "KERNEL32.DLL" at base 74570000 "tletgtup.exe" loaded module "SHELL32.DLL" at base 74f20000 "tletgtup.exe" loaded module "USER32.DLL" at base 74640000 "tletgtup.exe" loaded module "OLE32.DLL" at base 747d0000 "tletgtup.exe" loaded module "ADVAPI32.DLL" at base 74430000 "tletgtup.exe" loaded module "VERSION.DLL" at base 74140000 "tletgtup.exe" loaded module "%TEMP%\GENTEE27\GUIG.DLL" at base 49e0000 "tletgtup.exe" loaded module "COMCTL32.DLL" at base 73f20000 "tletgtup.exe" loaded module "GDI32.DLL" at base 74ec0000 "tletgtup.exe" loaded module "OLEAUT32.DLL" at base 77590000 "tletgtup.exe" loaded module "MPR.DLL" at base 73f00000 "tletgtup.exe" loaded module "RPCRT4.DLL" at base 77670000 "tletgtup.exe" loaded module "SSPICLI.DLL" at base 74390000 "tletgtup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e80000 "tletgtup.exe" loaded module "NTDLL.DLL" at base 77a60000 "tletgtup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73c50000 "tletgtup.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 76b60000 "tletgtup.exe" loaded module "RICHED20.DLL" at base 73bd0000 "tletgtup.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73730000 "tletgtup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742e0000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74170000 "cscript.exe" loaded module "KERNEL32.DLL" at base 74570000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e80000 "cscript.exe" loaded module "RPCRT4.DLL" at base 77670000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\VBSCRIPT.DLL" at base 735f0000 "cscript.exe" loaded module "AMSI.DLL" at base 735e0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74140000 "cscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 73590000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74c00000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74c00000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c00000 "cscript.exe" loaded module "KERNEL32" at base 74570000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\QKD5CNX4.DLL" at base 73550000 "cscript.exe" loaded module "WLDP.DLL" at base 73530000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74430000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 77a10000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73500000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 734f0000 "cscript.exe" loaded module "OLE32.DLL" at base 747d0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 77730000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 734d0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 73490000 "Telegram.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe85620000 "Telegram.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe93fa0000 "Telegram.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe93fa0000 "Telegram.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffe93fa0000 "Telegram.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe93fa0000 "Telegram.exe" loaded module "KERNEL32" at base 7ffe97850000 "Telegram.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe93fa0000 "Telegram.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe93fa0000 "Telegram.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe93fa0000 "Telegram.exe" loaded module "KERNEL32.DLL" at base 7ffe97850000 "Telegram.exe" loaded module "SHELL32.DLL" at base 7ffe955a0000 "Telegram.exe" loaded module "PROPSYS.DLL" at base 7ffe903c0000 "Telegram.exe" loaded module "PSAPI.DLL" at base 7ffe973f0000 "Telegram.exe" loaded module "USER32.DLL" at base 7ffe95300000 "Telegram.exe" loaded module "SHCORE.DLL" at base 7ffe95490000 "Telegram.exe" loaded module "API-MS-WIN-SECURITY-SYSTEMFUNCTIONS-L1-1-0" at base 7ffe95250000 "Telegram.exe" loaded module "ADVAPI32.DLL" at base 7ffe95250000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7ffe955a0000 "Telegram.exe" loaded module "OLE32.DLL" at base 7ffe97620000 "Telegram.exe" loaded module "OLEAUT32.DLL" at base 7ffe969e0000 "Telegram.exe" loaded module "COMBASE.DLL" at base 7ffe970e0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe92360000 "Telegram.exe" loaded module "%PROGRAMFILES%\(X86)\TELEGRAM\MODULES\X64\D3D\D3DCOMPILER_47.DLL" at base 7ffe6ecb0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe931c0000 "Telegram.exe" loaded module "VERSION.DLL" at base 7ffe8a590000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\USER32.DLL" at base 7ffe95300000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\SHCORE.DLL" at base 7ffe95490000 "Telegram.exe" loaded module "GDI32.DLL" at base 7ffe951e0000 "Telegram.exe" loaded module "USERENV.DLL" at base 7ffe93c50000 "Telegram.exe" loaded module "NTDLL.DLL" at base 7ffe979d0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\PSAPI.DLL" at base 7ffe973f0000 "Telegram.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe93db0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\D3D9.DLL" at base 7ffe6eb10000 "Telegram.exe" loaded module "RPCRT4.DLL" at base 7ffe95040000 "Telegram.exe" loaded module "D3D10WARP.DLL" at base 7ffe8d180000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 7ffe7d5a0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7ffe8e0b0000 "Telegram.exe" loaded module "MMDEVAPI.DLL" at base 7ffe8e0b0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\DEVENUM.DLL" at base 7ffe8c850000 "Telegram.exe" loaded module "SETUPAPI.DLL" at base 7ffe96ab0000 "Telegram.exe" loaded module "MSDMO.DLL" at base 7ffe85cd0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\DWRITE.DLL" at base 7ffe82d80000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\GDI32.DLL" at base 7ffe951e0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffe94440000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7ffe903c0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINTYPES.DLL" at base 7ffe8ee80000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.MEDIA.MEDIACONTROL.DLL" at base 7ffe83280000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7ffe92750000 "Telegram.exe" loaded module "WINDOWS.WEB.DLL" at base 7ffe7c010000 "Telegram.exe" loaded module "GDIPLUS.DLL" at base 7ffe718c0000 "Telegram.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.16299.248_NONE_46B9C4E9EDF1CFA5\GDIPLUS.DLL" at base 7ffe718c0000 "Telegram.exe" loaded module "DWMAPI.DLL" at base 7ffe925d0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\DIRECTMANIPULATION.DLL" at base 7ffe823a0000 "Telegram.exe" loaded module "WTSAPI32.DLL" at base 7ffe8fb80000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7ffe7df60000 "Telegram.exe" loaded module "UXTHEME.DLL" at base 7ffe92360000 "Telegram.exe" loaded module "IPHLPAPI.DLL" at base 7ffe93340000 "Telegram.exe" loaded module "WS2_32.DLL" at base 7ffe975b0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 7ffe909a0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 7ffe8ccc0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTP.DLL" at base 7ffe90580000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe95250000 "Telegram.exe" loaded module "SSPICLI.DLL" at base 7ffe93c20000 "Telegram.exe" loaded module "WINHTTP.DLL" at base 7ffe90580000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffe75940000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 2a8928e0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\NAPINSP.DLL" at base 7ffe83260000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\PNRPNSP.DLL" at base 7ffe80ea0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7ffe8fbb0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe935b0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINRNR.DLL" at base 7ffe855f0000 "Telegram.exe" loaded module "DXGI.DLL" at base 7ffe92b90000 "Telegram.exe" loaded module "D3D11.DLL" at base 7ffe910f0000 "Telegram.exe" loaded module "DCOMP.DLL" at base 7ffe91a80000 "Telegram.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffe926c0000 "Telegram.exe" loaded module "COREMESSAGING.DLL" at base 7ffe913e0000 "Telegram.exe" loaded module "IMM32.DLL" at base 7ffe95220000 "Telegram.exe" loaded module "WINMM.DLL" at base 7ffe8b180000 "Telegram.exe" loaded module "CRYPT32.DLL" at base 7ffe93dd0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe8b7d0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe8cdc0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffe7d100000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffe7ddb0000 "Telegram.exe" loaded module "CSCAPI.DLL" at base 7ffe86230000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe94be0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7ffe97620000 "Telegram.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffe95300000 "Telegram.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 7ffe95300000 "Telegram.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffe970e0000 "zgqmQcC2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74170000 "zgqmQcC2.exe" loaded module "KERNEL32.DLL" at base 74570000 "zgqmQcC2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74f20000 "zgqmQcC2.exe" loaded module "RPCRT4.DLL" at base 77670000 "zgqmQcC2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e80000 "zgqmQcC2.exe" loaded module "NTDLL.DLL" at base 77a60000 "zgqmQcC2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 742e0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74170000 "zgqmQcC2.tmp" loaded module "KERNEL32.DLL" at base 74570000 "zgqmQcC2.tmp" loaded module "MSCTF.DLL" at base 778c0000 "zgqmQcC2.tmp" loaded module "IMM32.DLL" at base 74ef0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73e80000 "zgqmQcC2.tmp" loaded module "NTDLL.DLL" at base 77a60000 "zgqmQcC2.tmp" loaded module "RPCRT4.DLL" at base 77670000 "zgqmQcC2.tmp" loaded module "UXTHEME.DLL" at base 73e80000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 74f20000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 735e0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 735b0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 77140000 "zgqmQcC2.tmp" loaded module "COMCTL32" at base 73f20000 "zgqmQcC2.tmp" loaded module "COMCTL32.DLL" at base 73f20000 "zgqmQcC2.tmp" loaded module "USER32.DLL" at base 74640000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74de0000 "zgqmQcC2.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 734d0000 "zgqmQcC2.tmp" loaded module "OLEAUT32.DLL" at base 77590000 "zgqmQcC2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74640000 "zgqmQcC2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74640000 "zgqmQcC2.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76370000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 778c0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 747d0000 "zgqmQcC2.tmp" loaded module "SSPICLI.DLL" at base 74390000 "zgqmQcC2.tmp" loaded module "DWMAPI.DLL" at base 73700000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 4bf0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 73730000 "zgqmQcC2.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 74c00000 "zgqmQcC2.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74c00000 "zgqmQcC2.tmp" loaded module "KERNEL32" at base 74570000 "zgqmQcC2.tmp" loaded module "%TEMP%\IS-B4JP8.TMP\C7130EC1.DLL" at base 73070000 "zgqmQcC2.tmp" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 77390000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72fe0000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 7370000049:T529,"tletgtup.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "tletgtup.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD0000 "cscript.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "cscript.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD0000 "Telegram.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "Telegram.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD0000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 94BE0000 "msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 93880000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "MsiExec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD0000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD0000 "Telegram.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 94BE0000 "Telegram.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 93880000 "zgqmQcC2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 77140000 "zgqmQcC2.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73DD00004a:Td0c,"tletgtup.exe" was detected as "Gentee Installer" and name: "Installer" "tletgtup.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "tletgtup.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "tletgtup.exe" was detected as "Microsoft Linker" and name: "Linker" "zgqmQcC2.exe" was detected as "Gentee Installer" and name: "Installer" "zgqmQcC2.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zgqmQcC2.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zgqmQcC2.exe" was detected as "Microsoft Linker" and name: "Linker" "c7130ec1.dll" was detected as "Gentee Installer" and name: "Installer" "c7130ec1.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "c7130ec1.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "c7130ec1.dll" was detected as "Microsoft Linker" and name: "Linker" "genteert.dll" was detected as "Gentee Installer" and name: "Installer" "genteert.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "genteert.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "genteert.dll" was detected as "Microsoft Linker" and name: "Linker" "guig.dll" was detected as "Gentee Installer" and name: "Installer" "guig.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "guig.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "guig.dll" was detected as "Microsoft Linker" and name: "Linker" "zgqmQcC2.tmp" was detected as "Gentee Installer" and name: "Installer" "zgqmQcC2.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "zgqmQcC2.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "zgqmQcC2.tmp" was detected as "Microsoft Linker" and name: "Linker" "shiCBF2.tmp" was detected as "Gentee Installer" and name: "Installer" "shiCBF2.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "shiCBF2.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "shiCBF2.tmp" was detected as "Microsoft Linker" and name: "Linker" "MSICC80.tmp" was detected as "Gentee Installer" and name: "Installer" "MSICC80.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "MSICC80.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "MSICC80.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-695HK.tmp" was detected as "Gentee Installer" and name: "Installer" "is-695HK.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-695HK.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-695HK.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-NBT1Q.tmp" was detected as "Gentee Installer" and name: "Installer" "is-NBT1Q.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-NBT1Q.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-NBT1Q.tmp" was detected as "Microsoft Linker" and name: "Linker" "_setup64.tmp" was detected as "Gentee Installer" and name: "Installer" "_setup64.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_setup64.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_setup64.tmp" was detected as "Microsoft Linker" and name: "Linker"4b:Tf07,"tletgtup.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "tletgtup.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "tletgtup.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "tletgtup.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "tletgtup.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "tletgtup.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "tletgtup.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "tletgtup.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "cscript.exe" touched "VBScript Language Encoding" (Path: "HKCU\WOW6432NODE\CLSID\{B54F3743-5B07-11CF-A4B0-00AA004A55E8}") "cscript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "cscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\WOW6432NODE\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "Telegram.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "Telegram.exe" touched "Msi install server" (Path: "HKCU\WOW6432NODE\CLSID\{000C101C-0000-0000-C000-000000000046}\TREATAS") "Telegram.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{000C103E-0000-0000-C000-000000000046}\TREATAS") "Telegram.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}") "Telegram.exe" touched "System Device Enumerator" (Path: "HKCU\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\TREATAS") "Telegram.exe" touched "VFW Capture Class Manager" (Path: "HKCU\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "Telegram.exe" touched "Shortcut" (Path: "HKCU\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Telegram.exe" touched "@%SystemRoot%\system32\shell32.dll,-22067" (Path: "HKCU\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\SHELLFOLDER") "Telegram.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Telegram.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "Telegram.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Telegram.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "Telegram.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "Telegram.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "zgqmQcC2.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "zgqmQcC2.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "zgqmQcC2.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "zgqmQcC2.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS")4c:T46e,"tletgtup.exe" has an writable section named ".data" "zgqmQcC2.exe" has an writable section named ".data" "zgqmQcC2.exe" has an writable section named ".bss" "zgqmQcC2.exe" has an writable section named ".idata" "zgqmQcC2.exe" has an writable section named ".didata" "zgqmQcC2.exe" has an writable section named ".tls" "c7130ec1.dll" has an writable section named ".data" "c7130ec1.dll" has an writable section named ".fptable" "genteert.dll" has an writable section named ".data" "guig.dll" has an writable section named ".data" "zgqmQcC2.tmp" has an writable section named ".data" "zgqmQcC2.tmp" has an writable section named ".bss" "zgqmQcC2.tmp" has an writable section named ".idata" "zgqmQcC2.tmp" has an writable section named ".didata" "zgqmQcC2.tmp" has an writable section named ".tls" "shiCBF2.tmp" has an writable section named ".data" "shiCBF2.tmp" has an writable section named ".didat" "MSICC80.tmp" has an writable section named ".data" "is-695HK.tmp" has an writable section named ".data" "is-695HK.tmp" has an writable section named ".fptable" "_setup64.tmp" has an writable section named ".data"4d:T1cd7,"tletgtup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x402128,push 0x401ea0,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x402088],pop ecx,or dword ptr [0x403554], 0xffffffff,or dword ptr [0x403558], 0xffffffff,call dword ptr [0x402084],mov ecx, dword ptr [0x4032cc],mov dword ptr [eax], ecx,call dword ptr [0x402080],mov ecx, dword ptr [0x4032c8],mov dword ptr [eax], ecx,mov eax, dword ptr [0x40207c]," "zgqmQcC2.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x5c,push ebx,push esi,push edi,xor eax, eax,mov dword ptr [ebp - 0x3c], eax,mov dword ptr [ebp - 0x40], eax,mov dword ptr [ebp - 0x5c], eax,mov dword ptr [ebp - 0x30], eax,mov dword ptr [ebp - 0x38], eax,mov dword ptr [ebp - 0x34], eax,mov dword ptr [ebp - 0x2c], eax,mov dword ptr [ebp - 0x28], eax,mov dword ptr [ebp - 0x14], eax,mov eax, 0x4a8194,call 0x40e5c8,xor eax, eax,push ebp,push 0x4ad6e5,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,xor edx, edx,push ebp,push 0x4ad69f,push dword ptr fs:[edx],mov dword ptr fs:[edx], esp,mov eax, dword ptr [0x4b5634],call 0x4a69b4,call 0x4a650c,lea edx, [ebp - 0x14],xor eax, eax," "c7130ec1.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x10004dde,call 0x10004e00,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10004c90,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [0x1001a0c0],sub esp, 0x14,cmp eax, 0xbb40e64e,je 0x10004e24,test eax, 0xffff0000,je 0x10004e24,not eax,mov dword ptr [0x1001a100], eax,mov esp, ebp,pop ebp,ret ,lea eax, [ebp - 0xc],xorps xmm0, xmm0,push eax,movlpd qword ptr [ebp - 0xc], xmm0," "genteert.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x100010e7,cmp dword ptr [0x1000ce20], 0,jmp 0x1000110d,cmp esi, 1,je 0x100010f1,cmp esi, 2,jne 0x10001113,mov eax, dword ptr [0x1000ce38],test eax, eax,je 0x10001103,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1000110f,push edi,push esi,push ebx,call 0x10001020,test eax, eax,jne 0x10001113,xor eax, eax,jmp 0x10001161,push edi,push esi,push ebx,call 0x10001000,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1000112f,test eax, eax,jne 0x1000115e,push edi,push eax,push ebx,call 0x10001020," "guig.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10001d95,cmp dword ptr [0x10003074], 0,jmp 0x10001dbb,cmp esi, 1,je 0x10001d9f,cmp esi, 2,jne 0x10001dc1,mov eax, dword ptr [0x100032f0],test eax, eax,je 0x10001db1,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10001dbd,push edi,push esi,push ebx,call 0x10001cce,test eax, eax,jne 0x10001dc1,xor eax, eax,jmp 0x10001e0f,push edi,push esi,push ebx,call 0x1000161c,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10001ddd,test eax, eax,jne 0x10001e0c,push edi,push eax,push ebx,call 0x10001cce," "zgqmQcC2.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6c72e0,call 0x411f60,xor eax, eax,push ebp,push 0x6da92c,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x4159ec,call 0x6c7044,mov eax, dword ptr [0x6c6f34],push eax,push 0x6c6fcc,mov eax, dword ptr [0x6e510c],mov eax, dword ptr [eax],call 0x5b893c,mov eax, 0x66c49c,mov edx, dword ptr [0x6e4f80],mov dword ptr [edx], eax,mov eax, dword ptr [0x6e506c],mov dword ptr [eax], 1,push 0,mov eax, dword ptr [0x6e510c]," "shiCBF2.tmp" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x1800b9be1,call 0x1800ba5c0,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x1800b9c00,int3 ,int3 ,int3 ,mov rax, rsp,mov qword ptr [rax + 0x20], rbx,mov qword ptr [rax + 0x18], r8,mov dword ptr [rax + 0x10], edx,mov qword ptr [rax + 8], rcx,push rsi,push rdi,push r14,sub rsp, 0x150,mov edi, edx,mov r14, rcx," "MSICC80.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1002d435,call 0x1002d92b,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x1002d2f1,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 0xf,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x1002da10,push ecx,lea ecx, [esp + 8],sub ecx, eax,and ecx, 7,add eax, ecx,sbb ecx, ecx,or eax, ecx,pop ecx,jmp 0x1002da10,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx," "is-695HK.