gh0strat | 0d94a9f55dffae231d0e08686f29576cbb2233bb28659dcf1dc73d42536fee18

Analysis

max time kernel
210s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20220722-en
resource tags

arch:x64arch:x86image:win10v2004-20220722-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2022 11:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Telegram中文版.msi
Size

49.4MB
MD5

2136db4ff59f623fdb2d29e07c59a552
SHA1

ec55f8e83cba1257ea8df5929eccff22daec766b
SHA256

0d94a9f55dffae231d0e08686f29576cbb2233bb28659dcf1dc73d42536fee18
SHA512

e4151a129133cde9579ca3500c339d8b9582764ad656c0d00275f106641c46e9f1addafc7c61614bfe2a800a774623fb61a85fb07450512cb880c6f92f69e116

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/3244-193-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3244-195-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3244-199-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3244-204-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3244-193-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/3244-195-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/3244-199-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/3244-204-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 6 IoCs

Processes:

Mouxuycvty.exeMouseOne.exeSearchCefViewsGhhc.exeTelegram.exeSearchRun.exeSearchRunCall.exe

pid process

2896 Mouxuycvty.exe
4108 MouseOne.exe
4320 SearchCefViewsGhhc.exe
4592 Telegram.exe
2824 SearchRun.exe
1088 SearchRunCall.exe

pid	process
2896	Mouxuycvty.exe
4108	MouseOne.exe
4320	SearchCefViewsGhhc.exe
4592	Telegram.exe
2824	SearchRun.exe
1088	SearchRunCall.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3244-191-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/3244-193-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/3244-195-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/3244-199-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/3244-204-0x0000000010000000-0x00000000101C6000-memory.dmp	upx

Loads dropped DLL 9 IoCs

Processes:

MsiExec.exeMouxuycvty.exeMouseOne.exeSearchCefViewsGhhc.exeSearchRun.exeSearchRunCall.exe

pid	process
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
4124	MsiExec.exe
2896	Mouxuycvty.exe
4108	MouseOne.exe
4320	SearchCefViewsGhhc.exe
2824	SearchRun.exe
1088	SearchRunCall.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exewlanext.exe

description	ioc	process
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	wlanext.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	wlanext.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	wlanext.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	wlanext.exe
File opened (read-only)	\??\K:	wlanext.exe
File opened (read-only)	\??\W:	wlanext.exe
File opened (read-only)	\??\E:	wlanext.exe
File opened (read-only)	\??\M:	wlanext.exe
File opened (read-only)	\??\S:	wlanext.exe
File opened (read-only)	\??\U:	wlanext.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	wlanext.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	wlanext.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	wlanext.exe
File opened (read-only)	\??\R:	wlanext.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\F:	wlanext.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	wlanext.exe
File opened (read-only)	\??\O:	wlanext.exe
File opened (read-only)	\??\P:	wlanext.exe
File opened (read-only)	\??\Y:	wlanext.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 14 IoCs

Processes:

wlanext.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_FE3F60C572CBD4CBBF58A7AA61D0386A	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wlanext.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_FE3F60C572CBD4CBBF58A7AA61D0386A	wlanext.exe
File created	C:\Windows\SysWOW64\LOG.OLG	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C	wlanext.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SearchRunCall.exe

description pid process target process

PID 1088 set thread context of 3244 1088 SearchRunCall.exe wlanext.exe

description	pid	process	target process
PID 1088 set thread context of 3244	1088	SearchRunCall.exe	wlanext.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e590371.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI93E.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1C83C3F3-9BF5-42D1-8E27-FB4E35F1C523}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI142E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e590371.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI611.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

3056 sc.exe
3420 sc.exe

pid	process
3056	sc.exe
3420	sc.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

vssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000005cd502df9bbdf3820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800005cd502df0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff0000000007000100006809005cd502df000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cd502df00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000005cd502df00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wlanext.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wlanext.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wlanext.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Telegram.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

520 taskkill.exe

pid	process
520	taskkill.exe

Modifies data under HKEY_USERS 20 IoCs

Processes:

wlanext.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wlanext.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	wlanext.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Telegram.exe

pid process

4592 Telegram.exe

pid	process
4592	Telegram.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMouxuycvty.exeSearchCefViewsGhhc.exeMouseOne.exewlanext.exe

pid	process
4048	msiexec.exe
4048	msiexec.exe
2896	Mouxuycvty.exe
2896	Mouxuycvty.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4320	SearchCefViewsGhhc.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
4108	MouseOne.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe
3244	wlanext.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exesrtasks.exetaskkill.exewlanext.exe