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100028ee,call 0x10002910,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x100027a0,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [0x10024000],sub esp, 0x14,cmp eax, 0xbb40e64e,je 0x10002934,test eax, 0xffff0000,je 0x10002934,not eax,mov dword ptr [0x10024040], eax,mov esp, ebp,pop ebp,ret ,lea eax, [ebp - 0xc],xorps xmm0, xmm0,push eax,movlpd qword ptr [ebp - 0xc], xmm0," "is-NBT1Q.tmp" file has an entrypoint instructions - "push ebx,push edi,push esi,xor edx, edx,xor edi, edi,inc edi,mov ebx, 0x63,xor ecx, ecx,mov esi, edx,cmp ecx, 3,jbe 0x400d0f,cmp ecx, 0x63,jne 0x400d03,jmp 0x400d6f,jmp dword ptr [ecx*4 + 0x401604],call 0x400bff,mov ecx, 3,jmp 0x400d03,call 0x4006e0,mov ecx, 0x63,mov edx, edi,test eax, eax,je 0x400d01,push edi,push 0,call 0x401060,add esp, 8,mov dword ptr [0x40179c], eax,test eax, eax,cmove esi, edi,mov ecx, edi,jmp 0x400d5a,call 0x400a88,test eax, eax,cmove esi, eax," "_setup64.tmp" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400012a4,mov ecx, eax,call qword ptr [rip + 0xb8f],int3 ,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,"4e:T4da7,Process "msedge.exe" (UID: 00000000-00007028) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00003976) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006460) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "tletgtup.exe" (UID: 00000000-00002028) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="PZMOHcN", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "tletgtup.exe" (UID: 00000000-00002028) was launched with modified environment variables: "Path" Process "tletgtup.exe" (UID: 00000000-00002028) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00006708) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00006708) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00006708) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "cscript.exe" (UID: 00000000-00005884) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="x86", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="PZMOHcN", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\(x86)\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", PROCESSOR_ARCHITEW6432="AMD64", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="%PROGRAMFILES%\(x86)", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="8", windir="C:\WINDOWS"" Process "cscript.exe" (UID: 00000000-00005884) was launched with modified environment variables: "Path" Process "cscript.exe" (UID: 00000000-00005884) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "msiexec.exe" (UID: 00000000-00007080) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msiexec.exe" (UID: 00000000-00007080) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE" Process "MsiExec.exe" (UID: 00000000-00005716) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", LOGONSERVER="%HOSTNAME%", OneDrive="%USERPROFILE%\OneDrive", USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00005716) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00000192) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00000192) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00000192) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "MsiExec.exe" (UID: 00000000-00006296) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "MsiExec.exe" (UID: 00000000-00006296) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "MsiExec.exe" (UID: 00000000-00006296) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00005256) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00005256) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00005256) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, PROCESSOR_ARCHITEW6432, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00003636) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="PZMOHcN", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "MsiExec.exe" (UID: 00000000-00001752) was launched with modified environment variables: "Path" Process "MsiExec.exe" (UID: 00000000-00001752) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, USERDNSDOMAIN, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00004436) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERDNSDOMAIN="DESKTOP-FVVF82A", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00004436) was launched with modified environment variables: "Path" Process "MsiExec.exe" (UID: 00000000-00004064) was launched with modified environment variables: "Path" Process "MsiExec.exe" (UID: 00000000-00004064) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_USER_DATA_DIR, USERDNSDOMAIN, EDGE_METRICS_CLIENT_ID_HASH, EDGE_BROWSER_PID" Process "msedge.exe" (UID: 00000000-00008064) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00008064) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00008064) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "Telegram.exe" (UID: 00000000-00003176) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", USERNAME="PZMOHcN", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS"" Process "Telegram.exe" (UID: 00000000-00003176) was launched with modified environment variables: "Path" Process "Telegram.exe" (UID: 00000000-00003176) was launched with missing environment variables: "EDGE_CRASHPAD_PIPE_NAME, COMPONENT_INSTALLER_DIR, EDGE_BROWSER_PID" Process "zgqmQcC2.exe" (UID: 00000000-00005544) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "zgqmQcC2.exe" (UID: 00000000-00005544) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00007872) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_5112_LNHLWCORWPSVDJHL", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_BROWSER_PID="5112"" Process "msedge.exe" (UID: 00000000-00007872) was launched with modified environment variables: "Path" Process "msedge.exe" (UID: 00000000-00007872) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, OneDrive, APPDATA, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, PROCESSOR_ARCHITEW6432, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir" Process "msedge.exe" (UID: 00000000-00001468) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="PZMOHcN", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00006936) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00007868) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="U3UMwzXsKJVfY4M", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="PZMOHcN", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="U3UMwzXsKJVfY4M", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\PZMOHcN", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\PZMOHcN", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00005880) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"4f:T7de,"tletgtup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tletgtup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tletgtup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tletgtup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: ".") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "..") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "0409") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ADVANCEDINSTALLERS") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "APPLOCKER") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BESTPRACTICES") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BTHPROPS") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CATROOT") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "COM") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CONFIG")50:T714,Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00005884-00000C2B-870945583] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00005884-00000C2B-871352582] Observed system executable string:"%WINDIR%\system32\shell32.dll" [Source: 00000000-00003176-00000C2B-936793222] Observed system executable string:"%WINDIR%\system32\user32.dll" [Source: 00000000-00003176-00000C2B-937226225] Observed system executable string:"%WINDIR%\system32\SHCore.dll" [Source: 00000000-00003176-00000C2B-937255797] Observed system executable string:"%WINDIR%\system32\psapi.dll" [Source: 00000000-00003176-00000C2B-937323055] Observed system executable string:"%WINDIR%\system32\d3d9.dll" [Source: 00000000-00003176-00000C2B-937370026] Observed system executable string:"%WINDIR%\system32\dwrite.dll" [Source: 00000000-00003176-00000C2B-937871318] Observed system executable string:"%WINDIR%\system32\gdi32.dll" [Source: 00000000-00003176-00000C2B-937886962] Observed system executable string:"%WINDIR%\system32\winhttp.dll" [Source: 00000000-00003176-00000C2B-944828982] Observed system executable string:"%WINDIR%\system32\Advapi32.dll" [Source: 00000000-00003176-00000C2B-945090313] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003768-00000C2B-939799204] Observed system executable string:"%WINDIR%\system32\shfolder.dll" [Source: 00000000-00003768-00000C2B-939995418] Observed system executable string:"%WINDIR%\system32\Rstrtmgr.dll" [Source: 00000000-00003768-00000C2B-940024852] Observed system executable string:"%WINDIR%\system32\shlwapi.dll" [Source: 00000000-00003768-00000C2B-940999541] Observed system executable string:"%WINDIR%\system32\sfc.dll" [Source: 00000000-00003768-00000C2B-941632583]51:Tc4c,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007028), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007944), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006460), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00006424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005300), Spawned process "tletgtup.exe" (UID: 00000000-00002028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007484), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00006708), Spawned process "cscript.exe" with commandline "/nologo "%APPDATA%\\Telegram\\adddf.vbe" C:\\" (UID: 00000000-00005884), Spawned process "Telegram.exe" (UID: 00000000-00006604), Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00007080), Spawned process "MsiExec.exe" with commandline "-Embedding 5DE61576F4706DD039D05539C82777F5 C" (UID: 00000000-00005716), Spawned process "msiexec.exe" with commandline "/i "%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Teleg ..." (UID: 00000000-00004396) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000192) Spawned process "MsiExec.exe" with commandline "-Embedding 9207F3247ECA5D17310D6690D137DC00 C" (UID: 00000000-00006296) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005256) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00003636) Spawned process "MsiExec.exe" with commandline "-Embedding 92934C34447114445647FD3DA00882EF" (UID: 00000000-00001752) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004436) Spawned process "MsiExec.exe" with commandline "-Embedding CEAF7B35BECB5F507545A2B757B2445E E Global\\MSI0000" (UID: 00000000-00004064) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008064) Spawned process "zgqmQcC2.exe" (UID: 00000000-00005544) Spawned process "zgqmQcC2.tmp" with commandline "/SL5="$E0290 1022629 821760 %TEMP%\\gentee27\\zgqmQcC2.exe"" (UID: 00000000-00003768) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007872)52:Tc4c,Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00007028), Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00003976), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00007944), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006460), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00006424), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00005300), Spawned process "tletgtup.exe" (UID: 00000000-00002028), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00007484), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00006708), Spawned process "cscript.exe" with commandline "/nologo "%APPDATA%\\Telegram\\adddf.vbe" C:\\" (UID: 00000000-00005884), Spawned process "Telegram.exe" (UID: 00000000-00006604), Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00007080), Spawned process "MsiExec.exe" with commandline "-Embedding 5DE61576F4706DD039D05539C82777F5 C" (UID: 00000000-00005716), Spawned process "msiexec.exe" with commandline "/i "%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Teleg ..." (UID: 00000000-00004396) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00000192) Spawned process "MsiExec.exe" with commandline "-Embedding 9207F3247ECA5D17310D6690D137DC00 C" (UID: 00000000-00006296) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00005256) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00003636) Spawned process "MsiExec.exe" with commandline "-Embedding 92934C34447114445647FD3DA00882EF" (UID: 00000000-00001752) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004436) Spawned process "MsiExec.exe" with commandline "-Embedding CEAF7B35BECB5F507545A2B757B2445E E Global\\MSI0000" (UID: 00000000-00004064) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00008064) Spawned process "zgqmQcC2.exe" (UID: 00000000-00005544) Spawned process "zgqmQcC2.tmp" with commandline "/SL5="$E0290 1022629 821760 %TEMP%\\gentee27\\zgqmQcC2.exe"" (UID: 00000000-00003768) Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00007872)53:Ted2,The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 02, O=Microsoft Corporation, C=US" (SHA1: A6:C8:B1:18:C0:60:D3:F0:04:B0:D4:F0:4B:C2:0D:A6:7E:6C:0A:01; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 33:6D:3E:54:51:31:52:94:F6:E1:E7:CF:DA:84:E5:1C:8B:1E:40:54; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7F:A0:5A:CF:9B:4A:AB:B0:DE:0C:FA:FA:29:7D:DF:92:FD:C5:F3:F5; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 26:7E:93:E6:E3:1A:7D:88:ED:C8:FC:60:E9:19:8B:B8:C9:D7:53:24; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS G2 ECC CA OCSP 06, O=Microsoft Corporation, C=US" (SHA1: 2B:56:9D:5A:30:51:78:CD:39:CD:44:E3:B0:28:BA:2E:14:DF:82:41; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft TLS ECC Root G2, O=Microsoft Corporation, C=US" (SHA1: 9B:C5:75:46:AC:BD:B2:9E:38:8C:D1:79:1B:43:DE:4F:65:9B:84:4B; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7E:04:DE:89:6A:3E:66:6D:00:E6:87:D3:3F:FA:D9:3B:E8:3D:34:9E; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: E4:D6:E8:E5:22:80:AD:72:51:7B:20:20:8B:56:F6:8F:73:C8:AB:00; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: DD:62:30:AC:86:0A:2D:30:6B:DA:38:B1:68:79:52:30:07:FB:41:7E; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 78:95:7C:11:99:43:F8:58:42:7D:38:19:A2:12:A7:3C:CA:06:89:23; see report for more information)54:T406,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "tletgtup.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")55:T22d1,"Telegram.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\gentee27\Telegram.exe]- [targetUID: 00000000-00002028] "zgqmQcC2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee27\zgqmQcC2.exe]- [targetUID: 00000000-00003768] "Telegram.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 10.0 MSI Installer Last Printed: Fri Dec 11 11:47:44 2009 Create Time/Date: Fri Dec 11 11:47:44 2009 Last Saved Time/Date: Fri Sep 18 14:06:51 2020 Security: 0 Code page: 1252 Revision Number: {A30B958F-ABF8-47C7-81D4-C0C795019237} Number of Words: 2 Subject: Telegram Author: Telegram FZ-LLC Name of Creating Application: Telegram Template: ;1033 Comments: This installer database contains the logic and data required to install Telegram. Title: Installation Database Keywords: Installer MSI Database Number of Pages: 200"- Location: [%APPDATA%\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram.msi]- [targetUID: 00000000-00006604] "c7130ec1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\c7130ec1.dll]- [targetUID: 00000000-00003768] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002028] "guig.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- [targetUID: 00000000-00002028] "adddf.vbe" has type "data"- Location: [%APPDATA%\Telegram\adddf.vbe]- [targetUID: 00000000-00002028] "Telegram1.cab" has type "Microsoft Cabinet archive data many 74862451 bytes 2 files at 0x2c last modified Aug 02 2026 16:32:50 +A "Telegram.exe" last modified Sep 03 2025 22:46:54 +A "d3dcompiler_47.dll" ID 1234 number 1 6980 datablocks 0x1 compression"- Location: [%APPDATA%\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram1.cab]- [targetUID: 00000000-00006604] "zgqmQcC2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-421G2.tmp\zgqmQcC2.tmp]- [targetUID: 00000000-00003768] "shiCBF2.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\shiCBF2.tmp]- [targetUID: 00000000-00006604] "cache_24_6" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_6]- [targetUID: 00000000-00003176] "cache_24_0" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_0]- [targetUID: 00000000-00003176] "cache_24_1" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_1]- [targetUID: 00000000-00003176] "cache_24_3" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_3]- [targetUID: 00000000-00003176] "cache_24_4" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_4]- [targetUID: 00000000-00003176] "cache_24_2" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_2]- [targetUID: 00000000-00003176] "cache_24_5" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_5]- [targetUID: 00000000-00003176] "cache_18_4" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_4]- [targetUID: 00000000-00003176] "cache_18_2" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_2]- [targetUID: 00000000-00003176] "cache_18_0" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_0]- [targetUID: 00000000-00003176] "cache_18_1" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_1]- [targetUID: 00000000-00003176] "cache_18_3" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_3]- [targetUID: 00000000-00003176] "cache_18_5" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_5]- [targetUID: 00000000-00003176] "cache_18_6" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_6]- [targetUID: 00000000-00003176] "6B61835E29CEE158s.mSqlho" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\6B61835E29CEE158s.mSqlho]- [targetUID: 00000000-00003176] "text" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\spoiler\text]- [targetUID: 00000000-00003176] "MSICC80.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSICC80.tmp]- [targetUID: 00000000-00006604] "cache_24_7" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_24_7]- [targetUID: 00000000-00003176] "cache_18_7" has type "Excel 2 BIFF 2"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\cache_18_7]- [targetUID: 00000000-00003176] "is-695HK.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\MicrosoftDevKit\is-695HK.tmp]- [targetUID: 00000000-00003768] "is-NBT1Q.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\MicrosoftDevKit\is-NBT1Q.tmp]- [targetUID: 00000000-00003768] "countries" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\countries]- [targetUID: 00000000-00003176] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00003768] "shortcuts-default.json" has type "ASCII text"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\shortcuts-default.json]- [targetUID: 00000000-00003176] "setup_temp.gea" has type "data"- Location: [%TEMP%\gentee27\setup_temp.gea]- [targetUID: 00000000-00002028] "quit_0.ico" has type "MS Windows icon resource - 3 icons 16x16 with PNG image data 16 x 16 8-bit/color RGBA non-interlaced 32 bits/pixel 32x32 with \012- PNG image data 32 x 32 8-bit/color RGBA non-interlaced 32 bits/pixel"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\temp\quit_0.ico]- [targetUID: 00000000-00003176] "settingss.ykZlYP" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ykZlYP]- [targetUID: 00000000-00003176] "settingss.tgXjRv" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.tgXjRv]- [targetUID: 00000000-00003176] "settingss.adLBvH" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.adLBvH]- [targetUID: 00000000-00003176] "settingss.ylfyIb" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ylfyIb]- [targetUID: 00000000-00003176] "settingss.ZIDVdU" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ZIDVdU]- [targetUID: 00000000-00003176] "settingss.vujVqm" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.vujVqm]- [targetUID: 00000000-00003176] "log_start0.txt" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Telegram\log_start0.txt]- [targetUID: 00000000-00003176] "configs.AGsuGb" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8C\configs.AGsuGb]- [targetUID: 00000000-00003176] "D877F783D5D3EF8Cs.tmrvYN" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.tmrvYN]- [targetUID: 00000000-00003176] "shortcuts-custom.json" has type "ASCII text with CRLF line terminators"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\shortcuts-custom.json]- [targetUID: 00000000-00003176] "key_datas.hLUgcz" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\key_datas.hLUgcz]- [targetUID: 00000000-00003176] "D877F783D5D3EF8Cs.AyilRI" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.AyilRI]- [targetUID: 00000000-00003176] "D877F783D5D3EF8Cs.NXBOCn" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.NXBOCn]- [targetUID: 00000000-00003176] "83986FAE099FFDBEs.BFhhNR" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs.BFhhNR]- [targetUID: 00000000-00003176] "83986FAE099FFDBEs.AhbOhd" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs.AhbOhd]- [targetUID: 00000000-00003176] "83986FAE099FFDBEs.BmVDSk" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs.BmVDSk]- [targetUID: 00000000-00003176] "83986FAE099FFDBEs.NIGiRR" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs.NIGiRR]- [targetUID: 00000000-00003176] "83986FAE099FFDBEs.BlBrZN" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\83986FAE099FFDBEs.BlBrZN]- [targetUID: 00000000-00003176] "usertag" has type "data"- Location: [%PROGRAMFILES%\(x86)\Telegram\tdata\usertag]- [targetUID: 00000000-00003176]56:T541,"tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "tletgtup.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")57:T488,"tletgtup.exe" queries basic process information of the "C:\Windows\SysWOW64\cscript.exe" (UID: 2028) "tletgtup.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" (UID: 2028) "tletgtup.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" (UID: 2028) "cscript.exe" queries basic process information of the "C:\Windows\SysWOW64\cscript.exe" (UID: 5884) "Telegram.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" (UID: 6604) "Telegram.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 6604) "msiexec.exe" queries basic process information of the "C:\Windows\System32\msiexec.exe" (UID: 7080) "msiexec.exe" queries basic process information of the "C:\Windows\SysWOW64\msiexec.exe" (UID: 7080) "Telegram.exe" queries basic process information of the "C:\Program Files (x86)\Telegram\Telegram.exe" (UID: 3176) "zgqmQcC2.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp" (UID: 5544)58:T9fc,"tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "TLETGTUP.EXE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")59:T515,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Calls an API typically used to find device information Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size5a:T851,"Telegram.exe" touched file "C:\Program Files (x86)\Telegram" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\log_start0.txt" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\usertag" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\log.txt" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\shortcuts-default.json" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\shortcuts-custom.json" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\EMOJI\CACHE_24_0" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\emoji\cache_24_0" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\emoji\cache_18_0" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\key_datas.hLUgcz" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\settingss.vujVqm" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\settingss.ylfyIb" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BFhhNR" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.NIGiRR" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.AhbOhd" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\settingss.ZIDVdU" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\opengl_crash_check" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\emoji\cache_24_1" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\emoji\cache_18_1" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BlBrZN" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\83986FAE099FFDBEs.BmVDSk" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\settingss.adLBvH" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\settingss.tgXjRv" "Telegram.exe" touched file "C:\Program Files (x86)\Telegram\tdata\emoji\cache_24_2"5b:T590,"Telegram.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TELEGRAM DESKTOP\TELEGRAM.LNK" "Telegram.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\TELEGRAM WIN (UNOFFICIAL)\TELEGRAM.LNK" "Telegram.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk" "Telegram.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk" "Telegram.exe" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk" "Telegram.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\TELEGRAM DESKTOP\TELEGRAM.LNK" "Telegram.exe" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\TELEGRAM WIN (UNOFFICIAL)\TELEGRAM.LNK" "Telegram.exe" trying to access LNK file "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk" "Telegram.exe" trying to access LNK file "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.lnk" "Telegram.exe" trying to access LNK file "%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Microsoft Edge.lnk"5c:T68e,"tletgtup.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "tletgtup.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "tletgtup.exe" trying to access non-existent file "C:\FLTLIB.DLL" "tletgtup.exe" trying to access non-existent file "C:\MSVCP140.DLL" "tletgtup.exe" trying to access non-existent file "C:\MSVCP140.dll" "tletgtup.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "tletgtup.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEERT.DLL" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" "tletgtup.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "tletgtup.exe" trying to access non-existent file "C:\VERSION.DLL" "tletgtup.exe" trying to access non-existent file "C:\MPR.DLL" "tletgtup.exe" trying to access non-existent file "C:\mpr.dll" "tletgtup.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "tletgtup.exe" trying to access non-existent file "C:\CLDAPI.DLL" "tletgtup.exe" trying to access non-existent file "C:\CLDAPI.dll" "tletgtup.exe" trying to access non-existent file "C:\AEPIC.DLL" "tletgtup.exe" trying to access non-existent file "C:\AEPIC.dll" "tletgtup.exe" trying to access non-existent file "C:\BCRYPT.DLL" "tletgtup.exe" trying to access non-existent file "C:\bcrypt.dll" "tletgtup.exe" trying to access non-existent file "C:\RICHED20.DLL" "tletgtup.exe" trying to access non-existent file "C:\riched20.dll" "tletgtup.exe" trying to access non-existent file "C:\USP10.DLL"5d:T55a,"tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEE27" "tletgtup.exe" trying to access non-existent file "C:\TLETGTUP.EXE.LOCAL" "tletgtup.exe" trying to access non-existent file "C:\tletgtup.exe.Local\" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "tletgtup.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies\DESKTOP.INI" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\TELEGRAM" "tletgtup.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Telegram" "cscript.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "Telegram.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\TELEGRAM.EXE.LOCAL" "Telegram.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe.Local\" "Telegram.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\TELEGRAM FZ-LLC" "Telegram.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "Telegram.exe" trying to access non-existent file "C:\Windows\SysWOW64\af-ZA\SXS.DLL.MUI"5e:T42b,Found reference to API "WNetEnumResourceW" (Indicator: "WNetEnumResource"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WNetGetUniversalNameW" (Indicator: "WNetGetUniversalName"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WNetCloseEnum" (Indicator: "WNetCloseEnum"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WNetOpenEnumW" (Indicator: "WNetOpenEnum"; File: "00000000-00003768.00000001.124917.00410000.00000004.mdmp") Found reference to API "WNetGetUserA" (Indicator: "WNetGetUser"; Source: "00000000-00002028-00000C2C-868345354") Found reference to API "WNetGetUserA" (Indicator: "WNetGetUser"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")5f:T48b,Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "tletgtup.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "tletgtup.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "tletgtup.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "tletgtup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "tletgtup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "tletgtup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "tletgtup.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "tletgtup.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "tletgtup.exe") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "tletgtup.exe") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003176-00000C2C-946024218") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003176-00000C2C-946507284")60:T823,Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "tletgtup.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "tletgtup.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "tletgtup.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "tletgtup.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "tletgtup.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "tletgtup.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "tletgtup.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "tletgtup.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "tletgtup.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "tletgtup.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "tletgtup.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "tletgtup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "tletgtup.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "tletgtup.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "tletgtup.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "tletgtup.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "tletgtup.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "tletgtup.exe") Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "tletgtup.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "tletgtup.exe")61:T745,Found HTTP POST request "('POST /api HTTP/1.1\nHost: 149.15`LI\ncation/x-www-form-urlencoded\neep-Alive\nAccept-Encoding: gzip\nUser-Agent: Mozilla/5.0\nFVVF82A\nn30\'\nHAPUBWS\nVide QI\nFVVF82A\nFVVF82A\nFVVF82A\nKZ^¿"ÉWe ¢F0Íx¯ò%A\ëÅ|®", Potential IP "95.161.76.100" found in string "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0øÙeÕ»j£Õ»jxF`û>#bìÒò¬gyX®Ê", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0Ð¬¸ºÕ»j8xF`«_{8éefc°lþ9|¥õ~0}ÞIY»`T87o9¡l@'þ)\Ïõ¬[", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 48Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0Ðqyë¾Õ»jxF`»u=/éDé´½ß3Pë'-ãKm", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0àÙÔë¾Õ»j4xF`@Öm[0ÐRýÌÂÈyàÙ®WÂÃù\´.2ù}ã80çU¦Õv", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ì×ÄÅÕ»j$xF`úøætý]KÎ9FXP"Ìçzm]ê©Jß÷h", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0Pð7×ÆÕ»j,xF`¼´Ðfùb<öìæ§èk8_áóó·Ùq¬æ¶f¥à", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 48Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0(x'ËÕ»jxF`x/qe=¶¢÷òÔ? an¤pzÌ", Potential IP "91.108.56.160" found in string "POST /api HTTP/1.1Host: 91.108.56.160:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0lÐÕ»j xF`é~TëEâñ#|Qtò0Ðafn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6fn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003176.00000001.126427.99818000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmaddtrust" - Source: "00000000-00003176.00000001.126427.99818000.00000004.mdmp") Found URL "http://repository.swisssign.com/\?oq2.qd@w9%e" - Source: "00000000-00003176.00000001.126427.99818000.00000004.mdmp") Found URL "http://91.108.56.160:80washington1redmond1microsoft" - Source: "00000000-00003176.00000001.126427.99818000.00000004.mdmp") Found URL "http://149.154.167.41:8091.108.56.160q0o1addtrust" - Source: "00000000-00003176.00000001.126427.99818000.00000004.mdmp") Found URL "https://t.me/" - Source: "00000000-00003176.00000001.126427.99D3F000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0wc@fn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmaddtrust" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "https://github.com/telegramdesktop/tdesktop/blob/master/license" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "https://github.com/telegramdesktop/tdesktop" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "http://repository.swisssign.com/\?oq2.qd@w9%e" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "https://core.telegram.org/api" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "https://telegram.org/blog/telegram-starslng_credits_box_out_subscription_confirmsubscribe" - Source: "00000000-00003176.00000002.128347.99818000.00000004.mdmp") Found URL "https://fragment.com/ads/topuplng_suggest_action_agreementlng_suggest_decline_titlelng_story_reply_phlng_suggest_action_yourlng_suggest_change_pricelng_suggest_action_decline" - Source: "00000000-00003176.00000002.128347.99E98000.00000004.mdmp") Found URL "https://t.me/telegramtipslng_tag_info_title_ownerlng_terms_declinedecline" - Source: "00000000-00003176.00000002.128347.99E98000.00000004.mdmp") Found URL "https://fragment.com/ads/topupnone" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://t.me/telegramtipsview" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://telegram.org/tos/stars" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://telegram.org/tos/starsconnecting" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://telegram.org/tos/starsrevoke" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://ads.telegram.orgdelete" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://telegram.org/tos/starslimit" - Source: "00000000-00003176.00000002.128347.99ECA000.00000004.mdmp") Found URL "https://telegram.org/tos/mini-appstop." - Source: "00000000-00003176.00000002.128347.99F5C000.00000004.mdmp") Found URL "https://telegram.org/privacy-tpasponsored" - Source: "00000000-00003176.00000002.128347.99F5C000.00000004.mdmp") Found URL "https://telegram.org/privacy" - Source: "00000000-00003176.00000002.128347.99FC6000.00000004.mdmp") Found URL "https://telegram.org/tos/affiliate-programsticker" - Source: "00000000-00003176.00000002.128347.99FC6000.00000004.mdmp") Found URL "https://telegram.org/faq" - Source: "00000000-00003176.00000002.128347.99FC6000.00000004.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00005884.00000000.120291.73591000.00000020.mdmp") Found URL "http://" (Indicator: "GetDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "/GetDC" (Indicator: "GetDC"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "/GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")67:T657,Found registry query API: "RegQueryValueExW" in file "tletgtup.exe" Found registry query API: "RegOpenKeyExW" in file "tletgtup.exe" Found registry query API: "RegQueryInfoKeyW" in file "tletgtup.exe" Found registry query API: "RegEnumKeyExW" in file "tletgtup.exe" Found registry query API: "RegEnumValueW" in file "tletgtup.exe" Found registry query API: "RegGetValueW" in file "tletgtup.exe" Found registry query API: "RegOpenCurrentUser" in file "tletgtup.exe" Found registry query API: "RegQueryValueExA" in file "tletgtup.exe" Found registry query API: "RegGetValueA" in file "tletgtup.exe" Found registry query API: "RegEnumKeyExA" in file "tletgtup.exe" Found registry query API: "RegOpenKeyExA" in file "tletgtup.exe" Found registry query API: "RegEnumKeyExA" in "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp"68:T501,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "tletgtup.exe") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "tletgtup.exe") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "tletgtup.exe") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; File: "tletgtup.exe") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; File: "tletgtup.exe") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; File: "tletgtup.exe") Found reference to API "NetQueryDisplayInformation" (Indicator: "NetQueryDisplayInformation"; File: "tletgtup.exe") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")69:T74d,"tletgtup.exe" called "FindFirstFileA" with parameter %TEMP%\gentee27\*.* (UID: 00000000-00002028) "tletgtup.exe" called "FindFirstFileA" with parameter %APPDATA%\Telegram\adddf.vbe (UID: 00000000-00002028) "tletgtup.exe" called "FindFirstFileA" with parameter %TEMP%\gentee27\zgqmQcC2.exe (UID: 00000000-00002028) "tletgtup.exe" called "FindFirstFileA" with parameter %TEMP%\gentee27\Telegram.exe (UID: 00000000-00002028) "tletgtup.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002028) "tletgtup.exe" called "FindNextFileA" with parameter guig.dll (UID: 00000000-00002028) "tletgtup.exe" called "FindNextFileA" with parameter setup_temp.gea (UID: 00000000-00002028) "tletgtup.exe" called "FindNextFileA" with parameter Telegram.exe (UID: 00000000-00002028) "tletgtup.exe" called "FindNextFileA" with parameter zgqmQcC2.exe (UID: 00000000-00002028) "Telegram.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter log.txt (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter modules (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter tdata (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter Telegram.exe (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter desktop.ini (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter File Explorer.lnk (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter Google Chrome.lnk (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter Microsoft Edge.lnk (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter cache_18_0 (UID: 00000000-00003176) "Telegram.exe" called "FindNextFileW" with parameter cache_18_1 (UID: 00000000-00003176)6a:T436,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "tletgtup.exe") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "tletgtup.exe") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "tletgtup.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "tletgtup.exe") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "tletgtup.exe") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")6b:T9a8,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "tletgtup.exe") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "tletgtup.exe") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "tletgtup.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "tletgtup.exe") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "tletgtup.exe") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "tletgtup.exe") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; File: "tletgtup.exe") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "tletgtup.exe") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "tletgtup.exe") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "tletgtup.exe") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "ICreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "IProcess32First" (Indicator: "Process32First"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "IProcess32Next" (Indicator: "Process32Next"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")6c:T1067,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "tletgtup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "tletgtup.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "tletgtup.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "tletgtup.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "tletgtup.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "tletgtup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "tletgtup.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "tletgtup.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "tletgtup.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "tletgtup.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "tletgtup.exe") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "tletgtup.exe") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "tletgtup.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "tletgtup.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")6d:T476,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003176.00000000.124508.901A0000.00000004.mdmp, 00000000-00003176.00000001.126427.901A0000.00000004.mdmp, 00000000-00003176.00000002.128347.901A0000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003176.00000000.124508.901A0000.00000004.mdmp, 00000000-00003176.00000001.126427.901A0000.00000004.mdmp, 00000000-00003176.00000002.128347.901A0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Telegram\Telegram.exe" (Indicator: "\Device\"; Source: "00000000-00003176.00000000.124508.901A0000.00000004.mdmp, 00000000-00003176.00000001.126427.901A0000.00000004.mdmp, 00000000-00003176.00000002.128347.901A0000.00000004.mdmp")6e:T51d,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00005544.00000000.124552.01381000.00000020.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "tletgtup.exe") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "tletgtup.exe") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")6f:Td3c,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "00000000-00003768.00000000.124668.00418000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "tletgtup.exe") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "tletgtup.exe") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "tletgtup.exe") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "tletgtup.exe") Found reference to API "RtlFreeSid" (Indicator: "FreeSid"; File: "tletgtup.exe") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; File: "tletgtup.exe") Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; File: "tletgtup.exe") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "tletgtup.exe") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "tletgtup.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "tletgtup.exe") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "tletgtup.exe") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "tletgtup.exe") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "EqualSid" (Indicator: "EqualSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp")70:T127a,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: zgqmQcC2.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: zgqmQcC2.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: zgqmQcC2.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: zgqmQcC2.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: zgqmQcC2.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: guig.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: guig.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: guig.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: guig.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: guig.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: zgqmQcC2.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: zgqmQcC2.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: zgqmQcC2.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: zgqmQcC2.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: zgqmQcC2.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: zgqmQcC2.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: zgqmQcC2.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: shiCBF2.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: MSICC80.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: MSICC80.tmp] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: MSICC80.tmp] Observed import api "GetSidIdentifierAuthority" which can "return a pointer to the SID_IDENTIFIER_AUTHORITY structure in a specified security identifier (SID)" [Source: MSICC80.tmp] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: MSICC80.tmp] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: MSICC80.tmp] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: MSICC80.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: MSICC80.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: MSICC80.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: MSICC80.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: MSICC80.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]71:Te7e,"tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CSCRIPT.EXE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\GENTEE27\TELEGRAM.EXE"; Value: "") "tletgtup.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\GENTEE27\ZGQMQCC2.EXE"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\MSIEXEC.EXE"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "")72:Tcc6,"Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES"; Key: "APPLICATIONNAME"; Value: "Telegram Desktop"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES"; Key: "APPLICATIONDESCRIPTION"; Value: "Telegram Desktop"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES\URLASSOCIATIONS"; Key: "TG"; Value: "tdesktop.tg"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\REGISTEREDAPPLICATIONS"; Key: "TELEGRAM DESKTOP"; Value: "SOFTWARE\TelegramDesktop\Capabilities"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG"; Key: "URL PROTOCOL"; Value: "000000"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG"; Key: "(DEFAULT)"; Value: "URL:Telegram Link"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES\URLASSOCIATIONS"; Key: "TONSITE"; Value: "tdesktop.tonsite"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE"; Key: "URL PROTOCOL"; Value: "000000"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE"; Key: "(DEFAULT)"; Value: "URL:TonSite Link"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" -- "%1""), "zgqmQcC2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "B80E00007CE382783050DD0100"), "zgqmQcC2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "C3F90952092EF69F6CFCF4769612BCF10F1C4F05322DA4971B17D065FC7E20CE00"), "zgqmQcC2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000"), "zgqmQcC2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%ALLUSERSPROFILE%\MicrosoftDevKit\Guard.dll"), "zgqmQcC2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "74FD045FEE4F1085784E77808779A5E2E5B6F65C4986E72125E7880A7740963E00")73:T51c,"Telegram.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\gentee27\Telegram.exe]- [targetUID: 00000000-00002028] "zgqmQcC2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee27\zgqmQcC2.exe]- [targetUID: 00000000-00003768] "c7130ec1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\c7130ec1.dll]- [targetUID: 00000000-00003768] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002028] "zgqmQcC2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-421G2.tmp\zgqmQcC2.tmp]- [targetUID: 00000000-00003768] "shiCBF2.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\shiCBF2.tmp]- [targetUID: 00000000-00006604] "MSICC80.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSICC80.tmp]- [targetUID: 00000000-00006604] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00003768]74:T6a0,Dropped file "%TEMP%\gentee27\zgqmQcC2.exe" has high entropy 7.64997 Dropped file "%APPDATA%\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram1.cab" has high entropy 7.9969 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\6B61835E29CEE158s.mSqlho" has high entropy 7.99975 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\emoji\spoiler\text" has high entropy 7.98735 Dropped file "%ALLUSERSPROFILE%\MicrosoftDevKit\is-NBT1Q.tmp" has high entropy 7.89715 Dropped file "%TEMP%\gentee27\setup_temp.gea" has high entropy 7.92114 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\temp\quit_0.ico" has high entropy 7.79441 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ykZlYP" has high entropy 7.90667 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.tgXjRv" has high entropy 7.87918 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.adLBvH" has high entropy 7.8825 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ylfyIb" has high entropy 7.88058 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.ZIDVdU" has high entropy 7.88917 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\settingss.vujVqm" has high entropy 7.88309 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8C\configs.AGsuGb" has high entropy 7.79762 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.tmrvYN" has high entropy 7.62482 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\key_datas.hLUgcz" has high entropy 7.37244 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.AyilRI" has high entropy 7.43975 Dropped file "%PROGRAMFILES%\(x86)\Telegram\tdata\D877F783D5D3EF8Cs.NXBOCn" has high entropy 7.3908475:T490e,"POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1 Host: aefd.nelreports.net Connection: keep-alive Content-Length: 958 Content-Type: application/reports+json Origin: https://www.bing.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: en-US,en;q=0.9" with payload::==> "[{"age":44857,"body":{"elapsed_time":6504,"method":"GET","phase":"connection","protocol":"quic","referrer":"https://ntp.msn.com/","sampling_fraction":1.0,"server_ip":"23.210.216.149","status_code":0,"type":"h3.protocol.error"},"type":"network-error","url":"https://www.bing.com/api/v1/mediation/tracking?adUnit=1732768568&auId=1b04de89-724f-409f-a0b7-4a98262d9edb&bdc=pb&bidId=20&bidderId=4&cmExpId=LV5&impId=1&impTy=1&ldc=jhf2nczr&mkt=en-us&oAdUnit=1732768568&pId=1&publisherId=17160724&rId=f5595b85-f4ee-4d93-9115-029d259a6b44®ion=na&rlink=https%3A%2F%2Fwww.bing.com%2Faes%2Fc.gif%3Ftype%3Dmv%26reqver%3D1.0%26rg%3Db7ee28dfa4184aac8ad308c74db24ccb%26tids%3D20%26med%3D10&rtype=mvFeedbackURL&tagId=edgechrntp-peekinfopane-1&trafficGroup=zfa_angvir&trafficSubGroup=erfreir&uberGroup=hore_1c&uberSubGroup=erfreir","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0"}]" HTTP/1.1 200 OK Content-Length: 0 Server: Kestrel Date: Tue 29 Sep 2026 15:12:00 GMT Connection: keep-alive PMUSER_FORMAT_QS: X-CDN-TraceId: 0.95b13717.1790694720.48bc423 Access-Control-Allow-Headers: * Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: GET OPTIONS POST Access-Control-Allow-Origin: * with no response body "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 164 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ànCûEè»jxF`tBùP,Òy«Çîw´]ñéÿY¹µ!F9ÍÅ0000000000000000014CC2AEC2815DC395C2BB6A40000000632416057442C295C28EC3B9502CC3921B79C2ABC387C3AE77C2B45D6AC28C75C29DC3BD01C2837D......., "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 108 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "(¶Fè»jXxF`|ãã6n$¬ÉþÁ«ËÝ°g«d3]oúßýÍÐbs(u{IË¬èP%%vé³#A«òØõR§sza?·@Ic×JÝ)î0E7±" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 148 with response body ==>0000000000000000011452C2825DC395C2BB6A40000000632416057CC28DC3A3C28BC29BC3A336166E24C2ACC389C3BEC381C2ABC38B26C3AF5C04C3891B3553......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> " ù Hè»j4xF`k}^FµWPëYö4Ã¼$ØÔ3%X%å²÷UP&15{³ÿëê" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 84 with response body ==>00000000000000000168651A61C395C2BB6A40000000632416056B7D5E46C2B55750C3AB59C3B6C29434C383C29DC2BC0B75C3A75CC38AC2ADC39FC29BC3B75B......., "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 100 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "$%5Jè»jPxF`´Í¨d=0ùvöMiÍ¤%HMø?Ñyô¿ÿ ¹î 7áX# î^Ú a[Ô0ÐÇei«U}p:%tÃo¯ò4Q/±" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 100 with response body ==>000000000000000001C388C384C3AE65C395C2BB6A4000000063241605C2B4C38DC2A8643D30C297C3B976C3B64DC29869C38DC2A4253FC2A0C39CC38B40C292......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 56 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "ø5Jè»j$xF`>^¿"ÉWe,¢F0Íx¯ò%A\ëÅ|®" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 180 with response body ==>000000000000000001341D1C65C395C2BB6A40000000632416053E5EC2BFC29C22C38957C28C65C28F2CC2A246300819C293701BC3A7646B22C38C6DC39FC2B4....... "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 100 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "$%5Jè»jPxF`´Í¨d=0ùvöMiÍ¤%HMø?Ñyô¿ÿ,¹î,7áX# î^Ú,a[Ô0ÐÇei«U}p:%tÃo¯ò4Q/±" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 152 with response body ==>0000000000000000016CC3B72665C395C2BB6A4000000063241605C2B4C38DC2A8643D30C297C3B976C3B64DC29869C38DC2A4254317C290C2BA0143C2A3C2BB....... "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 232 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ÖeÕ»jÔxF`¢ñþýLZk{FÎ¾§¹ÓÇ£7U~kSá¡H.å?qùyiËq òzW!ÚøàðÕoâßHsH+XtlÊ3òó%Á(-sÏ!£Öü¶Öj6´B|9Ì^iÃÚîc¸ùHS^kÓúbd]!õ®KîWK.ðÊ{$ªP¤âJÌ,'1VSMÎwÚÚ¡U©þ»ÿgªØÃFîH¬¸E"§ý¢ûq^Ìs ç-" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 148 with response body ==>00000000000000000154C2B3C28866C395C2BB6A4000000063241605C297C2A2C3B1C3BEC3BDC28D4C5A6B7B4618C38EC296C2BEC290C39BC3891BC297C2A1C2......., "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "øÙeÕ»j000000000000000001C2B4C2AAC28E66C395C2BB6A4000000063241605C39F5AC282163BC2877B0FC2A2C292C2BC35C3B301C3BBC2BE14C2A2C2BAC3BEC38626......., "POST /api HTTP/1.1 Host: 149.154.167.91:80 Content-Type: application/x-www-form-urlencoded Content-Length: 212 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "Üó²úgÕ»jÀxF`Áv{WÇØlSZøÚÐ¿\·E=7ábH;B~'XÖþyv;Giõ2ûe~g¸zø+|00000000000000000148656469C395C2BB6A400000006324160503C381C298767B57C387C3986C535AC3B8C39AC390C2BF5C02C39BC2B7C380C3AD48C2B07104......., "POST /api HTTP/1.1 Host: 149.154.167.91:80 Content-Type: application/x-www-form-urlencoded Content-Length: 284 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "¸ÔfâjÕ»jxF`ø)AOù³·òÜ÷ñp_¶0f ãºÄW.È1Ö+·ßð*õrÛº9?p>ñSñg#`ùw¨tÓ'ßx(tD6Âe+º´~µ½#J4ÈÉ;DaÇÃQ_}<$±`A²TÞÝqeÁae¨xh&¬ÌÕµ»½©»Ù$TçF&Âîe4¬s×MÊZ0Ré¸\Ë2QQW«Du®èöåwüûrØÕª²Y9(rîT¸bÃ"%O4¤þ×dCø¼©j1:pê=WHôùÕr¶p®×ï¸þÙ®0" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 116 with response body ==>0000000000000000011C02056CC395C2BB6A4000000063241605C292C29EC28FC3B829414FC3B9C2B3C2B71CC3B2C39CC3B7C3B1C2954944C3BD3DC28F0DC2BC......., "POST /api HTTP/1.1 Host: 149.154.167.91:80 Content-Type: application/x-www-form-urlencoded Content-Length: 288 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "lþãkÕ»jxF`NÚAT÷·vP¶n»Q<Ä|Iªð¡©Hf`WÇ8ÊµÃº¤;b2*qú03qeÞRÛxÊUùYE¼Ax{õh|ØÙöØ!IQR9äâDzå<¥ñìÝóò¬Ú6:"f:UÊqU¸Aµ942wîk~}I!<¡±4xâGlÛ*ÊÎI$ZÄ¿DÑÂ}¢ÃBD®¬Ãþ7ÃÖ{Ý1é =¤äÜco$ûXFÆàRevôi:þ1cm´)T³¤Òê,A0ì'[@§PÞ¤ÕW¥.RìUn§ÑIÆÍÁÍ».N3kq=AÏ¡" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 88 with response body ==>000000000000000001C3ACC38BC3B06CC395C2BB6A40000000632416051FC2991A4EC39A4154C3B7C2B77650C2B66EC2BB513CC39660C3827AC38FC2AFC2B477......., "POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 280 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "p´@mÕ»jxF`-F $ÂGð_©lY÷êI÷ª(ýùNíX)áyp=Õ5S´ÖÌ·òìi ÑÚ¹t/>6Vb©·+Ot»Ï"ntãB¯voªGtÖmIåë¼f¸É³ázÐsmé/XÓÙîÁÿJ þj¤À¢Q÷¯-8C-Ú9Ä¢G=+·lÑ§ÖãwNúí"Äªs(dþIü×º+,uÀ-¤xµ×¸}Pÿ6~" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 188 with response body ==>00000000000000000138C38C196EC395C2BB6A40000000632416052D0C03080A7F462C24C382C294C29847C3B05FC2A9C38AC2B5C2B8012E2DC293C29F2CC391......., "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 52 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "àãAmÕ»j xF`©pDWí¾ÏÇÓp\a¥î+Zû4!