description	pid	process
Token: SeShutdownPrivilege	3500	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3500	msiexec.exe
Token: SeSecurityPrivilege	4048	msiexec.exe
Token: SeCreateTokenPrivilege	3500	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3500	msiexec.exe
Token: SeLockMemoryPrivilege	3500	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3500	msiexec.exe
Token: SeMachineAccountPrivilege	3500	msiexec.exe
Token: SeTcbPrivilege	3500	msiexec.exe
Token: SeSecurityPrivilege	3500	msiexec.exe
Token: SeTakeOwnershipPrivilege	3500	msiexec.exe
Token: SeLoadDriverPrivilege	3500	msiexec.exe
Token: SeSystemProfilePrivilege	3500	msiexec.exe
Token: SeSystemtimePrivilege	3500	msiexec.exe
Token: SeProfSingleProcessPrivilege	3500	msiexec.exe
Token: SeIncBasePriorityPrivilege	3500	msiexec.exe
Token: SeCreatePagefilePrivilege	3500	msiexec.exe
Token: SeCreatePermanentPrivilege	3500	msiexec.exe
Token: SeBackupPrivilege	3500	msiexec.exe
Token: SeRestorePrivilege	3500	msiexec.exe
Token: SeShutdownPrivilege	3500	msiexec.exe
Token: SeDebugPrivilege	3500	msiexec.exe
Token: SeAuditPrivilege	3500	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3500	msiexec.exe
Token: SeChangeNotifyPrivilege	3500	msiexec.exe
Token: SeRemoteShutdownPrivilege	3500	msiexec.exe
Token: SeUndockPrivilege	3500	msiexec.exe
Token: SeSyncAgentPrivilege	3500	msiexec.exe
Token: SeEnableDelegationPrivilege	3500	msiexec.exe
Token: SeManageVolumePrivilege	3500	msiexec.exe
Token: SeImpersonatePrivilege	3500	msiexec.exe
Token: SeCreateGlobalPrivilege	3500	msiexec.exe
Token: SeBackupPrivilege	1348	vssvc.exe
Token: SeRestorePrivilege	1348	vssvc.exe
Token: SeAuditPrivilege	1348	vssvc.exe
Token: SeBackupPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeBackupPrivilege	2584	srtasks.exe
Token: SeRestorePrivilege	2584	srtasks.exe
Token: SeSecurityPrivilege	2584	srtasks.exe
Token: SeTakeOwnershipPrivilege	2584	srtasks.exe
Token: SeBackupPrivilege	2584	srtasks.exe
Token: SeRestorePrivilege	2584	srtasks.exe
Token: SeSecurityPrivilege	2584	srtasks.exe
Token: SeTakeOwnershipPrivilege	2584	srtasks.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeRestorePrivilege	4048	msiexec.exe
Token: SeTakeOwnershipPrivilege	4048	msiexec.exe
Token: SeDebugPrivilege	520	taskkill.exe
Token: 33	3244	wlanext.exe
Token: SeIncBasePriorityPrivilege	3244	wlanext.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

msiexec.exeTelegram.exe

pid process

3500 msiexec.exe
3500 msiexec.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Telegram.exe

pid process

4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
4592 Telegram.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Mouxuycvty.exeMouseOne.exeSearchCefViewsGhhc.exeSearchRun.exeSearchRunCall.exeTelegram.exe

pid process

2896 Mouxuycvty.exe
4108 MouseOne.exe
4320 SearchCefViewsGhhc.exe
2824 SearchRun.exe
1088 SearchRunCall.exe
4592 Telegram.exe

pid	process
3500	msiexec.exe
3500	msiexec.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe

pid	process
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe
4592	Telegram.exe

pid	process
2896	Mouxuycvty.exe
4108	MouseOne.exe
4320	SearchCefViewsGhhc.exe
2824	SearchRun.exe
1088	SearchRunCall.exe
4592	Telegram.exe

Suspicious use of WriteProcessMemory 44 IoCs

Processes:

msiexec.exeMouxuycvty.exeMouseOne.exeNET.exeSearchCefViewsGhhc.exeSearchRun.exeSearchRunCall.exewlanext.exe