|R2" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 96 with response body ==>000000000000000001C38CC3BE356EC395C2BB6A4000000063241605C284C2A9701C440257C3ADC2BEC38FC387C393705C61C2A522C29C193751C3A945C2A4C2......., "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 92 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ljÁ>nÕ»jHxF`uåÓZ¦ xuA{SMá+ÊóÛøû7g¹Ã#qsKófO¯L#èo¶5$½f´$¼¦Þ¡Jôfç" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 160 with response body ==>00000000000000000138C3B7236FC395C2BB6A400000006324160575C3A5C393095A09C2A6C283207875417BC28653C2982BC3BB27C2ABC3A6C2A823C2A45F65......., "POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 60 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "´NpÕ»j(xF`=Ó;;i9OI§÷èõÍÖØéÚîZb Ç¤`%" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 116 with response body ==>000000000000000001C3A43A2871C395C2BB6A40000000632416053DC3933B3B0969394F49C283C2A7C3B7C3A8C297C3B5C38D74130EC28EC3861540145E3D42......., "POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 76 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ÄANqÕ»j8xF`wh>ý1»ò¼ÀÉÒÅò£=) ê½.&ü}.ÕEíÁKn£fì 0B±BSwai" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 132 with response body ==>00000000000000000130171172C395C2BB6A400000006324160516C28877683E02C3BD31C2BBC3B2C2BCC380C389C39202C385C2903C17C3AF10C3BBC3A93EC3......., "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 268 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "T-rÕ»jøxF`QÁ¡-®öÍ_÷"É/õÆ{¸Oÿ]]¿´Tç?.ä¡îÁ(ÿf/]¹%Ü¢UôË¼G¾¡2|&YÍ<ß¥¤j<£·UÁ29dDÜâ]5hTÑmìdQ8 6LLÕwòZxÅQùÊ* åøq¢H´Z¹é×Ð:ãbû°uþ<ßf3ÙZ\Õ;ÌMo7f;G°óçÅ²fD¾Äòfb+uÞ«Ê¬ùÁsÒÎ)äo½ÆÃfýaìXÌ*ÿD¨¥¼éçzSvåIªOcÜ_*)}¤¶ä9" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 164 with response body ==>0000000000000000016010C39F72C395C2BB6A400000006324160551C381C2A12DC2AD12C2AEC3B6C38D175FC3B71322C3890BC38FC2901662C2B5C29230C2A1....... "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 212 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "8.ìsÕ»jÀxF`PµyàÚ8ß¢!viÏ¬Ëo°æJÛäiÃ®¢róf>¹»¯ãfIÍésh(\[ñ ¢ô:1ÌpóQ±À\,~GØó0Á7£ =ö*ÄÁ#ëgäuD_¾t«leÛ¿D¦Æêq¤hÇV&Ï-e_ÐêüÌmÍw- E®m8Lio'ÔÑÙWDh«E=eÎZsÆÓ)~ÓÉk©®²Xû¬Hy#" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 176 with response body ==>000000000000000001C3B0C29BC39C73C395C2BB6A40000000632416055005C288C2B51E79C3A0C39AC2831638C39FC2A2217669C3B0245537C2A5C3B1C39559....... "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 116 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¤b-wÕ»j`xF`Î¯ÄkÔ¾ gG[Ù`@/Ë%®©v eªÄ %ÿì¸ßRþ×99æÞÍAöÈ[»ÿ÷TÙkÙ.í`EÕ|Uè;ÁÿäjyÉ]lx:Î¼kÌ9ù´à#" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 92 with response body ==>0000000000000000011CC39B3878C395C2BB6A4000000063241605C38EC2AFC293C384136B13C394C2BEC2A06704475BC39960C3A129C38A37411EC38CC2AE55....... "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "àgxÕ»jÈxF`xÄ¦ü0¥HSOâ|%/+©ÕÅÛ)>ñÔ"!£©7Ë¨º¦Ë4JuÌJºR¹ÝFÎÍð2Í¶ÚÀ0!Î>é½"%dÔÂGlîãUfÊ¡ZqTçç&Aìwínû^\ÉÕ¶jñ¯zËF[ìhûJ1;ýèÅA¾´Øt³l+ç3>]Ò^ýµÂC)$SË1zßP\¯ÙÒØ¼ÎÒÐe§n{fõäo×©î¯Ò¯AúPÆ" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 100 with response body ==>000000000000000001C284C3BA4A79C395C2BB6A400000006324160578C292C38411C2A60BC3BC30C2A51B1C4853C2994FC3A215C39A0CC3A81015C3BDC29DC2....... "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 272 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "(Ó¯{Õ»jüxF`/Z÷«èõê4²ºúc>Ù]Aü÷ð*ýnM>³íCã3ìÙÎðÂtÏ§ Õ2¹ÂüÞcZ¾¬gy\nN÷¼6²WìHú+Â+£Ü»Ã®hæqç<(c1Ä¹Má*oäG¯³øWq÷÷»^©xYÕ3¿$¯6õ¡cq³z¼¾¨ÚÅ©&pÓíj¼v§¯&Âød®¤AÇbç"ØliµðÆ¢ÛÞ2¼«µ¥Çº3ÅåyZw/ÒçáÕãÆùÜáj 22" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 144 with response body ==>000000000000000001C2A0C3A56F7CC395C2BB6A4000000063241605C2942F075A1018C3B71EC28BC2ABC3A815C296C3B5C3AA34713EC28CC3B54708C3BCC3BE......., "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 40 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "¬b®|Õ»jxF`¹×øuY|*y-©û) Y" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 84 with response body ==>000000000000000001C3B0C296687DC395C2BB6A4000000063241605C2B9C397C281C28CC3B875597C2A792DC2A9C3BB292C59C3931824C396C2A1C280C29AC3......., "POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 268 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "xxwáÕ»jøxF`Ñï)ûÃ-x+ù9ì^ÙÙ=ÓÔØº#vù&X+ÝK½ØÐm¿Ä(æ·êSh-?uûì{È+e+$<}h-¹t±£5¶[¡\h/fSÝã¼Äº¤umTQË[\kº7GÆÃKc*1ð5eöZ:)8xRêøtÝ±u%Û³÷ÍTIÝ>§ÓÑ »r1®¼7¨ßÀ¿Mô0Þò%Âû1U(õ¤[µlæ/¹pÀyhO«.?£9±ª¥,gt/ªEsVjøßn±È´ãÆ$ZçÜûÞ ZæÛQ" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 188 with response body ==>000000000000000001C3A402C29EC280C395C2BB6A4000000063241605C391C3AF1CC291290BC285C3BBC383C280012DC290782BC3B9C386C387C2BE400FC283......., "POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 252 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "8=.áÕ»jèxF`oÆXõ°ö^â/|à#¾T1´å2Iì¡ON}D%.|îãqÛÇDá Á¹µòÝ|**§íèOºö¬ o°³Ä=õÒÇ~ÕZ÷Ú.fj¾ÿ¯álÚÉ(lVMý3®Ô³_éA¹¾}µXx4Gý(?Y9¢ù;SorÌÅÀ°õ?TH¦bîXnîq)âRøyñ=ìq_7[*a\É4%=àÇÑR9þ¥·D6ÐÏq¡]Ñ!ð¿a:fôu´3ùW%"¤" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 144 with response body ==>000000000000000001C3B816C28BC280C395C2BB6A4000000063241605C284166F1FC38658C290C3B5C28BC2B0C28CC29A05C3B65EC3A2C382C29EC39614C28F.......76:T777,"tletgtup.exe" reads file "C:\Users\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "tletgtup.exe" reads file "C:\Program Files (x86)\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "tletgtup.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "tletgtup.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "tletgtup.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" "tletgtup.exe" reads file "C:\Windows\Fonts\desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\Documents\desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\Pictures\desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\Music\desktop.ini" "tletgtup.exe" reads file "C:\Users\Public\Videos\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "tletgtup.exe" reads file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\desktop.ini"77:T701,"Telegram.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\gentee27\Telegram.exe]- [targetUID: 00000000-00002028] "zgqmQcC2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee27\zgqmQcC2.exe]- [targetUID: 00000000-00003768] "c7130ec1.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\c7130ec1.dll]- [targetUID: 00000000-00003768] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002028] "guig.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- [targetUID: 00000000-00002028] "zgqmQcC2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-421G2.tmp\zgqmQcC2.tmp]- [targetUID: 00000000-00003768] "shiCBF2.tmp" has type "PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections"- Location: [%TEMP%\shiCBF2.tmp]- [targetUID: 00000000-00006604] "MSICC80.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\MSICC80.tmp]- [targetUID: 00000000-00006604] "is-695HK.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\MicrosoftDevKit\is-695HK.tmp]- [targetUID: 00000000-00003768] "is-NBT1Q.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\MicrosoftDevKit\is-NBT1Q.tmp]- [targetUID: 00000000-00003768] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-B4JP8.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00003768]78:T7cb,"tletgtup.exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tletgtup.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\guig.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tletgtup.exe" wrote 54866 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "zgqmQcC2.exe" wrote 12800 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "zgqmQcC2.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-B4JP8.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...79:T2721,Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 92 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> ü<ñÕ»jHxF`xQrRÞlahFÞó¿Ådüvy)©ÏIÂûhøÃû÷Áè¢ú.2Ü=Õr|^seÙ*ÿ ÈÏ>£Õ»jxF`û>#bìÒò¬gyX®Ê....... Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 196 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> lóÕ»j°xF`¢8ÞÒ2\FSÆ0yL§ÎòM1z}GH9|àCÕTI¬(¦âaËïb!45CW·£HÍ«Ö(~îsyPðöÅ>fÝ¶GÕÇó«2ñ«ø¸Iÿé×U;Ímà1ÕáÅÉÒÂ{2#¤......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 244 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¸BÄ²Õ»jàxF`4¸½çiÉQÄ>LÜZ¢èîbj)®ølP«!äHÞ©jðÚ_ñp'B>]ùfÂíéÈÏÏÒ Ør»Nµ»v7$Qp?Ê*"Ë'ÎØr%ÉtüÞ:c=<ßN9\Ö)i *ü[ ....... Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 76 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> Ð¬¸ºÕ»j8xF`«_{8éefc°lþ9|¥õ~0}ÞIY»`T87o9¡l@'þ)\Ïõ¬[......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 64 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> Pð7×ÆÕ»j,xF`¼´Ðfùb<öìæ§èk8_áóó·Ùq¬æ¶f¥à......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 120 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> dÎ¼ÕÕ»jdxF`yk¾Rè-{«-õ¯ÂþããðÔµ`;í{1sû\°CTê}Ï!;àÊ;g;íý¤:4dKö?Ì ÄX#EmÈäºH©|nÀ½>¡ù³ùN_®¥<£°......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 68 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> nòØÕ»j0xF`öâ»«3ï8¡á÷vÉ÷HÊÉª}ðÜ4V¸z¿bì8vØ......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 124 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ´í¨àÕ»jhxF`Ã!8KG×~ÓÄ5ðÉ2*rÛpxå»oPkà7ªòÀ0ò°OrÒ-í6á7:g*ÝT)xzoÕÏdïÉ§+oùr8FOÏÂlíû'Ñ=aÒÈï....... Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 172 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> PÒoæÕ»jxF`_.£õî;Û |-x'ùÐÓ¦yë_0^ðß¯r½´h(qwôËOÔ¯Øwuó¹º¬pTóy"Ë/ùGrâ9R~¢³.H_æ.F"nY×éù@÷z[²ôÎ.xW¿Ój_|é1Nc......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 204 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¤¿hòÕ»j¸xF`gòÆCì~Üõ³yØ%±Ñåµ¨ÚXq©eè%:k-nD²Ø"Q-GoÊÜ'[.JuJk)¦??çR~§ åjFÓÂ]Ã"bû6¨H5zÖLÌï¯³ûÌº¦Ý²[A§sÖS&+......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 136 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ø$§hóÕ»jtxF`ä3¥ÏTM7`_J<ñk6zûßÝ¦<ÞPTFx¶¹CX®(rº|ÑÍ,ÛVí6z`Ëày»Ýfà¢PhKËµVJGZ_fé¨w2Ò«Õ¬ÈIc!/......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 48 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> xÈÃøÕ»jxF`F°ûì{M¤¸x¥hsV_ 0......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 240 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> \Ö·Ö»jÜxF` ²Y_¤ØngT¬&ÕÚìûðôÈw*/&$rÚö3S´ ;U¸ènë½Há_ÁiçäÎ^È¹òALCQK!î¸FxÝæ%;^´rWFzÿÊ×9<,8>xI?9ðCë§ìùo......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 232 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÌrÖ»jÔxF`4ºÏ¢r¶BÒ©\¾]'º.NåÍ\B´Eúléqõ»Èòv(bmß¶j°Iøíéz\ÂøY~¦ª&yÞ^»$®Àæ2'lÔ)ç@>3©MÞÌHz°÷Ñ"C'ù ¤Ä*_1¾"¾......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 264 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> Í5Ö»jôxF`ArY¯´jõý§Ã~mNÓG¡4ÂxÞ«)6}[ôH*´3ó[µàUÄõ»¤Æ§¹h¼ôÅºÓÊÎMBT%øáz-PT¥.ÁðÒ¢é%vL«jg®wµ5Ü!-Ñ÷´<8qRU;³ï......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> 8Ö»jTxF`~T=]ÊEÐ|YvJ¼ ·ªr²W&fÐ*aüë(|sOVÄ?+®ªp®÷?Þ#ÁMb'þÒ1ûa¦ÇP\w·ldUÐ×º_....... Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 228 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> <[¸Ö»jÐxF`ýÂ4}aÊUû"iCZââ5ÙEÇÎÚAëº¡bx\>ÀÛ+Çè¦¤P'dlO1É}ûù,2õ¦pLS®JXâòô56.´......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 144 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÔEGG#Ö»j|xF`VKülGW&z- îsV²ïpuÆÓ*øÏÚ 3Åðí2 |6øJnáì.®ÆØ¨n©¯½#!T'MùYà÷OWDô=ß$ºHa¸'7ÚF¿-Qx¥<Ç)zÐ¢>Y\n......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 248 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÐÞ#,Ö»jäxF`Ý¬³Ö»é´íqoæûÏ«Ê_È8Vr®|iÕTÜG@ 8Á[ÂD¬ùDyE¿/îýsáÒ¥H(5¹ÙíVÎv CÃ"'Ê¾¥z6ÒÇ5·3ç¹ÞïHMq.{î@ZiÉ=......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 160 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ü&A.Ö»jxF`o"Ðü/%´P3P_t( hO5JÓbÔÄ\ Ó=u=¨8+MBÜÓúçÆÃV)úW³Ê<ÖNq#>Ö³@õ¶³òyyÒNY8óW¸)÷~À|Ó3²1öE 93OÄ«øX½ÿ 4......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 176 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÈIg3Ö»jxF`-03öt~5¾PLGÞ7p¼×¬õ(P$úõõÇQOÖ©×ÍÛuñ¸KoYXáB-:gbß¾uU»ö^!lxaôäÈÌ¤9S||)æqb¼ÍW?ó»áLV»àÒ«Áé´ö©ª·}......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 136 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¿5r4Ö»jtxF`7ÛÎÔèò0oN(ýDI¦pf¨4X|ïy {Iå/ñè'Ûì² `tü¥B»(µJ£ûbbÛ®"öûMÿÄ?v><¶+M¦ðÛVDõAólmCðôÌ5¦´UA......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 88 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> È2ÐÏ:Ö»jDxF`"ù¬eQ£Ý5Êb¤ùö£8K,ä©ò´Á`±Wµ$@ü¶ Ñpæs¢ªÈ5µÉ¨§DÇATTÿü......., Found more than 2 POST requests like this POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 232 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¼E·JÖ»jÔxF`¡"5ÜÕ×ÓAVHêYjõ®JôìÑe¼@;U´ÕÏÔ»)z3ÇÛÚF÷9lá{á´.fÕ4øÉpÜUüð´)ø86Ê³UêÒjÞi»ã3¶jnB(DþmßïÆª7CØ²0Væ.......7a:T21b6,POST /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1 Host: aefd.nelreports.net Connection: keep-alive Content-Length: 958 Content-Type: application/reports+json Origin: https://www.bing.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Accept-Encoding: gzip deflate br zstd Accept-Language: en-US en;q=0.9 with payload ==> [{"age":44857 "body":{"elapsed_time":6504 "method":"GET" "phase":"connection" "protocol":"quic" "ref......., POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 164 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ànCûEè»jxF`tBùP,Òy«Çîw´]ñéÿY¹µ!F9ÍÅ (¶Fè»jXxF`|ãã6n$¬ÉþÁ«ËÝ°g«d3]oúßýÍÐbs(u{IË¬èP%%vé³#A«òØõR§sza?·@Ic×JÝ)î0E7±....... POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 72 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> ù Hè»j4xF`k}^FµWPëYö4Ã¼$ØÔ3%X%å²÷UP&15{³ÿëê....... POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 100 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> $%5Jè»jPxF`´Í¨d=0ùvöMiÍ¤%HMø?Ñyô¿ÿ ¹î 7áX# î^Ú a[Ô0ÐÇei«U}p:%tÃo¯ò4Q/±....... POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 56 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> ø5Jè»j$xF`>^¿"ÉWe,¢F0Íx¯ò%A\ëÅ|®......., POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 232 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÖeÕ»jÔxF`¢ñþýLZk{FÎ¾§¹ÓÇ£7U~kSá¡H.å?qùyiËq òzW!ÚøàðÕoâßHsH+XtlÊ3òó%Á(-sÏ!£Öü¶Öj6´B|9Ì^iÃÚîc¸ùHS^kÓú......., POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 80 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> øÙeÕ»j Üó²úgÕ»jÀxF`Áv{WÇØlSZøÚÐ¿\·E=7ábH;B~'XÖþyv;Giõ2ûe~g¸zø+| ¸ÔfâjÕ»jxF`ø)AOù³·òÜ÷ñp_¶0f ãºÄW.È1Ö+·ßð*õrÛº9?p>ñSñg#`ùw¨tÓ'ßx(tD6Âe+º´~µ½#J4ÈÉ;DaÇÃQ_}<$±`A²TÞÝqeÁ......., POST /api HTTP/1.1 Host: 149.154.167.91:80 Content-Type: application/x-www-form-urlencoded Content-Length: 288 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> lþãkÕ»jxF`NÚAT÷·vP¶n»Q<Ä|Iªð¡©Hf`WÇ8ÊµÃº¤;b2*qú03qeÞRÛxÊUùYE¼Ax{õh|ØÙöØ!IQR9äâDzå<¥ñìÝóò¬Ú6:"f:UÊqU¸......., POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 280 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> p´@mÕ»jxF`-F,$ÂGð_©lY÷êI÷ª(ýùNíX)áyp=Õ5S´ÖÌ·òìi ÑÚ¹t/>6Vb©·+Ot»Ï"ntãB¯voªGtÖmIåë¼f¸É³ázÐsmé/XÓÙîÁÿJ ......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 52 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> àãAmÕ»j xF`©pDWí¾ÏÇÓp\a¥î+Zû4!|R2......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 92 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ljÁ>nÕ»jHxF`uåÓZ¦ xuA{SMá+ÊóÛøû7g¹Ã#qsKófO¯L#èo¶5$½f´$¼¦Þ¡Jôfç......., POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 60 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ´NpÕ»j(xF`=Ó;;i9OI§÷èõÍÖØéÚîZb Ç¤`%......., POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 76 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ÄANqÕ»j8xF`wh>ý1»ò¼ÀÉÒÅò£=) ê½.&ü}.ÕEíÁKn£fì 0B±BSwai......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 268 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> T-rÕ»jøxF`QÁ¡-®öÍ_÷"É/õÆ{¸Oÿ]]¿´Tç?.ä¡îÁ(ÿf/]¹%Ü¢UôË¼G¾¡2|&YÍ<ß¥¤j<£·UÁ29dDÜâ]5hTÑmìdQ8 6LLÕwòZxÅ......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 212 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> 8.ìsÕ»jÀxF`PµyàÚ8ß¢!viÏ¬Ëo°æJÛäiÃ®¢róf>¹»¯ãfIÍésh(\[ñ ¢ô:1ÌpóQ±À\,~GØó0Á7£ =ö*ÄÁ#ëgäuD_¾t«leÛ¿D¦......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 116 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¤b-wÕ»j`xF`Î¯ÄkÔ¾ gG[Ù`@/Ë%®©v eªÄ %ÿì¸ßRþ×99æÞÍAöÈ[»ÿ÷TÙkÙ.í`EÕ|Uè;ÁÿäjyÉ]lx:Î¼kÌ9ù´à#......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 220 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> àgxÕ»jÈxF`xÄ¦ü0¥HSOâ|%/+©ÕÅÛ)>ñÔ"!£©7Ë¨º¦Ë4JuÌJºR¹ÝFÎÍð2Í¶ÚÀ0!Î>é½"%dÔÂGlîãUfÊ¡ZqTçç&Aìwínû^\ÉÕ¶jñ¯z....... POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 272 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> (Ó¯{Õ»jüxF`/Z÷«èõê4²ºúc>Ù]Aü÷ð*ýnM>³íCã3ìÙÎðÂtÏ§ Õ2¹ÂüÞcZ¾¬gy\nN÷¼6²WìHú+Â+£Ü»Ã®hæqç<(c1Ä¹Má*oäG¯³øW......., POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 40 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0 with payload ==> ¬b®|Õ»jxF`¹×øuY|*y-©û) Y....... POST /api HTTP/1.1 Host: 149.154.167.41:80 Content-Type: application/x-www-form-urlencoded Content-Length: 268 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> xxwáÕ»jøxF`Ñï)ûÃ-x+ù9ì^ÙÙ=ÓÔØº#vù&X+ÝK½ØÐm¿Ä(æ·êSh-?uûì{È+e+$<}h-¹t±£5¶[¡\h/fSÝã¼Äº¤umTQË[\kº7GÆÃKc*....... POST /api HTTP/1.1 Host: 91.108.56.160:80 Content-Type: application/x-www-form-urlencoded Content-Length: 252 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 with payload ==> 8=.áÕ»jèxF`oÆXõ°ö^â/|à#¾T1´å2Iì¡ON}D%.|îãqÛÇDá Á¹µòÝ|**§íèOºö¬ o°³Ä=õÒÇ~ÕZ÷Ú.fj¾ÿ¯álÚÉ(lVMý3®Ô³_éA¹¾.......7b:Td97,Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 18.238.55.69 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.22.17 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.49.251.25 on port 443 (UDP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.49.251.16 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 68.67.160.186 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.44.201.178 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 104.18.41.41 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 151.101.1.44 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.109.77 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.12 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.109.73 on port 443 (TCP); Domain: "edge-consumer-static.azureedge.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.218.206 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 142.251.218.129 on port 443 (TCP); Domain: "clients2.googleusercontent.com" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.10 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.55.178.216 on port 443 (UDP); Domain: "aefd.nelreports.net" Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 4.150.223.110 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 23.38.109.37 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 51.132.193.110 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.27.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 4.150.223.108 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 150.171.28.11 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" connects to 52.123.255.142 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 149.154.167.51 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 95.161.76.100 on port 443 (TCP) Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 95.161.76.100 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 149.154.167.51 on port 80 (TCP) Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 172.64.41.4 on port 443 (TCP); Domain: "mozilla.cloudflare-dns.com" Process "%PROGRAMFILES%\(x86)\Telegram\Telegram.exe" connects to 195.54.171.229 on port 443 (TCP)7c:T64a,"tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram\adddf.vbe" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\guig.dll" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\setup_temp.gea" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27.tmp" for deletion "tletgtup.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\shiCBF2.tmp" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\MSICC80.tmp" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\holder0.aiph" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram.msi" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram1.cab" for deletion "Telegram.exe" marked "C:\Program Files (x86)\Telegram\tdata\opengl_crash_check" for deletion "zgqmQcC2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp" for deletion "zgqmQcC2.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-B4JP8.tmp\c7130ec1.dll" for deletion "zgqmQcC2.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-B4JP8.tmp\_isetup\_setup64.tmp" for deletion7d:T8a3,"tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEE27" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram\adddf.vbe" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\guig.dll" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\setup_temp.gea" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27.tmp" with delete access "tletgtup.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\shiCBF2.tmp" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\MSICC80.tmp" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\holder0.aiph" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram.msi" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram FZ-LLC\Telegram 7.0.6.0\install\Telegram1.cab" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\log_start0.txt" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\CONFIG" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\key_datas.hLUgcz" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\KEY_DATA0" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\KEY_DATA1" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\settingss.vujVqm" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\SETTINGS0" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\SETTINGS1" with delete access "Telegram.exe" opened "C:\Program Files (x86)\Telegram\tdata\settingss.ylfyIb" with delete access7e:T6b7,WriteFile GetModuleFileNameA GetTempPathA GetFileSize LoadLibraryA GetFileAttributesA GetStartupInfoA VirtualAlloc GetProcAddress GetModuleHandleA CreateFileA CreateDirectoryA DeleteFileA RegOpenKeyExW RegCloseKey OpenProcessToken GetDriveTypeW GetModuleHandleW GetFileAttributesW CreateFileW GetTickCount GetVersionExW CreateProcessW DeleteFileW CreateThread FindFirstFileW GetSystemDirectoryW GetCommandLineW Sleep UnhandledExceptionFilter LockResource FindResourceW LoadLibraryW GetModuleFileNameW CreateDirectoryW LoadLibraryExW GetSystemInfo ExitThread VirtualProtect GetStartupInfoW GetUserNameW FindFirstFileExW GetModuleHandleExW FindNextFileW IsDebuggerPresent TerminateProcess GetCommandLineA FindFirstFileA FindNextFileA LoadLibraryExA SetSecurityDescriptorDacl RegEnumKeyExW RegDeleteValueW RegCreateKeyExW RegDeleteKeyW OpenProcess GetLogicalDrives GetComputerNameW CopyFileW DeviceIoControl WNetOpenEnumW ShellExecuteW ShellExecuteExW FindWindowExW FindWindowW SetWindowsHookExW GetCursorPos GetWindowThreadProcessId GetLastActivePopup GetUpdateRect GetFileSizeEx GetFileAttributesExW GetModuleHandleExA OpenFileMappingW CreateFileMappingW MapViewOfFile RegCreateKeyExA RegEnumKeyExA RegDeleteValueA RegOpenKeyExA SleepConditionVariableCS GetSystemDirectoryA GetTickCount64 GetNativeSystemInfo CreateThreadpoolWait CreateThreadpoolWork CreateThreadpoolIo CreateThreadpoolTimer NtQueryInformationToken StartServiceW LookupAccountNameW ChangeServiceConfig2W OutputDebugStringW FindResourceExW ReadProcessMemory Process32FirstW GetTempFileNameW GetTempPathW Process32NextW CreateToolhelp32Snapshot WSAStartup7f:T727,"tletgtup.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 920) "tletgtup.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 920) "tletgtup.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 920) "tletgtup.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" (Handle: 940) "tletgtup.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" (Handle: 940) "tletgtup.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\Telegram.exe" (Handle: 940) "tletgtup.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" (Handle: 944) "tletgtup.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" (Handle: 944) "tletgtup.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee27\zgqmQcC2.exe" (Handle: 944) "Telegram.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1352) "Telegram.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1352) "Telegram.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\msiexec.exe" (Handle: 1352) "zgqmQcC2.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp" (Handle: 616) "zgqmQcC2.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp" (Handle: 616) "zgqmQcC2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-421G2.tmp\zgqmQcC2.tmp" (Handle: 616)80:T400,AAABAAEAICAQlwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==81:T400,AAABAAEAICAQlwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==82:T400,AAABAAEAICAQlwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==83:T400,AAABAAEAICAQlwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790695687883,"unified_at":"2026-09-29T15:28:07.883Z","metadata":{"hashes":{"sha256":"45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","sha1":"ab3f7d644cd8bedc4a023094a0fbe8a79f867372","md5":"b46fac338a73b49baec70ea2c9dd20dd","sha512":"4b33b8e2dbbc2f30702ddffbcca8cac7c31f8c5b8a314fcbf19db86a44de16582ee75d7212fb409a566b89370555447f9acfe65694a81d0581ad6cee0fd352df","ssdeep":"1572864:a+6FOctotiaYumK6PCCTWMCibNESLd7KZilWhRUmL83sm:av7mN6KCaBQEaeAKymL3m","ssdeep_chunks":["1572864:a+6FOct","1572864:+6FOcto","1572864:6FOctot","1572864:FOctoti","1572864:Octotia","1572864:ctotiaY","1572864:totiaYu","1572864:otiaYum","1572864:tiaYumK","1572864:iaYumK6","1572864:aYumK6P","1572864:YumK6PC","1572864:umK6PCC","1572864:mK6PCCT","1572864:K6PCCTW","1572864:6PCCTWM","1572864:PCCTWMC","1572864:CCTWMCi","1572864:CTWMCib","1572864:TWMCibN","1572864:WMCibNE","1572864:MCibNES","1572864:CibNESL","1572864:ibNESLd","1572864:bNESLd7","1572864:NESLd7K","1572864:ESLd7KZ","1572864:SLd7KZi","1572864:Ld7KZil","1572864:d7KZilW","1572864:7KZilWh","1572864:KZilWhR","1572864:ZilWhRU","1572864:ilWhRUm","1572864:lWhRUmL","1572864:WhRUmL8","1572864:hRUmL83","1572864:RUmL83s","1572864:UmL83sm","3145728:a+6FOct","3145728:+6FOcto","3145728:6FOctot","3145728:FOctoti","3145728:Octotia","3145728:ctotiaY","3145728:totiaYu","3145728:otiaYum","3145728:tiaYumK","3145728:iaYumK6","3145728:aYumK6P","3145728:YumK6PC","3145728:umK6PCC","3145728:mK6PCCT","3145728:K6PCCTW","3145728:6PCCTWM","3145728:PCCTWMC","3145728:CCTWMCi","3145728:CTWMCib","3145728:TWMCibN","3145728:WMCibNE","3145728:MCibNES","3145728:CibNESL","3145728:ibNESLd","3145728:bNESLd7","3145728:NESLd7K","3145728:ESLd7KZ","3145728:SLd7KZi","3145728:Ld7KZil","3145728:d7KZilW","3145728:7KZilWh","3145728:KZilWhR","3145728:ZilWhRU","3145728:ilWhRUm","3145728:lWhRUmL","3145728:WhRUmL8","3145728:hRUmL83","3145728:RUmL83s","3145728:UmL83sm","1572864:av7mN6K","1572864:v7mN6KC","1572864:7mN6KCa","1572864:mN6KCaB","1572864:N6KCaBQ","1572864:6KCaBQE","1572864:KCaBQEa","1572864:CaBQEae","1572864:aBQEaeA","1572864:BQEaeAK","1572864:QEaeAKy","1572864:EaeAKym","1572864:aeAKymL","1572864:eAKymL3","1572864:AKymL3m"],"imphash":"d221b1dc8c3a08622f6512e7876527c8","pehash":"45bf65149d400a3410a82f0f0ec9bc134cf9a4f4"},"file_info":{"file_name":"tletgtup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":77950429,"entropy":8,"compile_timestamp":"2011-01-31T17:44:13","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790694612000,"last_seen":1790694612000,"last_multi_scan":1790694612000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":3756,"raw_size":4096},{"name":".rdata","virtual_address":"0x2000","virtual_size":1160,"raw_size":4096},{"name":".data","virtual_address":"0x3000","virtual_size":1376,"raw_size":4096},{"name":".gentee","virtual_address":"0x4000","virtual_size":54337,"raw_size":57344},{"name":".rsrc","virtual_address":"0x12000","virtual_size":15620,"raw_size":16384}],"section_names":[".text",".rdata",".data",".gentee",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["account_takeover","qr_code"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":113},"sandbox_signatures":{"informative_count":313,"suspicious_count":22,"malicious_count":5,"total":340},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.40412541","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.40412541 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00603fd21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"informative","value":"Detected QR code in the sample"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Malicious Link","attack_id":"T1204.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/001","identifiers":[{"type":"suspicious","value":"Detected QR code shortener or suspicious in-app deep link in QR code"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"},{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"informative","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Modifies the open verb of a shell class"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","identifiers":[{"type":"informative","value":"Modifies file association registry keys to establish persistence"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Calls an API typically used to acquire handle to a key container within a CSP"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"},{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Calls an API typically used to find device information"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Contains ability to detect virtual environment"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"},{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"malicious","value":"PE file contains executable resources"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"},{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve the host name of a computer"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"},{"type":"informative","value":"Contains ability enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"},{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"},{"type":"informative","value":"Contains ability to retrieve IPv4 TCP connection table (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to retrieve name of the domain controller for the current domain (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"},{"type":"informative","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"},{"type":"informative","value":"Imports network management related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"},{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Creates a writable file in a temporary directory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Calls an API that may be used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to monitor clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"suspicious","value":"Spawned process connects to a network"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Found more than one unique User Agent"},{"type":"informative","value":"Attempts to call internet-related API for network communication"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"References HTTP requests in memory"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"},{"type":"suspicious","value":"POSTs data to a web server (HTTPS)"},{"type":"informative","value":"Found POST request with headers in memory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","identifiers":[{"type":"suspicious","value":"Multiple POSTs requests with same length but different payloads to a web server (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"tactic":"Impact","technique":"Internal Defacement","attack_id":"T1491.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1491/001","identifiers":[{"type":"informative","value":"Opens multiple files with write access (often indicator for full-system infection)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netgroupgetinfo\"; File: \"MSICC80.tmp\")\n file/memory contains long string with (Indicator: \"netlocalgroupgetinfo\"; File: \"MSICC80.tmp\")\n Found reference string \"NetGroupGetInfo\" (Indicator: \"netgroupgetinfo\"; File: \"tletgtup.exe\")\n Found reference string \"NetLocalGroupGetInfo\" (Indicator: \"netlocalgroupgetinfo\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"tletgtup.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"tletgtup.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"tletgtup.exe\" called \"FindResourceA\" with parameter \"81261980\" - (UID: 00000000-00002028)\n \"cscript.exe\" called \"FindResourceA\" with parameter \"65\" - (UID: 00000000-00005884)\n \"cscript.exe\" called \"FindResourceA\" with parameter \"257\" - (UID: 00000000-00005884)\n \"zgqmQcC2.exe\" called \"FindResourceW\" with parameter \"12121\" - (UID: 00000000-00005544)\n \"zgqmQcC2.tmp\" called \"FindResourceW\" with parameter \"80962156\" - (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"FindResourceW\" with parameter \"80876268\" - (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"FindResourceW\" with parameter \"80853156\" - (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"tletgtup.exe\" called \"LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4268288'}\" (UID: 00000000-00002028)\n \"cscript.exe\" called \"LoadResource with parameter {'hModule': '1935605760', 'hResInfo': '20383920'}\" (UID: 00000000-00005884)\n \"cscript.exe\" called \"LoadResource with parameter {'hModule': '1935605760', 'hResInfo': '20383968'}\" (UID: 00000000-00005884)\n \"zgqmQcC2.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '21308400'}\" (UID: 00000000-00005544)\n \"zgqmQcC2.tmp\" called \"LoadResource with parameter {'hModule': '1179648', 'hResInfo': '4562016'}\" (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"LoadResource with parameter {'hModule': '1179648', 'hResInfo': '4562176'}\" (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"tletgtup.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\gentee27 (UID: 00000000-00002028)\n \"zgqmQcC2.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-421G2.tmp (UID: 00000000-00005544)\n \"zgqmQcC2.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-B4JP8.tmp\\installer (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-B4JP8.tmp\\_isetup (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-B4JP8.tmp (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability enumerate permission groups in the domain","description":"Observed api used in \"NETAPI32.dll\" [Source: MSICC80.tmp]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":1,"id":"static-224","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"tletgtup.exe\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"tletgtup.exe\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"tletgtup.exe\")\n Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"tletgtup.exe\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"tletgtup.exe\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp\")\n Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"MSICC80.tmp\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"MSICC80.tmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"tletgtup.exe\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"$Aesm~N6\" (Indicator: \"Aes\"; File: \"tletgtup.exe\")\n Found reference to \"$Aesm~N6\" (Indicator: \"Aes\"; Source: \"00000000-00002028.00000001.121962.05CD9000.00000004.mdmp\")\n Found reference to \"R$OidE\" (Indicator: \"Oid\"; Source: \"00000000-00002028.00000001.121962.05CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding 5DE61576F4706DD039D05539C82777F5 C\" (UID: 00000000-00005716)\n\n Process \"msiexec.exe\" with commandline \"/i \"%APPDATA%\\\\Telegram FZ-LLC\\\\Telegram 7.0.6.0\\\\install\\\\Telegram.msi\" AI_SETUPEXEPATH=%TEMP%\\\\gentee27\\\\Telegram.exe SETUPEXEDIR=%TEMP%\\\\gentee27\\\\ EXE_CMD_LINE=\"/exenoupdates /forcecleanup /wintime 1790694454 \"\" (UID: 00000000-00004396)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 9207F3247ECA5D17310D6690D137DC00 C\" (UID: 00000000-00006296)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 92934C34447114445647FD3DA00882EF\" (UID: 00000000-00001752)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding CEAF7B35BECB5F507545A2B757B2445E E Global\\\\MSI0000\" (UID: 00000000-00004064)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002028.00000001.121962.049C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003768.00000000.124668.00418000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006604.00000000.120963.077C0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Telegram.exe\" loaded module \"%WINDIR%\\SysWOW64\\dbghelp.dll\" at 72DC0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"msedge.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2a","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Telegram.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"tletgtup.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"tletgtup.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"tletgtup.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"tletgtup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"tletgtup.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00005544-44596-15-0138B718\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00005544-44596-22-01385568\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00005544-44596-148-0138BDF8\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00005544-44596-278-0138689C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to acquire handle to a key container within a CSP","description":"\"Telegram.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"c04af691a8020000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}\n \"Telegram.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"c06ef691a8020000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}\n \"Telegram.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"409df993a8020000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}\n \"Telegram.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"@u\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}\n \"Telegram.exe\" called \"CryptAcquireContextW\" with parameters {\"phProv\": \"40a2f993a8020000\"\n \"dwProvType\": \"1\"\n \"dwFlags\": \"4026531904\"}","origin":"API Call","mitre_attack_id":"T1027","relevance":1,"id":"api-228","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor ebx\n ecx in Stream UID: 00000000-00005544-44596-2190-013A382C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002028.00000000.120041.02F20000.00000004.mdmp, 00000000-00002028.00000001.121962.02F20000.00000004.mdmp, 00000000-00002028.00000002.123880.02F20000.00000004.mdmp, 00000000-00002028.00000003.124928.02F20000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003176.00000000.124508.901A0000.00000004.mdmp, 00000000-00003176.00000001.126427.901A0000.00000004.mdmp, 00000000-00003176.00000002.128347.901A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match – Encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"c7130ec1.dll\")\n Found string \"GetUserNameA\" (Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"tletgtup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusW\" (File: \"tletgtup.exe\")\n Found string \"QueryServiceStatusEx\" (File: \"tletgtup.exe\")\n Found string \"QueryServiceStatus\" (File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"tletgtup.exe\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"tletgtup.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003176-00000C2C-948433164\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"tletgtup.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"tletgtup.exe\"\n Found system information discovery API: \"WTSRegisterSessionNotification\" in file \"tletgtup.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"tletgtup.exe\"\n Found system information discovery API: \"GetNativeSystemInfo\" in file \"tletgtup.exe\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"tletgtup.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"tletgtup.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"tletgtup.exe\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"tletgtup.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"tletgtup.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"tletgtup.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"tletgtup.exe\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"tletgtup.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002028)\n \"cscript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005884)\n \"zgqmQcC2.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"tletgtup.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00002028)\n \"tletgtup.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"msedge.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"Telegram.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"mozilla.cloudflare-dns.com\"\n \"pHints\": \"b580fffb90\"\n \"ppResult\": \"200d8199a8020000\"}\n \"Telegram.exe\" called \"getaddrinfo\" with parameters {\"pNodeName\": \"dns.google.com\"\n \"pHints\": \"b580fffb90\"\n \"ppResult\": \"200b8199a8020000\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"Telegram.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"zgqmQcC2.tmp\" called \"EnumWindows\" with parameter \"9432144\" - (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"EnumWindows\" with parameter \"525176\" - (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"EnumWindows\" with parameter \"9433272\" - (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to find device information","description":"\"Telegram.exe\" called \"SetupDiGetClassDevsW\" with parameters {\"ClassGuid\": \"=w\"\n \"Flags\": \"18\"}","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-193","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"zgqmQcC2.tmp\" called \"GetWindowTextW\" with parameter \"0b4e004e656b280026004e002900\" - (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"zgqmQcC2.tmp\" called \"GetActiveWindow\" (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"tletgtup.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002028)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"tletgtup.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00002028)\n \"tletgtup.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002028)\n \"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005884)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00005884)\n \"Telegram.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve the host name of a computer","description":"\"Telegram.exe\" called \"gethostname\" with parameter DESKTOP-FVVF82A & 512 (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-225","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: zgqmQcC2.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: guig.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: zgqmQcC2.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: shiCBF2.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: MSICC80.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment","description":"\"Telegram.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMPRODUCTNAME\")\n \"Telegram.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"SYSTEMFAMILY\")\n \"Telegram.exe\" (Path: \"HKLM\\HARDWARE\\DESCRIPTION\\SYSTEM\\BIOS\"; Key: \"BASEBOARDPRODUCT\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-87","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00005544-44596-244-013838E0\n GetTickCount@KERNEL32.DLL at 00000000-00005544-44596-2058-0138F914","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00005544-44596-108-01383790\n FindFirstFileW@KERNEL32.DLL at 00000000-00005544-44596-148-0138BDF8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"GetVolumePathNameW\" (Indicator: \"GetVolumePathName\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00005544-44596-3765-01425A1C\n GetDriveTypeW@KERNEL32.DLL at 00000000-00005544-44596-3767-0138F7F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"tletgtup.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"tletgtup.exe\")\n Found reference to API \"CFindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00005544-44596-711-0138F834","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00005544-44596-3-013838D0\n GetVersion@KERNEL32.DLL at 00000000-00005544-44596-15-0138B718\n GetVersionExW@KERNEL32.DLL at 00000000-00005544-44596-3796-0142C228\n GetVersionExW@KERNEL32.DLL at 00000000-00005544-44596-3798-0138F924","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00005544-44596-114-01383858\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00005544-44596-2751-0138F83C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00005544-44596-2221-0138F7EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00005544-44596-14-013838D8\n GetSystemInfo@KERNEL32.DLL at 00000000-00005544-44596-1414-0138F8FC\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005544-44596-3796-0142C228\n GetNativeSystemInfo@KERNEL32.DLL at 00000000-00005544-44596-3797-0138F8F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"tletgtup.exe\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00005544-44596-115-01383860\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00005544-44596-118-0138BCB0\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00005544-44596-130-01383868\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00005544-44596-3784-0138F91C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"tletgtup.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"tletgtup.exe\")\n Found reference to API \"GetVolumeNameForVolumeMountPointW\" (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"tletgtup.exe\")\n Found reference to API \"NtQueryVolumeInformationFile\" (Indicator: \"NtQueryVolumeInformationFile\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00005544-44596-22-01385568\n GetProcessHeap@KERNEL32.DLL at 00000000-00005544-44596-24-01383940\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005544-44596-3728-014211B0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00005544-44596-3730-0142129C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 44596-147-0138BFF8","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp byte ptr [01434C10h], 00h\" and \"je 0138B796h\" at 00000000-00005544-44596-15-0138B718","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\GENTEERT.DLL\n %TEMP%\\IS-B4JP8.TMP\\C7130EC1.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$37","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"zgqmQcC2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"zgqmQcC2.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Telegram.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00006604-00000C17-882765573\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007080-00000C17-883085849\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00007080-00000C17-922793820\n \"msiexec.exe\" queries volume information of an entire harddrive\"C:\\\" at 00000000-00004396-00000C17-903579051\n \"Telegram.exe\" queries volume information of \"C:\\Program Files (x86)\\Telegram\\log.txt\" at 00000000-00003176-00000C17-937354726\n \"Telegram.exe\" queries volume information of \"C:\\Program Files (x86)\\Telegram\\log.txt\" at 00000000-00003176-00000C17-937355190","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"tletgtup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Telegram.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"zgqmQcC2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"zgqmQcC2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TELEGRAM.EXE\")\n \"zgqmQcC2.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\ _IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"Telegram.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"Telegram.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\2AF3362609D41F25.CUSTOMDESTINATIONS-MS\"\n \"Telegram.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.TEMP\"\n \"Telegram.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"tletgtup.exe\"\n Found registry modification API: \"RegCreateKeyExA\" in file \"tletgtup.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"EnumServicesStatusW\" (Indicator: \"EnumServicesStatus\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"tletgtup.exe\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"tletgtup.exe\")\n Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"c7130ec1.dll\")\n file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"MSICC80.tmp\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"tletgtup.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"tletgtup.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002028-00000C2C-867827492\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"c7130ec1.dll\")\n file/memory contains long string(File: \"genteert.dll\")\n file/memory contains long string(File: \"MSICC80.tmp\")\n file/memory contains long string(File: \"is-695HK.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002028.00000000.120041.1000A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"tletgtup.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"tletgtup.exe\" called \"CreateProcessA\" with parameter \"cscript.exe /nologo \"%APPDATA%\\Telegram\\adddf.vbe\" C:\\\" - (UID: 00000000-00002028)\n \"tletgtup.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\gentee27\\Telegram.exe\"\" - (UID: 00000000-00002028)\n \"tletgtup.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\gentee27\\zgqmQcC2.exe\"\" - (UID: 00000000-00002028)\n \"zgqmQcC2.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-421G2.tmp\\zgqmQcC2.tmp\" /SL5=\"$E0290\n1022629\n821760\n%TEMP%\\ge\" - (UID: 00000000-00005544)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"tletgtup.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002028)\n \"Telegram.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\ToServerAdvinst_Extract_C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\Telegram.exe\" - (UID: 00000000-00006604)\n \"Telegram.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\Global\\fb3dfb18d12c52a85ceb789c7f70e573-{87A94AB0-E370-4cde-98D3-ACC110C5967D}\" - (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"\"Telegram.exe\" called \"MoveFileW\" with parameter \\\\?\\%PROGRAMFILES%\\(x86)\\Telegram\\log_start0.txt & \\\\?\\%PROGRAMFILES%\\(x86)\\Telegram\\log.txt (UID: 00000000-00003176)\n \"Telegram.exe\" called \"MoveFileW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp & %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\2af3362609d41f25.customDestinations-ms (UID: 00000000-00003176)\n \"zgqmQcC2.tmp\" called \"MoveFileW\" with parameter %ALLUSERSPROFILE%\\MicrosoftDevKit\\is-695HK.tmp & %ALLUSERSPROFILE%\\MicrosoftDevKit\\Guard.dll (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"MoveFileW\" with parameter %ALLUSERSPROFILE%\\MicrosoftDevKit\\is-NBT1Q.tmp & %ALLUSERSPROFILE%\\MicrosoftDevKit\\Microsoft.Photos.exe (UID: 00000000-00003768)\n \"zgqmQcC2.tmp\" called \"MoveFileW\" with parameter %ALLUSERSPROFILE%\\MicrosoftDevKit\\Microsoft.Photos.exe & %ALLUSERSPROFILE%\\MicrosoftDevKit\\MicrosoftPhotos.exe (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3b","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"aefd.nelreports.net\"\n \"mozilla.cloudflare-dns.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"150.171.28.10:443\"\n \"23.44.201.178:443\"\n \"150.171.109.73:443\"\n \"142.251.218.129:443\"\n \"23.55.178.216:443\"\n \"23.55.178.216\"\n \"149.154.167.51:443\"\n \"95.161.76.100:443\"\n \"149.154.167.51:80\"\n \"95.161.76.100:80\"\n \"195.54.171.229:443\"\n \"172.64.41.4:443\"\n \"4.150.223.108:443\"\n \"150.171.22.17:443\"\n \"150.171.109.77:443\"\n \"150.171.27.10:443\"\n \"150.171.28.12:443\"\n \"23.49.251.25:443\"\n \"18.238.55.69:443\"\n \"151.101.1.44:443\"\n \"104.18.41.41:443\"\n \"68.67.160.186:443\"\n \"23.49.251.16:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"tletgtup.exe\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; File: \"tletgtup.exe\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00005544-44596-139-013839A4\n Sleep@KERNEL32.DLL at 00000000-00005544-44596-2041-0138FA0C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005544-44596-2994-013B9318\n WaitForSingleObject@KERNEL32.DLL at 00000000-00005544-44596-2996-0138FA5C\n Sleep@KERNEL32.DLL at 00000000-00005544-44596-3781-013A3A68\n MsgWaitForMultipleObjects at 00000000-00005544-44596-3791-014267C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"tletgtup.