description	pid	process	target process
PID 4048 wrote to memory of 2584	4048	msiexec.exe	srtasks.exe
PID 4048 wrote to memory of 2584	4048	msiexec.exe	srtasks.exe
PID 4048 wrote to memory of 4124	4048	msiexec.exe	MsiExec.exe
PID 4048 wrote to memory of 4124	4048	msiexec.exe	MsiExec.exe
PID 4048 wrote to memory of 4124	4048	msiexec.exe	MsiExec.exe
PID 4048 wrote to memory of 2896	4048	msiexec.exe	Mouxuycvty.exe
PID 4048 wrote to memory of 2896	4048	msiexec.exe	Mouxuycvty.exe
PID 4048 wrote to memory of 2896	4048	msiexec.exe	Mouxuycvty.exe
PID 2896 wrote to memory of 4108	2896	Mouxuycvty.exe	MouseOne.exe
PID 2896 wrote to memory of 4108	2896	Mouxuycvty.exe	MouseOne.exe
PID 2896 wrote to memory of 4108	2896	Mouxuycvty.exe	MouseOne.exe
PID 4108 wrote to memory of 3420	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 3420	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 3420	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 3056	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 3056	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 3056	4108	MouseOne.exe	sc.exe
PID 4108 wrote to memory of 2432	4108	MouseOne.exe	NET.exe
PID 4108 wrote to memory of 2432	4108	MouseOne.exe	NET.exe
PID 4108 wrote to memory of 2432	4108	MouseOne.exe	NET.exe
PID 2432 wrote to memory of 1716	2432	NET.exe	net1.exe
PID 2432 wrote to memory of 1716	2432	NET.exe	net1.exe
PID 2432 wrote to memory of 1716	2432	NET.exe	net1.exe
PID 4048 wrote to memory of 4592	4048	msiexec.exe	Telegram.exe
PID 4048 wrote to memory of 4592	4048	msiexec.exe	Telegram.exe
PID 4320 wrote to memory of 2824	4320	SearchCefViewsGhhc.exe	SearchRun.exe
PID 4320 wrote to memory of 2824	4320	SearchCefViewsGhhc.exe	SearchRun.exe
PID 4320 wrote to memory of 2824	4320	SearchCefViewsGhhc.exe	SearchRun.exe
PID 2824 wrote to memory of 1088	2824	SearchRun.exe	SearchRunCall.exe
PID 2824 wrote to memory of 1088	2824	SearchRun.exe	SearchRunCall.exe
PID 2824 wrote to memory of 1088	2824	SearchRun.exe	SearchRunCall.exe
PID 1088 wrote to memory of 1052	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 1052	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 1052	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 1088 wrote to memory of 3244	1088	SearchRunCall.exe	wlanext.exe
PID 3244 wrote to memory of 520	3244	wlanext.exe	taskkill.exe
PID 3244 wrote to memory of 520	3244	wlanext.exe	taskkill.exe
PID 3244 wrote to memory of 520	3244	wlanext.exe	taskkill.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Telegram中文版.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3500

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4048

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2584

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding D0379E362CC9C2946A219732FAECD594
2⤵
- Loads dropped DLL
PID:4124

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896

C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108

C:\Windows\SysWOW64\sc.exe
sc create "XMouseUpdate" binPath= "C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewsGhhc.exe" type= own type= interact start= auto displayname= "ÓÃÓÚÖ§³ÖWindowsÏµÍ³°²È«·À»¤Ïà¹Ø·þÎñ"
4⤵
- Launches sc.exe
PID:3420

C:\Windows\SysWOW64\sc.exe
sc description XMouseUpdate "Microsoft°²È«·þÎñ"
4⤵
- Launches sc.exe
PID:3056

C:\Windows\SysWOW64\NET.exe
NET start XMouseUpdate
4⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start XMouseUpdate
5⤵
PID:1716

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1348

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewsGhhc.exe
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewsGhhc.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4320

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
"C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2824

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
shhsjdhljslkdhj
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\wlanext.exe
wlanext.exe
4⤵
PID:1052

C:\Windows\SysWOW64\wlanext.exe
wlanext.exe
4⤵
- Enumerates connected drives
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3244

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipaip2.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:520

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\MouseRoaming\Mouse2.bin
Filesize
2.5MB

MD5
9099bea0e17cf7eaebf9f34b8dda883f

SHA1
cf1b2607309f13c3dd82878184fbad22aacd65b6

SHA256
5f373ec9096ec811e9c9b20d2b66f3a37e552d7a8b8265573a910bb91a5ddcec

SHA512
972d7699c8f8fd952e6d13fabe7de38b16d3a338bef4a3d9b2a55ebfdcc99184c6e731503089442878c017c147bbd3e4faea70f2ed2be65a5713136986d156cd

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\WGLogin.olg
Filesize
403KB

MD5
e038dfc6380cace845daef5ad572d7b3

SHA1
a38a5e08c7c457bcb74a58b83a4182376851555a

SHA256
93ca537b16c33776740744d329478f5081845b12c61f723f4aa00f7025bbfa8f

SHA512
d8d528ffa256dffe982a0813e65d2a2b5d19926fd5bc99429e529b2da9d9e3814b7aff994e063e3b26358bf4512e6d2150241aeb4ebf4ed919c6e003109929e9

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.dll
Filesize
908KB

MD5
42e7a4eccf05af577af88e5bb52b60fb

SHA1
f93312f14039ba9abaa410e056c600a09a46cdf2

SHA256
cd72e87268d73bc433e8b3da28157a325b03d506d67015e86f31c1fffe8fbf41

SHA512
28ac6c3dc13defa10b2176d00c164af9561486adab7098fa5bddc2afe980de2477671f7523e15ad599f5fcdf0efb842d3f8fc9c9289745a1fe0dd0d56d0895e2