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: tletgtup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: zgqmQcC2.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: genteert.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: guig.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: zgqmQcC2.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00005544-44596-102-01383838\n LoadLibraryA@KERNEL32.DLL at 00000000-00005544-44596-2690-0138DFA0\n LoadLibraryW@KERNEL32.DLL at 00000000-00005544-44596-2804-0138F97C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"4ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"4ShellExecuteExA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"tletgtup.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"tletgtup.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"00000000-00003768.00000000.124668.00418000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"00000000-00003768.00000000.124668.00418000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"tletgtup.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002028.00000000.120041.1000A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"tletgtup.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"tletgtup.exe\")\n Found reference to API \"/ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3f","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$40","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: c7130ec1.dll)\n Found MoveFileW in import section (Source: zgqmQcC2.tmp)\n Found MoveFileExW in import section (Source: shiCBF2.tmp)\n Found MoveFileW in import section (Source: shiCBF2.tmp)\n Found MoveFileW in import section (Source: MSICC80.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"MsiExec.exe\" created file \"pipe\\ToServerAdvinst_Extract_C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\Telegram.exe\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$42","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$43","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"Telegram.exe\" failed to load missing module \"Windows.Web.UI.Interop.dll\" - [base:0; Status:c0000135]\n \"Telegram.exe\" failed to load missing module \"Windows.Web.UI.dll\" - [base:0; Status:c0000135]\n \"Telegram.exe\" failed to load missing module \"Windows.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$44","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\Global\\fb3dfb18d12c52a85ceb789c7f70e573-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$45","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$46","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"/nologo \"%APPDATA%\\\\Telegram\\\\adddf.vbe\" C:\\\\\" (UID: 00000000-00005884)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"$47","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$48","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"tletgtup.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73BD0000\n \"Telegram.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73BD0000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73BD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 735E0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$49","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 6F790000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"tletgtup.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"Telegram.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95040000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"Telegram.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 95040000\n \"zgqmQcC2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000\n \"zgqmQcC2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77670000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00b500000040c71194fe7f0000@ntdll.dll\"\n \"22002300b500000018c71194fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4a","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"shiCBF2.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"MSICC80.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"tletgtup.exe\" has an executable section named \".text\"\n \"zgqmQcC2.exe\" has an executable section named \".text\"\n \"zgqmQcC2.exe\" has an executable section named \".itext\"\n \"c7130ec1.dll\" has an executable section named \".text\"\n \"genteert.dll\" has an executable section named \".text\"\n \"guig.dll\" has an executable section named \".text\"\n \"zgqmQcC2.tmp\" has an executable section named \".text\"\n \"zgqmQcC2.tmp\" has an executable section named \".itext\"\n \"shiCBF2.tmp\" has an executable section named \".text\"\n \"shiCBF2.tmp\" has an executable section named \".wpp_sf\"\n \"MSICC80.tmp\" has an executable section named \".text\"\n \"is-695HK.tmp\" has an executable section named \".text\"\n \"is-NBT1Q.tmp\" has an executable section named \".text\"\n \"_setup64.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$4c","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4d","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2cf400\" greater than 0x100000\n Raw size of \".text\" is \"0x1aee00\" greater than 0x100000\n Raw size of \".rdata\" is \"0x134e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2cf32c\" greater than 0x100000\n Virtual size of \".text\" is \"0x1aed5f\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x134c32\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"shiCBF2.tmp\" has high imagebase \"0x180000000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\msiexec.exe\" [Source: 00000000-00006604-00000BC0-883726094]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"aefd.nelreports.net\"\n \"chycregi.com\"\n \"clients2.googleusercontent.com\"\n \"edge-consumer-static.azureedge.net\"\n \"mozilla.cloudflare-dns.com\"\n \"sadotoqu.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Telegram.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"Telegram.exe\" searching for class \"Shell_TrayWnd\"\n \"zgqmQcC2.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$52","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$53","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"tletgtup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"zgqmQcC2.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"c7130ec1.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"genteert.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"guig.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"zgqmQcC2.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"MSICC80.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-695HK.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-NBT1Q.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"tletgtup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\genteert.dll\"\n \"tletgtup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\guig.dll\"\n \"tletgtup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\setup_temp.gea\"\n \"tletgtup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\zgqmQcC2.exe\"\n \"tletgtup.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee27\\Telegram.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"zgqmQcC2.tmp\" with commandline \"/SL5=\"$E0290\n1022629\n821760\n%TEMP%\\\\gentee27\\\\zgqmQcC2.exe\"\" (UID: 00000000-00003768)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"cscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Telegram.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"msiexec.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"zgqmQcC2.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\" - Location: [%TEMP%\\is-421G2.tmp\\zgqmQcC2.tmp]\n \"shiCBF2.tmp\" has type \"PE32+ executable for MS Windows 10.00 (DLL) x86-64 8 sections\" - Location: [%TEMP%\\shiCBF2.tmp]\n \"MSICC80.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\" - Location: [%TEMP%\\MSICC80.tmp]\n \"is-695HK.tmp\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\" - Location: [%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-695HK.tmp]\n \"is-NBT1Q.tmp\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections\" - Location: [%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-NBT1Q.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-B4JP8.tmp\\_isetup\\_setup64.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies file association registry keys to establish persistence","description":"\"Telegram.exe\" (Path: \"HKCU\\TDESKTOP.TG\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TG\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TDESKTOP.TONSITE\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TONSITE\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\")","origin":"Registry Access","mitre_attack_id":"T1546.001","relevance":10,"id":"registry-232","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Modifies the open verb of a shell class","description":"\"Telegram.exe\" (Path: \"HKCU\\TDESKTOP.TG\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TG\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TDESKTOP.TONSITE\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\"), \"Telegram.exe\" (Path: \"HKCU\\TONSITE\\SHELL\\OPEN\\COMMAND\"; Key: \"(DEFAULT)\"; Value: \"\"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe\" -- \"%1\"\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-58","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"msedge.exe\" opens a process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" (UID: 00000000-00005112)\n \"msedge.exe\" opens a process \"C:\\Windows\\explorer.exe\" (UID: 00000000-00005112)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"c7130ec1.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-B4JP8.tmp\\c7130ec1.dll]- [targetUID: 00000000-00003768]\n \"genteert.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\genteert.dll]- [targetUID: 00000000-00002028]\n \"guig.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- [targetUID: 00000000-00002028]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$57","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"Telegram.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"tletgtup.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee27\\setup_temp.gea\"\n \"tletgtup.exe\" reads file \"c:\\tletgtup.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$59","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"tletgtup.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"tletgtup.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\tletgtup.exe\"\n \"tletgtup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"tletgtup.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"tletgtup.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"tletgtup.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Telegram.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"Telegram.exe\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Templates\"\n \"Telegram.exe\" touched file \"C:\\Windows\\Fonts\"\n \"Telegram.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"Telegram.exe\" touched file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates\"\n \"Telegram.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"Telegram.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp\"\n \"Telegram.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\"\n \"Telegram.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\genteert.dll\"\n \"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee27\\guig.dll\"\n \"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee27\\setup_temp.gea\"\n \"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\telegram\\adddf.vbe\"\n \"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee27\\zgqmqcc2.exe\"\n \"tletgtup.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee27\\telegram.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"is-NBT1Q.tmp\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"Telegram.exe\" called \"gethostname\" with parameters (UID: 00000000-00003176)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /api/report?cat=bingth&ndcParam=nadatio\"\n Found http requests in header \"POST /api\"\n Found http requests in header \"GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk\"\n Found http requests in header \"GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"tletgtup.exe\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"tletgtup.exe\")\n Found reference to API \":CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; File: \"tletgtup.exe\")\n Found reference to API \"NetGetDCName\" (Indicator: \"NetGetDCName\"; File: \"tletgtup.exe\")\n Found reference to API \"NetGroupGetInfo\" (Indicator: \"NetGroupGetInfo\"; File: \"tletgtup.exe\")\n Found reference to API \"NetUserModalsGet\" (Indicator: \"NetUserModalsGet\"; File: \"tletgtup.exe\")\n Found reference to API \"NetQueryDisplayInformation\" (Indicator: \"NetQueryDisplayInformation\"; File: \"tletgtup.exe\")\n Found reference to API \"NetLocalGroupGetInfo\" (Indicator: \"NetLocalGroupGetInfo\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"log_start0.txt\")\n Found reference to API \"gethostbyname\" (Indicator: \"gethostbyname\"; File: \"tletgtup.exe\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"tletgtup.exe\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 149.154.167.51 on port 80\n HTTP traffic to 95.161.76.100 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Found POST request with headers in memory","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1041","relevance":5,"id":"memorydump-7","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.qci*\" [Source: 00000000-00002028.00000001.121962.05CD9000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$62","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$63","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$64","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip\n deflate\nAccept-Language: en-US\n*\n\n GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip\n deflate\nAccept-Language: en-US\n*\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$65","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"mozilla.cloudflare-dns.com\" has high entropy\n Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetGetDCName\" which can \"return the name of the primary domain controller (PDC).\" [Source: MSICC80.tmp]\n Observed import api \"NetGroupGetInfo\" which can \"retrieve information about a particular global group in the security database.\" [Source: MSICC80.tmp]\n Observed import api \"NetLocalGroupGetInfo\" which can \"retrieve information about a particular local group account on a server.\" [Source: MSICC80.tmp]\n Observed import api \"NetQueryDisplayInformation\" which can \"return user account, computer, or group account information. Call this function to quickly enumerate account information for display in user interfaces.\" [Source: MSICC80.tmp]\n Observed import api \"NetUserGetInfo\" which can \"retrieve information about a particular user account on a server.\" [Source: MSICC80.tmp]\n Observed import api \"NetUserModalsGet\" which can \"retrieve global information for all users and global groups in the security database.\" [Source: MSICC80.tmp]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetCloseEnum\" which can \"end a network resource enumeration\" [Source: zgqmQcC2.tmp]\n Observed import api \"WNetEnumResource\" which can \"continue an enumeration of network recls.sources\" [Source: zgqmQcC2.tmp]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: zgqmQcC2.tmp]\n Observed import api \"WNetGetUniversalName\" which can \"take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name\" [Source: zgqmQcC2.tmp]\n Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: zgqmQcC2.tmp]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7\n Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: ab6ffd96a24d80c15184d4b42e5c0af4","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"References HTTP requests in memory","description":"Found HTTP requests \"POST /api HTTP/1.1\" in memory - Source: \"00000000-00003176.00000001.126427.99458000.00000004.mdmp\")\n Found HTTP requests \"POST /api HTTP/1.1\" in memory - Source: \"00000000-00003176.00000001.126427.99818000.00000004.mdmp\")\n Found HTTP requests \"POST /api HTTP/1.1\" in memory - Source: \"00000000-00003176.00000002.128347.99650000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":3,"id":"memorydump-6","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS OPTIONS request to https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=nadatio\n Found HTTPS POST request to https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=nadatio\n Found HTTPS GET request to https://mozilla.cloudflare-dns.com/dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk\n Found HTTPS POST request to https://149.154.167.51:80/api\n Found HTTPS POST request to https://95.161.76.100:80/api\n Found HTTPS GET request to https://mozilla.cloudflare-dns.com/dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa\n Found HTTPS POST request to https://149.154.167.91:80/api\n Found HTTPS POST request to https://91.108.56.160:80/api\n Found HTTPS POST request to https://149.154.167.41:80/api","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"mozilla.cloudflare-dns.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"150.171.28.10\" on port \"443\"\n HTTPS traffic to \"23.44.201.178\" on port \"443\"\n HTTPS traffic to \"150.171.109.73\" on port \"443\"\n HTTPS traffic to \"142.251.218.129\" on port \"443\"\n HTTPS traffic to \"23.55.178.216\" on port \"443\"\n HTTPS traffic to \"149.154.167.51\" on port \"443\"\n HTTPS traffic to \"95.161.76.100\" on port \"443\"\n HTTPS traffic to \"195.54.171.229\" on port \"443\"\n HTTPS traffic to \"172.64.41.4\" on port \"443\"\n HTTPS traffic to \"4.150.223.108\" on port \"443\"\n HTTPS traffic to \"150.171.22.17\" on port \"443\"\n HTTPS traffic to \"150.171.109.77\" on port \"443\"\n HTTPS traffic to \"150.171.27.10\" on port \"443\"\n HTTPS traffic to \"150.171.28.12\" on port \"443\"\n HTTPS traffic to \"23.49.251.25\" on port \"443\"\n HTTPS traffic to \"18.238.55.69\" on port \"443\"\n HTTPS traffic to \"151.101.1.44\" on port \"443\"\n HTTPS traffic to \"104.18.41.41\" on port \"443\"\n HTTPS traffic to \"68.67.160.186\" on port \"443\"\n HTTPS traffic to \"23.49.251.16\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Pattern Matching","name":"Detected QR code in the sample","description":"Found qr code in \"(File: \"QR Code\") tg://login?token=AQWV1btq3LMqplv8d6cJJJVL_qRb8aYJ6SBFieAI64lPuw==\"","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":1,"id":"string-995","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"shiCBF2.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"Telegram.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00003176\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal file \"is-695HK.tmp\"\n YARA signature for PEB traversal file \"is-NBT1Q.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00005544-44596-3760-01425910\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00005544-44596-3762-014258D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"tletgtup.exe\")\n Found reference to API \"WTSUnRegisterSessionNotification\" (Indicator: \"WTSUnRegisterSessionNotification\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$66","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00002028-00000C2C-867827325\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: c7130ec1.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: genteert.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: MSICC80.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-695HK.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (Source: \"00000000-00003176-00000C2C-937254744\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$67","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"tletgtup.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"tletgtup.exe\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve name of the domain controller for the current domain (API string)","description":"Found domain controller discovery API reference: \"NetGetDCName\" in file \"tletgtup.exe\"","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-904","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"Telegram.exe\" tries to directly access volume data \"A:\"\n \"Telegram.exe\" tries to directly access volume data \"B:\"\n \"Telegram.exe\" tries to directly access volume data \"D:\"\n \"Telegram.exe\" tries to directly access volume data \"E:\"\n \"Telegram.exe\" tries to directly access volume data \"F:\"\n \"Telegram.exe\" tries to directly access volume data \"G:\"\n \"Telegram.exe\" tries to directly access volume data \"H:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"Telegram.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72660000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Telegram.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"2a010956\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Telegram.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"5001082e\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Telegram.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffff990108fe\"\n \"cx\": \"1280\"\n \"cy\": \"10\"}\n \"Telegram.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"ffffffff990108fe\"\n \"cx\": \"10\"\n \"cy\": \"760\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Telegram.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"Telegram.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"Telegram.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Telegram.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"Telegram.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$69","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"tletgtup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tletgtup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Telegram.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"zgqmQcC2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"zgqmQcC2.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"tletgtup.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00002028)\n \"zgqmQcC2.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005544)\n \"zgqmQcC2.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"tletgtup.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"512\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"Telegram.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"PZMOHcN\"\n \"Sid\": \"0\"\n \"cbSid\": \"1c000000\"\n \"cchReferencedDomainName\": \"10000000\"\n \"peUse\": \"01000000\"}\n \"Telegram.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"PZMOHcN\"\n \"Sid\": \"781679833792\"\n \"cbSid\": \"1c000000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"tletgtup.exe\" called \"GetComputerNameA\" (UID: 00000000-00002028)\n \"tletgtup.exe\" called \"GetComputerNameW\" (UID: 00000000-00002028)\n \"Telegram.exe\" called \"GetComputerNameW\" (UID: 00000000-00003176)\n \"zgqmQcC2.tmp\" called \"GetComputerNameW\" (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Telegram.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}\n \"zgqmQcC2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"zgqmQcC2.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"tletgtup.exe\" called \"GetUserNameA\" (UID: 00000000-00002028)\n \"Telegram.exe\" called \"GetUserNameW\" (UID: 00000000-00003176)\n \"zgqmQcC2.tmp\" called \"GetUserNameW\" (UID: 00000000-00003768)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"$Aesm~N6\" (Indicator: \"aes\"; File: \"tletgtup.exe\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"cache_24_0\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"cache_18_0\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"cache_18_1\")\n file/memory contains long string with (Indicator: \"aes\"; File: \"PCAP\")\n Found string \"ChaCha20\" (Indicator: \"chacha\"; File: \"00000000-00003768.00000000.124668.00418000.00000002.mdmp\")\n Found string \"$Aesm~N6\" (Indicator: \"aes\"; Source: \"00000000-00002028.00000001.121962.05CD9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: zgqmQcC2.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00003768.00000000.124668.00418000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve IPv4 TCP connection table (API string)","description":"Found reference to API \"GetTcpTable\" (Indicator: \"GetTcpTable\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-119","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"tletgtup.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002028.00000000.120041.049E2000.00000002.mdmp, 00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve class object from a DLL object handler","description":"\"shiCBF2.tmp\" contains export function called \"DllGetClassObject\" at ordinal 157","origin":"Static Parser","mitre_attack_id":"T1559.001","relevance":1,"id":"static-177","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"tletgtup.exe\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"tletgtup.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"tletgtup.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002028.00000000.120041.1000A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00005544.00000000.124552.01381000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Telegram.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"tletgtup.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"tletgtup.exe\"\n Found registry deletion API: \"RegDeleteTreeA\" in file \"tletgtup.exe\"\n Found registry deletion API: \"RegDeleteValueA\" in file \"tletgtup.exe\"\n Found registry deletion API: \"RegDeleteTreeW\" in file \"tletgtup.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: MSICC80.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: zgqmQcC2.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: guig.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: zgqmQcC2.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: shiCBF2.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: MSICC80.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"tletgtup.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"tletgtup.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"tletgtup.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"tletgtup.exe\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"tletgtup.exe\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; File: \"tletgtup.exe\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; File: \"tletgtup.exe\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"tletgtup.exe\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"tletgtup.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"tletgtup.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"tletgtup.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000000.120041.1000A000.00000002.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"Telegram.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$70","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"msedge.exe\" opened \"\\Device\\KsecDD\"\n \"tletgtup.exe\" opened \"\\Device\\KsecDD\"\n \"Telegram.exe\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"\n \"MsiExec.exe\" opened \"\\Device\\KsecDD\"\n \"zgqmQcC2.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$71","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"Telegram.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"Telegram.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$72","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"tletgtup.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"00000000-00003768.00000001.124917.00410000.00000004.mdmp\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"tletgtup.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"tletgtup.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"tletgtup.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")\n Found reference to API \"IOpenMutexA\" (Indicator: \"OpenMutex\"; Source: \"00000000-00002028.00000000.120041.04D50000.00000004.mdmp, 00000000-00002028.00000001.121962.049C0000.00000004.mdmp, 00000000-00002028.00000002.123880.04D50000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$73","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"6B61835E29CEE158s.mSqlho has high entropy\"\n \"text has high entropy\"\n \"setup_temp.gea has high entropy\"\n \"settingss.ykZlYP has high entropy\"\n \"settingss.tgXjRv has high entropy\"\n \"settingss.adLBvH has high entropy\"\n \"settingss.ylfyIb has high entropy\"\n \"settingss.ZIDVdU has high entropy\"\n \"settingss.vujVqm has high entropy\"\n \"configs.AGsuGb has high entropy\"\n \"D877F783D5D3EF8Cs.tmrvYN has high entropy\"\n \"key_datas.hLUgcz has high entropy\"\n \"D877F783D5D3EF8Cs.AyilRI has high entropy\"\n \"D877F783D5D3EF8Cs.NXBOCn has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Telegram.msi\" - Location: [%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Telegram.msi]- [targetUID: 00000000-00006604]\n Dropped file: \"adddf.vbe\" - Location: [%APPDATA%\\Telegram\\adddf.vbe]- [targetUID: 00000000-00002028]\n Dropped file: \"Telegram1.cab\" - Location: [%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Telegram1.cab]- [targetUID: 00000000-00006604]\n Dropped file: \"JDBNMI9NN5IPU1ASRVYG.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp]- [targetUID: 00000000-00003176]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"tletgtup.exe\" was detected as \"Microsoft Visual C++ 5.0\"\n \"zgqmQcC2.exe\" was detected as \"Borland Delphi 4.0\"\n \"c7130ec1.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"genteert.dll\" was detected as \"Microsoft Visual C++ 6.0 DLL\"\n \"guig.dll\" was detected as \"Microsoft Visual C++ 6.0 DLL\"\n \"zgqmQcC2.tmp\" was detected as \"Borland Delphi 4.0\"\n \"MSICC80.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-695HK.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Opens multiple files with write access (often indicator for full-system infection)","description":"\"Telegram.exe\" opens more than 500 files with write access","origin":"API Call","mitre_attack_id":"T1491.001","relevance":10,"id":"api-49","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"tletgtup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"tletgtup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Telegram.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Telegram.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"zgqmQcC2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"zgqmQcC2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"zgqmQcC2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"zgqmQcC2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"tletgtup.exe\" has section name .gentee with entropy \"7.853136646307067\"\n \"is-NBT1Q.tmp\" has section name .sc1 with entropy \"7.965121690033688\"\n \"is-NBT1Q.tmp\" has section name .sc2 with entropy \"7.966161709342126\"\n \"is-NBT1Q.tmp\" has section name .tc3 with entropy \"7.965125721378439\"\n \"is-NBT1Q.tmp\" has section name .tc4 with entropy \"7.590988541971563\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"$74","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00000000-00005544-44596-3841-0138F99C\n LoadResource@KERNEL32.DLL at 00000000-00005544-44596-3842-0138F984\n SizeofResource@KERNEL32.DLL at 00000000-00005544-44596-3843-0138FA04\n FindResourceW@KERNEL32.DLL at 00000000-00005544-44596-3844-0138F794","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$75","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$76","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 23.55.178.216\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$77","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$78","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"Detected QR code shortener or suspicious in-app deep link in QR code","description":"Malicious Deep Link: Telegram deep link\nRisk: Telegram account takeover","origin":"File/Memory","mitre_attack_id":"T1204.001","relevance":10,"id":"string-8619","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"Found more than one unique User Agent","description":"Found the following User Agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\n Mozilla/5.0\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"Multiple POSTs requests with same length but different payloads to a web server (HTTPS)","description":"$79","origin":"Network Traffic","mitre_attack_id":"T1030","relevance":5,"id":"network-68","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"POSTs data to a web server (HTTPS)","description":"$7a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-67","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 149.154.167.51 on port 443 is sent without HTTP header\n TCP traffic to 95.161.76.100 on port 443 is sent without HTTP header\n TCP traffic to 149.154.167.51 on port 80 is sent without HTTP header\n TCP traffic to 95.161.76.100 on port 80 is sent without HTTP header\n TCP traffic to 195.54.171.229 on port 443 is sent without HTTP header\n TCP traffic to 172.64.41.4 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"$7b","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"is-NBT1Q.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"zgqmQcC2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$7c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$7d","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"zgqmQcC2.tmp\" claimed CRC 3618779 while the actual is CRC 3538629\n \"MSICC80.tmp\" claimed CRC 3392992 while the actual is CRC 464394\n \"is-695HK.tmp\" claimed CRC 464394 while the actual is CRC 203886","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7e","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"shiCBF2.tmp\" claims program is from Wed Aug 16 19:34:18 2102","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"zgqmQcC2.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-695HK.tmp\"\n File type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections\" was dropped at \"%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-NBT1Q.tmp\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"Telegram.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 724B0000\n \"zgqmQcC2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 72FE0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$7f","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"tletgtup.exe\" (UID: 00000000-00002028)\n Spawned process \"cscript.exe\" with commandline \"/nologo \"%APPDATA%\\\\Telegram\\\\adddf.vbe\" C:\\\\\" (UID: 00000000-00005884)\n Spawned process \"Telegram.exe\" (UID: 00000000-00006604)\n Spawned process \"Telegram.exe\" (UID: 00000000-00003176)\n Spawned process \"zgqmQcC2.exe\" (UID: 00000000-00005544)\n Spawned process \"zgqmQcC2.tmp\" with commandline \"/SL5=\"$E0290\n1022629\n821760\n%TEMP%\\\\gentee27\\\\zgqmQcC2.exe\"\" (UID: 00000000-00003768)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 6 domains and 6 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"intel_graph":{"map":{"Domain:aefd.nelreports.net":{"type":"Domain","value":"aefd.nelreports.net"},"Domain:chycregi.com":{"type":"Domain","value":"chycregi.com"},"Domain:clients2.googleusercontent.com":{"type":"Domain","value":"clients2.googleusercontent.com"},"Domain:edge-consumer-static.azureedge.net":{"type":"Domain","value":"edge-consumer-static.azureedge.net"},"Domain:mozilla.cloudflare-dns.com":{"type":"Domain","value":"mozilla.cloudflare-dns.com"},"Domain:sadotoqu.com":{"type":"Domain","value":"sadotoqu.com"},"File:02e6129b5fdf6dd51141a94846fd76150b1013cd20a54ca9f5b4241fd243e696":{"type":"File","value":"02e6129b5fdf6dd51141a94846fd76150b1013cd20a54ca9f5b4241fd243e696"},"File:153cf39bec496069d2139b1335eca58293715e9e4b895b81c38bdb816cbc6901":{"type":"File","value":"153cf39bec496069d2139b1335eca58293715e9e4b895b81c38bdb816cbc6901"},"File:17a80b1691a152b9adfec47c61352d7543d8b7094445034585bb7aacad673e42":{"type":"File","value":"17a80b1691a152b9adfec47c61352d7543d8b7094445034585bb7aacad673e42"},"File:1a17c0f222eebf5ae122271dfaa379c9fc4614000f4db5599d991bbd5d78f0d1":{"type":"File","value":"1a17c0f222eebf5ae122271dfaa379c9fc4614000f4db5599d991bbd5d78f0d1"},"File:1fd50d5a9f425df411410ea4cfeb5559d9b83971da299f82cd652d8961e5492c":{"type":"File","value":"1fd50d5a9f425df411410ea4cfeb5559d9b83971da299f82cd652d8961e5492c"},"File:2245e37b7aef76011bd7621319e5ae745b748195a8f9d1a90b943e099b02e0c4":{"type":"File","value":"2245e37b7aef76011bd7621319e5ae745b748195a8f9d1a90b943e099b02e0c4"},"File:23f14e330929fd5e95cb6555b86641cf05421ff9b8e432d90e2e331bc5f5fd33":{"type":"File","value":"23f14e330929fd5e95cb6555b86641cf05421ff9b8e432d90e2e331bc5f5fd33"},"File:281811fad6604a8c6583ea3d97acc9c590a5588a08c029abcd7821a86ff44089":{"type":"File","value":"281811fad6604a8c6583ea3d97acc9c590a5588a08c029abcd7821a86ff44089"},"File:3b3985e6e93d074ef384988ef25e706623193c778d6bff5fc1a1ac2992de9a33":{"type":"File","value":"3b3985e6e93d074ef384988ef25e706623193c778d6bff5fc1a1ac2992de9a33"},"File:3ea3d02b29a5d5afe6c5b93d5dc3500d59437b97f971c1dd33e61cee25985e5c":{"type":"File","value":"3ea3d02b29a5d5afe6c5b93d5dc3500d59437b97f971c1dd33e61cee25985e5c"},"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37":{"type":"File","value":"45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822":{"type":"File","value":"4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822"},"File:538b1bca476efd7e934af24cb1a5494dde0a1c8396d153020cee7e0ba216f62d":{"type":"File","value":"538b1bca476efd7e934af24cb1a5494dde0a1c8396d153020cee7e0ba216f62d"},"File:54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831":{"type":"File","value":"54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831"},"File:58550207773b9d02b539214d9d6122c279a06569df165c5474977e297e6d5431":{"type":"File","value":"58550207773b9d02b539214d9d6122c279a06569df165c5474977e297e6d5431"},"File:624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328":{"type":"File","value":"624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328"},"File:69a6e25482f7e2872082f12f55ea40f3ba7bf7dfba22e1551aee39e70a92fa82":{"type":"File","value":"69a6e25482f7e2872082f12f55ea40f3ba7bf7dfba22e1551aee39e70a92fa82"},"File:7bd9540010fd2e6043f7683918a9ff6b5f292cb5356cbe115f70a982242bbe2a":{"type":"File","value":"7bd9540010fd2e6043f7683918a9ff6b5f292cb5356cbe115f70a982242bbe2a"},"File:7da0cdc198e96d43268220e36c701534bde6768fbbcc413d65dff5dbc76d3359":{"type":"File","value":"7da0cdc198e96d43268220e36c701534bde6768fbbcc413d65dff5dbc76d3359"},"File:7fb43e597d714cce7ec001c871755b467d1ba3ee66739c38db0983a7b30a0e74":{"type":"File","value":"7fb43e597d714cce7ec001c871755b467d1ba3ee66739c38db0983a7b30a0e74"},"File:7fe98f711443647608256722eaceae95efbb50c8138c22b83c6ccd7c1e18f631":{"type":"File","value":"7fe98f711443647608256722eaceae95efbb50c8138c22b83c6ccd7c1e18f631"},"File:a73de0091c4eb9e8e938f4c2daf62b171b87b4e940a3f104530fb2c01dbc3526":{"type":"File","value":"a73de0091c4eb9e8e938f4c2daf62b171b87b4e940a3f104530fb2c01dbc3526"},"File:b42e686ddb3f1553725a0265365a0dfea91597ebda45240c9f473204ec07cba0":{"type":"File","value":"b42e686ddb3f1553725a0265365a0dfea91597ebda45240c9f473204ec07cba0"},"File:b564e6fabd95896bf9f8b32e6349a2a92b341259349cd83241fc0714d5887b95":{"type":"File","value":"b564e6fabd95896bf9f8b32e6349a2a92b341259349cd83241fc0714d5887b95"},"File:c3cf76dee706ca1ebb310280128cfc0b640b32b83097cfd442aa237b99e9223c":{"type":"File","value":"c3cf76dee706ca1ebb310280128cfc0b640b32b83097cfd442aa237b99e9223c"},"File:e080c07e5c8bff680972e05512894695423a5a34bce97a8df00f60ca1b0f95c1":{"type":"File","value":"e080c07e5c8bff680972e05512894695423a5a34bce97a8df00f60ca1b0f95c1"},"File:fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5":{"type":"File","value":"fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/vnd.ms-cab-compressed"},"Ip:104.18.41.41":{"type":"Ip","value":"104.18.41.41"},"Ip:142.251.218.129":{"type":"Ip","value":"142.251.218.129"},"Ip:149.154.167.51":{"type":"Ip","value":"149.154.167.51"},"Ip:150.171.109.73":{"type":"Ip","value":"150.171.109.73"},"Ip:150.171.109.77":{"type":"Ip","value":"150.171.109.77"},"Ip:150.171.22.17":{"type":"Ip","value":"150.171.22.17"},"Ip:150.171.27.10":{"type":"Ip","value":"150.171.27.10"},"Ip:150.171.28.10":{"type":"Ip","value":"150.171.28.10"},"Ip:150.171.28.12":{"type":"Ip","value":"150.171.28.12"},"Ip:151.101.1.44":{"type":"Ip","value":"151.101.1.44"},"Ip:172.64.41.4":{"type":"Ip","value":"172.64.41.4"},"Ip:18.238.55.69":{"type":"Ip","value":"18.238.55.69"},"Ip:195.54.171.229":{"type":"Ip","value":"195.54.171.229"},"Ip:23.44.201.178":{"type":"Ip","value":"23.44.201.178"},"Ip:23.49.251.16":{"type":"Ip","value":"23.49.251.16"},"Ip:23.49.251.25":{"type":"Ip","value":"23.49.251.25"},"Ip:23.55.178.216":{"type":"Ip","value":"23.55.178.216"},"Ip:4.150.223.108":{"type":"Ip","value":"4.150.223.108"},"Ip:68.67.160.186":{"type":"Ip","value":"68.67.160.186"},"Ip:95.161.76.100":{"type":"Ip","value":"95.161.76.100"},"Url:/api":{"type":"Url","value":"/api"},"Url:/api/report?cat=bingth&ndcParam=nadatio":{"type":"Url","value":"/api/report?cat=bingth&ndcParam=nadatio"},"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk":{"type":"Url","value":"/dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk"},"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa":{"type":"Url","value":"/dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa"}},"chains":[{"id":"1554515050655204454","root":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","edges":[],"verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]}},{"id":"1554515050663593063","root":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","edges":[{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.28.10"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:23.44.201.178"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.109.73"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:23.55.178.216"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:23.55.178.216"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:149.154.167.51"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:95.161.76.100"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:149.154.167.51"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:95.161.76.100"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:195.54.171.229"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:172.64.41.4"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:4.150.223.108"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.22.17"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.109.77"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.27.10"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:150.171.28.12"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:23.49.251.25"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:18.238.55.69"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:151.101.1.44"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:104.18.41.41"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:68.67.160.186"},{"edge_kind":"contacted_ip","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Ip:23.49.251.16"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:aefd.nelreports.net"},{"edge_kind":"resolves_to","from_key":"Domain:aefd.nelreports.net","to_key":"Ip:23.55.178.216"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:chycregi.com"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:clients2.googleusercontent.com"},{"edge_kind":"resolves_to","from_key":"Domain:clients2.googleusercontent.com","to_key":"Ip:142.251.218.129"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:edge-consumer-static.azureedge.net"},{"edge_kind":"resolves_to","from_key":"Domain:edge-consumer-static.azureedge.net","to_key":"Ip:150.171.109.73"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:mozilla.cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:mozilla.cloudflare-dns.com","to_key":"Ip:172.64.41.4"},{"edge_kind":"contacted_domain","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Domain:sadotoqu.com"},{"edge_kind":"contacted_url","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Url:/api/report?cat=bingth&ndcParam=nadatio"},{"edge_kind":"contacted_url","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Url:/api"},{"edge_kind":"contacted_url","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk"},{"edge_kind":"contacted_url","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","edges":[{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:7da0cdc198e96d43268220e36c701534bde6768fbbcc413d65dff5dbc76d3359"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:3b3985e6e93d074ef384988ef25e706623193c778d6bff5fc1a1ac2992de9a33"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:e080c07e5c8bff680972e05512894695423a5a34bce97a8df00f60ca1b0f95c1"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:c3cf76dee706ca1ebb310280128cfc0b640b32b83097cfd442aa237b99e9223c"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:58550207773b9d02b539214d9d6122c279a06569df165c5474977e297e6d5431"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:7fb43e597d714cce7ec001c871755b467d1ba3ee66739c38db0983a7b30a0e74"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:2245e37b7aef76011bd7621319e5ae745b748195a8f9d1a90b943e099b02e0c4"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:a73de0091c4eb9e8e938f4c2daf62b171b87b4e940a3f104530fb2c01dbc3526"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:69a6e25482f7e2872082f12f55ea40f3ba7bf7dfba22e1551aee39e70a92fa82"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:153cf39bec496069d2139b1335eca58293715e9e4b895b81c38bdb816cbc6901"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:1a17c0f222eebf5ae122271dfaa379c9fc4614000f4db5599d991bbd5d78f0d1"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:7fe98f711443647608256722eaceae95efbb50c8138c22b83c6ccd7c1e18f631"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:3ea3d02b29a5d5afe6c5b93d5dc3500d59437b97f971c1dd33e61cee25985e5c"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:23f14e330929fd5e95cb6555b86641cf05421ff9b8e432d90e2e331bc5f5fd33"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:1fd50d5a9f425df411410ea4cfeb5559d9b83971da299f82cd652d8961e5492c"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:17a80b1691a152b9adfec47c61352d7543d8b7094445034585bb7aacad673e42"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:538b1bca476efd7e934af24cb1a5494dde0a1c8396d153020cee7e0ba216f62d"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:b564e6fabd95896bf9f8b32e6349a2a92b341259349cd83241fc0714d5887b95"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:02e6129b5fdf6dd51141a94846fd76150b1013cd20a54ca9f5b4241fd243e696"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:281811fad6604a8c6583ea3d97acc9c590a5588a08c029abcd7821a86ff44089"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:b42e686ddb3f1553725a0265365a0dfea91597ebda45240c9f473204ec07cba0"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:7bd9540010fd2e6043f7683918a9ff6b5f292cb5356cbe115f70a982242bbe2a"},{"edge_kind":"extracted","from_key":"File:45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","to_key":"File:4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":32,"spawned_processes_count":32,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":114,"imported_dlls_count":226,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":113,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":23,"dns_resolutions_count":6,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["account_takeover","qr_code"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6abbd4cbafed2ee78b03cf8b","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","contacted_countries":["ATG","HKG","NLD","USA"],"submit_name":"tletgtup.exe","analysis_start_time":"2026-09-29T15:10:17+00:00","indicators_count":{"informative":313,"suspicious":76,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"150.171.28.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"23.44.201.178","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"150.171.109.73","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"142.251.218.129","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"23.55.178.216","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"23.55.178.216","port":0,"protocol":"ICMP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"149.154.167.51","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"95.161.76.100","port":443,"protocol":"TCP","country":"Antigua & Barbuda","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"149.154.167.51","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"95.161.76.100","port":80,"protocol":"TCP","country":"Antigua & Barbuda","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"195.54.171.229","port":443,"protocol":"TCP","country":"Hong Kong SAR China","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"172.64.41.4","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"4.150.223.108","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"150.171.22.17","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"150.171.109.77","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"150.171.27.10","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"150.171.28.12","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"23.49.251.25","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"18.238.55.69","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"151.101.1.44","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"104.18.41.41","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"68.67.160.186","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"address":"23.49.251.16","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"dns_resolutions":[{"domain":"aefd.nelreports.net","address":"23.55.178.216","ttl":350,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"domain":"chycregi.com","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"domain":"clients2.googleusercontent.com","address":"142.251.218.129","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"domain":"edge-consumer-static.azureedge.net","address":"150.171.109.73","ttl":1364,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"domain":"mozilla.cloudflare-dns.com","address":"172.64.41.4","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"domain":"sadotoqu.com","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"http_requests":[{"host":"aefd.nelreports.net","host_ip":"23.55.178.216:443","url":"/api/report?cat=bingth&ndcParam=nadatio","method":"OPTIONS","response_code":"200","response_phrase":"OK","header":"OPTIONS /api/report?cat=bingth&ndcParam=nadatio HTTP/1.1\nHost: aefd.nelreports.net\nConnection: keep-alive\nOrigin: https://www.bing.com\nAccess-Control-Request-Method: POST\nAccess-Control-Request-Headers: content-type\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nAccept-Encoding: gzip, deflate, br, zstd\nAccept-Language: en-US,en;q=0.9","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"host":"149.154.167.51:80","host_ip":"149.154.167.51:80","url":"/api","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api HTTP/1.1\nHost: 149.154.167.51:80\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 164\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"host":"mozilla.cloudflare-dns.com","host_ip":"172.64.41.4:443","url":"/dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=apv3.stel.com&type=16&random_padding=HvzJU9diIGWmzvmdHC5W1hxt9Ag2WnGfO5D6v104rYrtA3DnmAMwmhke2RJsywJtkrOJgo6x8fvk HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"host":"mozilla.cloudflare-dns.com","host_ip":"172.64.41.4:443","url":"/dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=apv3.stel.com&type=16&random_padding=OUNqMHxVRpDOhwdbpw7CWusbEEOV6mqHTnQatSFABNYWx9bs5aPyBZSGbFMdXxMZVa HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}],"processes":[{"pid":5112,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00005112","icon":"$80"},{"pid":7028,"ppid":5112,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d4,0x7ffe6dab0f18,0x7ffe6dab0f24,0x7ffe6dab0f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007028"},{"pid":3976,"ppid":5112,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1660,i,7164574262629461030,5828448917571787377,262144 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2080 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00003976"},{"pid":7944,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1892,i,9450691980023559794,7080268449146509251,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2296 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007944"},{"pid":6460,"ppid":5112,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1790692848635150 --launch-time-ticks=1872057117 --skip-read-main-dll --metrics-shmem-handle=2932,i,14904953367989741113,7306223255699715854,2097152 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3312 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00006460"},{"pid":6424,"ppid":5112,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1790692848635150 --launch-time-ticks=1872050729 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2032,i,10269949256467466166,15165786829959557369,2097152 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3296 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00006424"},{"pid":5300,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2332,i,425570212459878267,10598282692661692161,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3140 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00005300"},{"pid":7484,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=4932,i,831851275536149864,1930457018637899984,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=5016 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007484"},{"pid":6708,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=4952,i,17237066135335772561,10904607538857815910,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=5052 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00006708"},{"pid":192,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4724,i,6625902103667300906,9174260949340755610,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4800 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00000192"},{"pid":5256,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4852,i,4330537866795114090,14423912887371015257,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4848 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00005256"},{"pid":3636,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=4756,i,5240185745415899551,10132569651338470504,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=4716 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00003636"},{"pid":4436,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=5712,i,17002473376163874970,10054258637698789251,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5808 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00004436"},{"pid":8064,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5332,i,6647751840122487822,9754009400445119043,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=4740 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00008064"},{"pid":7872,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6084,i,16948720747241032951,8693135448715751644,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=4796 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007872"},{"pid":1468,"ppid":5112,"name":"msedge.exe","command_line":"--type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.16299.192 --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --skip-read-main-dll --metrics-shmem-handle=6080,i,8403308373733393634,15144793399413009435,262144 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=5620 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00001468"},{"pid":6936,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5848,i,2127699894206966145,6361863893929670236,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5204 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00006936"},{"pid":7868,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --skip-read-main-dll --metrics-shmem-handle=5276,i,6521823641826887648,6669043971544888859,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709003178624776 --mojo-platform-channel-handle=5248 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007868"},{"pid":5880,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6064,i,5638541609514502987,17164386412850745401,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709004115666625 --mojo-platform-channel-handle=6140 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00005880"},{"pid":7680,"ppid":5112,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=6032,i,14970726760453241703,5990117031215020776,524288 --field-trial-handle=2084,i,241085990685519026,15513071312412306500,262144 --variations-seed-version --trace-process-track-uuid=3190709005052708474 --mojo-platform-channel-handle=5876 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00005112","uid":"00000000-00007680"},{"pid":2028,"ppid":0,"name":"tletgtup.exe","command_line":"","sha256":"45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37","normalized_path":"C:\\tletgtup.exe","uid":"00000000-00002028","icon":"$81"},{"pid":5884,"ppid":2028,"name":"cscript.exe","command_line":"/nologo \"%APPDATA%\\Telegram\\adddf.vbe\" C:\\","sha256":"8d717ab837f26ecd2cc373d8ee3037798a115ba6a9ee958269f0cff056dc5cab","normalized_path":"%WINDIR%\\SysWOW64\\cscript.exe","parent_uid":"00000000-00002028","uid":"00000000-00005884"},{"pid":6604,"ppid":2028,"name":"Telegram.exe","command_line":"","sha256":"bd1c2b8c7b56bc680213161997b87d57c0a01ac0ab3772b2b7556aad4a844a21","normalized_path":"%TEMP%\\gentee27\\Telegram.exe","parent_uid":"00000000-00002028","uid":"00000000-00006604"},{"pid":4396,"ppid":6604,"name":"msiexec.exe","command_line":"/i \"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Telegram.msi\" AI_SETUPEXEPATH=%TEMP%\\gentee27\\Telegram.exe SETUPEXEDIR=%TEMP%\\gentee27\\ EXE_CMD_LINE=\"/exenoupdates /forcecleanup /wintime 1790694454 \"","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\SysWOW64\\msiexec.exe","parent_uid":"00000000-00006604","uid":"00000000-00004396"},{"pid":5544,"ppid":2028,"name":"zgqmQcC2.exe","command_line":"","sha256":"c3cf76dee706ca1ebb310280128cfc0b640b32b83097cfd442aa237b99e9223c","normalized_path":"%TEMP%\\gentee27\\zgqmQcC2.exe","parent_uid":"00000000-00002028","uid":"00000000-00005544"},{"pid":3768,"ppid":5544,"name":"zgqmQcC2.tmp","command_line":"/SL5=\"$E0290,1022629,821760,%TEMP%\\gentee27\\zgqmQcC2.exe\"","sha256":"174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013","normalized_path":"%TEMP%\\is-421G2.tmp\\zgqmQcC2.tmp","parent_uid":"00000000-00005544","uid":"00000000-00003768"},{"pid":7080,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00007080","icon":"$82"},{"pid":5716,"ppid":7080,"name":"MsiExec.exe","command_line":"-Embedding 5DE61576F4706DD039D05539C82777F5 C","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007080","uid":"00000000-00005716"},{"pid":6296,"ppid":7080,"name":"MsiExec.exe","command_line":"-Embedding 9207F3247ECA5D17310D6690D137DC00 C","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007080","uid":"00000000-00006296"},{"pid":1752,"ppid":7080,"name":"MsiExec.exe","command_line":"-Embedding 92934C34447114445647FD3DA00882EF","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007080","uid":"00000000-00001752"},{"pid":4064,"ppid":7080,"name":"MsiExec.exe","command_line":"-Embedding CEAF7B35BECB5F507545A2B757B2445E E Global\\MSI0000","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00007080","uid":"00000000-00004064"},{"pid":3176,"ppid":0,"name":"Telegram.exe","command_line":"","sha256":"0e79e5cc4c59c2b407f692de0c7b64d759ac6ae8280643ec84fbcbc72e96e016","normalized_path":"%PROGRAMFILES%\\(x86)\\Telegram\\Telegram.exe","uid":"00000000-00003176","icon":"$83"}],"all_imported_dlls":["policymanager.dll","ntdll.dll","shell32.dll","rasadhlp.dll","wscapi.dll","logoncli.dll","nsi.dll","winsta.dll","slc.dll","d3d9.dll","secur32.dll","domain_actions.dll","oneds.dll","pcacli.dll","libGLESv2.dll","msls31.dll","msi.dll","samlib.dll","onnxruntime.dll","D3D12.dll","riched20.dll","wintrust.dll","wwapi.dll","VxSSL64.dll","oleaut32.dll","c7130ec1.dll","vcruntime140_clr0400.dll","ELSCore.dll","Windows.Security.Authentication.OnlineId.dll","dpapi.dll","ExplorerFrame.dll","srvcli.dll","dmcmnutils.dll","OneCoreCommonProxyStub.dll","webauthn.dll","deviceaccess.dll","d3dcompiler_47.dll","actxprxy.dll","mf.dll","comdlg32.dll","msimg32.dll","atlthunk.dll","sfc_os.dll","devobj.dll","cabinet.dll","Windows.UI.dll","d3d11.dll","biwinrt.dll","hid.dll","cldapi.dll","AcLayers.dll","Windows.Security.Authentication.Web.Core.dll","clr.dll","Windows.UI.Immersive.dll","dcomp.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","mfplat.dll","version.dll","msvcp110_win.dll","netapi32.dll","shfolder.dll","slwga.dll","ole32.dll","MMDevAPI.dll","KernelBase.dll","msihnd.dll","urlmon.dll","profapi.dll","FirewallAPI.dll","genteert.dll","WindowsCodecs.dll","mscoree.dll","kernel32.dll","dsreg.dll","twinapi.appcore.dll","TextInputFramework.dll","telclient.dll","psapi.dll","mscoreei.dll","apphelp.dll","oneauth.dll","dbghelp.dll","RTWorkQ.dll","d3d10warp.dll","coml2.dll","clbcatq.dll","winhttp.dll","rsaenh.dll","wininet.dll","winrnr.dll","msasn1.dll","aepic.dll","iertutil.dll","MpOAV.dll","lpk.dll","combase.dll","winmmbase.dll","ws2_32.dll","wow64win.dll","vcruntime140_1.dll","winmm.dll","ResourcePolicyClient.dll","amsi.dll","wkscli.dll","sxs.dll","wevtapi.dll","netprofm.dll","wow64.dll","uxtheme.dll","crypt32.dll","CoreUIComponents.dll","DataExchange.dll","Windows.Web.dll","AppResolver.dll","nlaapi.dll","wlanapi.dll","imagehlp.dll","wldp.dll","comctl32.dll","ncrypt.dll","scrobj.dll","ucrtbase_clr0400.dll","ucrtbase.dll","wtsapi32.dll","well_known_domains.dll","taskschd.dll","NapiNSP.dll","msedge_elf.dll","advapi32.dll","cryptbase.dll","guig.dll","tiptsf.dll","msdmo.dll","shlwapi.dll","sspicli.dll","linkinfo.dll","npmproxy.dll","wow64cpu.dll","gdi32.dll","imm32.dll","dwmapi.dll","msctf.dll","DWrite.dll","rmclient.dll","ntasn1.dll","Windows.System.Profile.RetailInfo.dll","Windows.Devices.Enumeration.dll","setupapi.dll","srpapi.dll","cfgmgr32.dll","dusmapi.dll","PCPKsp.dll","sfc.dll","ncryptprov.dll","libEGL.dll","vk_swiftshader.dll","ntshrui.dll","sechost.dll","windows.storage.dll","userenv.dll","netutils.dll","CoreMessaging.dll","davhlpr.dll","RstrtMgr.dll","fusion.dll","ntmarta.dll","fwbase.dll","dxilconv.dll","samcli.dll","ffmpeg.dll","msvcp140.dll","vbscript.dll","bcrypt.dll","oleacc.dll","fltLib.dll","rpcrt4.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","GdiPlus.dll","msvcp_win.dll","Windows.Networking.Connectivity.dll","FWPUCLNT.DLL","kernel.appcore.dll","tbs.dll","VxSSL32.dll","usp10.dll","msisip.dll","WinTypes.dll","cscapi.dll","OnDemandConnRouteHelper.dll","msvcrt.dll","dhcpcsvc.dll","xmllite.dll","powrprof.dll","gpapi.dll","mscms.dll","mpr.dll","SHCore.dll","OneCoreUAPCommonProxyStub.dll","microsoft_shell_integration.dll","wshext.dll","user32.dll","BitsProxy.dll","qKD5CNX4.dll","BCP47Langs.dll","msedge.dll","twinapi.dll","rometadata.dll","vcruntime140.dll","deviceassociation.dll","sppc.dll","bcryptprimitives.dll","mdmregistration.dll","propsys.dll","dxgi.dll","devenum.dll","Windows.Media.MediaControl.dll","pnrpnsp.dll","win32u.dll","KBDUS.DLL","dnsapi.dll","cryptsp.dll","gdi32full.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","directmanipulation.dll","mswsock.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"Telegram.exe","sha256":"7da0cdc198e96d43268220e36c701534bde6768fbbcc413d65dff5dbc76d3359","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Telegram.msi","sha256":"3b3985e6e93d074ef384988ef25e706623193c778d6bff5fc1a1ac2992de9a33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"genteert.dll","sha256":"54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"6B61835E29CEE158s.mSqlho","sha256":"e080c07e5c8bff680972e05512894695423a5a34bce97a8df00f60ca1b0f95c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"zgqmQcC2.exe","sha256":"c3cf76dee706ca1ebb310280128cfc0b640b32b83097cfd442aa237b99e9223c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"83986FAE099FFDBEs.NIGiRR","sha256":"58550207773b9d02b539214d9d6122c279a06569df165c5474977e297e6d5431","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"cache_18_0","sha256":"7fb43e597d714cce7ec001c871755b467d1ba3ee66739c38db0983a7b30a0e74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"D877F783D5D3EF8Cs.NXBOCn","sha256":"2245e37b7aef76011bd7621319e5ae745b748195a8f9d1a90b943e099b02e0c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"83986FAE099FFDBEs.AhbOhd","sha256":"a73de0091c4eb9e8e938f4c2daf62b171b87b4e940a3f104530fb2c01dbc3526","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"JDBNMI9NN5IPU1ASRVYG.temp","sha256":"69a6e25482f7e2872082f12f55ea40f3ba7bf7dfba22e1551aee39e70a92fa82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"is-695HK.tmp","sha256":"153cf39bec496069d2139b1335eca58293715e9e4b895b81c38bdb816cbc6901","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"guig.dll","sha256":"624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"configs.AGsuGb","sha256":"1a17c0f222eebf5ae122271dfaa379c9fc4614000f4db5599d991bbd5d78f0d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"83986FAE099FFDBEs.BmVDSk","sha256":"7fe98f711443647608256722eaceae95efbb50c8138c22b83c6ccd7c1e18f631","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"log_start0.txt","sha256":"3ea3d02b29a5d5afe6c5b93d5dc3500d59437b97f971c1dd33e61cee25985e5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"D877F783D5D3EF8Cs.AyilRI","sha256":"23f14e330929fd5e95cb6555b86641cf05421ff9b8e432d90e2e331bc5f5fd33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"D877F783D5D3EF8Cs.tmrvYN","sha256":"1fd50d5a9f425df411410ea4cfeb5559d9b83971da299f82cd652d8961e5492c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"c7130ec1.dll","sha256":"17a80b1691a152b9adfec47c61352d7543d8b7094445034585bb7aacad673e42","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"cache_18_1","sha256":"538b1bca476efd7e934af24cb1a5494dde0a1c8396d153020cee7e0ba216f62d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"83986FAE099FFDBEs.BFhhNR","sha256":"b564e6fabd95896bf9f8b32e6349a2a92b341259349cd83241fc0714d5887b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"83986FAE099FFDBEs.BlBrZN","sha256":"02e6129b5fdf6dd51141a94846fd76150b1013cd20a54ca9f5b4241fd243e696","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Telegram1.cab","sha256":"281811fad6604a8c6583ea3d97acc9c590a5588a08c029abcd7821a86ff44089","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"is-NBT1Q.tmp","sha256":"b42e686ddb3f1553725a0265365a0dfea91597ebda45240c9f473204ec07cba0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5","sha256":"fd22633d8a7453e96aa6607da96dfa39d50730caa78762133a5f543457130be5","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"countries","sha256":"7bd9540010fd2e6043f7683918a9ff6b5f292cb5356cbe115f70a982242bbe2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"adddf.vbe","sha256":"4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"files_written":[{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\crashpad_5112_LNHLWCORWPSVDJHL","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.11962238258577508996","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.16417410777881701644","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.12406600315046303190","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.15998497345294384230","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.5921632297966297644","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.1168977900847891339","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.15544880074677896854","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.17076501762682365582","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.2432053137872693263","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.7357869056567346989","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.12166158592781805457","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.2759661862414629599","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.4284.12961883096196474585","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.3587288860321896539","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.9947989366836464256","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.9108435810350906598","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.3434408641291687771","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.1342303722700686225","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.10021863654917251656","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.12444843725425149499","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.11459254211632764288","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.12683662233911577242","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.14018939658504398908","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.5112.6044.17628198619450532556","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\LOCAL\\mojo.6424.2308.14758326880695475417","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\genteert.dll","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\gentee27.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\gentee27\\guig.dll","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\gentee27\\setup_temp.gea","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram\\adddf.vbe","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\gentee27\\zgqmQcC2.exe","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\gentee27\\Telegram.exe","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\holder0.aiph","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Telegram.msi","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Templates","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%WINDIR%\\Fonts","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\shiCBF2.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\MSICC80.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Telegram FZ-LLC\\Telegram 7.0.6.0\\install\\Telegram1.cab","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\is-421G2.tmp\\zgqmQcC2.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\is-B4JP8.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\is-B4JP8.tmp\\c7130ec1.dll","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-695HK.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%ALLUSERSPROFILE%\\MicrosoftDevKit\\is-NBT1Q.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\ToServerAdvinst_Extract_%TEMP%\\gentee27\\Telegram.exe","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\log_start0.txt","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\usertag","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%TEMP%\\18e9d2bc7c89adce61deb283e5ca18f5-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"pipe\\Global\\fb3dfb18d12c52a85ceb789c7f70e573-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\log.txt","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\shortcuts-default.json","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\shortcuts-custom.json","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\EMOJI\\CACHE_24_0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_0","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\key_datas.hLUgcz","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.vujVqm","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.ylfyIb","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\83986FAE099FFDBEs.BFhhNR","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\83986FAE099FFDBEs.NIGiRR","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\83986FAE099FFDBEs.AhbOhd","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.ZIDVdU","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\opengl_crash_check","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_1","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\83986FAE099FFDBEs.BlBrZN","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\83986FAE099FFDBEs.BmVDSk","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.adLBvH","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.tgXjRv","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_2","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_3","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_4","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_4","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\temp\\quit_0.ico","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\JDBNMI9NN5IPU1ASRVYG.temp","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_5","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_5","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_6","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_6","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_24_7","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\cache_18_7","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\emoji\\spoiler\\text","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\D877F783D5D3EF8Cs.NXBOCn","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\D877F783D5D3EF8C\\CONFIGS.OMGOYT","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\D877F783D5D3EF8C\\configs.AGsuGb","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\D877F783D5D3EF8Cs.AyilRI","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\D877F783D5D3EF8Cs.tmrvYN","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\countries","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\settingss.ykZlYP","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"path":"%PROGRAMFILES%\\(x86)\\Telegram\\tdata\\6B61835E29CEE158s.mSqlho","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:5112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:5112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:5112:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:5112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5112:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ChromeProcessSingletonStartup!","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SessionImmersiveColorMutex","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:3976:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:7944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:7944:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7484:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7484:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:7484:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:7484:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:6708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:6708:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:5256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:5256:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:3636:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:4436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:4436:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:8064:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:7872:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:1468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"mfx_d3d_mutex","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:1468:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:6936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:6936:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:7868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:7868:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:5880:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:7680:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ci516940532","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:2028:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:2028:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"ci516940532","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:6604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:6604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:6604:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6604:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6604:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4396:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:4396:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:5544:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:3768:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:3768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:3768:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\SM0:7080:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\BaseNamedObjects\\SM0:7080:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:1752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:1752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:4064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:4064:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"Local\\SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]},{"name":"SM0:3176:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd4cbafed2ee78b03cf8b"}]}]}},"report_ids":{"sandbox_job_ids":["6abbd4cbafed2ee78b03cf8b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dropper.Trojan.Generic Sample 45cf579fb674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 45cf579fb674…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Trojan.Generic Sample 45cf579fb674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 45cf579fb674…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/45cf579fb67411276d6ddc41f7aaa4c19098621c90ee3295dea8c06b433efc37"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Trojan.Generic Sample 45cf579fb674… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 45cf579fb674…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 5 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L84","11",{}]]