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.dll
Filesize
908KB

MD5
42e7a4eccf05af577af88e5bb52b60fb

SHA1
f93312f14039ba9abaa410e056c600a09a46cdf2

SHA256
cd72e87268d73bc433e8b3da28157a325b03d506d67015e86f31c1fffe8fbf41

SHA512
28ac6c3dc13defa10b2176d00c164af9561486adab7098fa5bddc2afe980de2477671f7523e15ad599f5fcdf0efb842d3f8fc9c9289745a1fe0dd0d56d0895e2

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.olg
Filesize
908KB

MD5
ba23edab2fa42d957f183dfc37e7b589

SHA1
e4abe02d6a7ccb4bcb998c7cc1fe6ea0c2ac6a7c

SHA256
7285b03a4d984d7da77b713fb27cd0a486fbfaaaafd91ba663e1c677ac98b511

SHA512
3c9747ff7a414653b02a87e3d93f5ef1ba599d9c87ee7b4b85942069e9ede90cde302ed170b117f53ceb05dd7e6a4f178202620cb12f9dacbc9c80bdb89b28a4

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\scrnshot.dll
Filesize
872KB

MD5
bf5299c399d3d734974eb83fa0d8b9ca

SHA1
aff35d159f032ce958b6ff0d2062307f2af87d15

SHA256
d50b2128dcd038a4aeb8174d9320d016e7e3b4cf670cae5354d26b8735ec9566

SHA512
0667b25b8633296628ae712f2d96ba771501a596264348d659937d9f04f0b72207a495086bc652c26aad6a842ab9addb67171f8ddf05a8c3da679f8557ebbfe7

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\scrnshot.dll
Filesize
872KB

MD5
bf5299c399d3d734974eb83fa0d8b9ca

SHA1
aff35d159f032ce958b6ff0d2062307f2af87d15

SHA256
d50b2128dcd038a4aeb8174d9320d016e7e3b4cf670cae5354d26b8735ec9566

SHA512
0667b25b8633296628ae712f2d96ba771501a596264348d659937d9f04f0b72207a495086bc652c26aad6a842ab9addb67171f8ddf05a8c3da679f8557ebbfe7

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewsGhhc.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewsGhhc.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\libcef.dll
Filesize
896KB

MD5
8492a87b7077f00d2b1c1946cf898169

SHA1
64b01f85f3cd70ca640fd5a22d680f3e8109e9bf

SHA256
1b2f0d00ed3f59d0077c6f1efcaef1eae1a700d92025e771d711132eae65b924

SHA512
f25f07b26ba518a3efa8ea6e7ff29e27dd0ee2aea81ae230d0400b3205a0b9ee1140a23a991b14ffe7c3b2313a2f87995ebc67ec7313a7c4e570c69bb3a52807

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\libcef.dll
Filesize
896KB

MD5
8492a87b7077f00d2b1c1946cf898169

SHA1
64b01f85f3cd70ca640fd5a22d680f3e8109e9bf

SHA256
1b2f0d00ed3f59d0077c6f1efcaef1eae1a700d92025e771d711132eae65b924

SHA512
f25f07b26ba518a3efa8ea6e7ff29e27dd0ee2aea81ae230d0400b3205a0b9ee1140a23a991b14ffe7c3b2313a2f87995ebc67ec7313a7c4e570c69bb3a52807

Download Submit
C:\Users\Admin\AppData\MouseRoaming\NULL.bin
Filesize
50B

MD5
8a1a442fbe480b78ed1f5d466e881a5a

SHA1
e695a3aba418f2d1702556136ce269e4bc040680

SHA256
f00025df1b49caa55c60c2e094a979a3ee470b43287da7ab75a1c5e113d65b53

SHA512
63e6fd74de8d6a6740f26340696c10387d34f9dfb16270cc982210c8758e4466034fdc6a8cd3a7f0e2a2c79a28fb75d34215b48832832a83014de4e1202cb05e

Download Submit
C:\Users\Admin\AppData\MouseRoaming\S-erNa
Filesize
22B

MD5
dc3f943de181f6f204c58a3f1c8dd2cd

SHA1
c20371d9b125c55caf6c43ec2cc5aa169977599e

SHA256
5583fd3eda334863c9100ca78ac6f80b1b365c897b937407c2e74bb67cd1f8f4

SHA512
bbcf1097b868204d0c2e064936bd6d19d06344f1a92107b0833635eb80bccac83e2f5bf9b90432a4c85ad343a27c75bbe066fc448ae0f067cd2ec004b23eb4da

Download Submit
C:\Users\Admin\AppData\MouseRoaming\libcef.dll
Filesize
952KB

MD5
616d8e703aecc00727ea27db365a3214

SHA1
e305b74fc8eac9cb6ef5350a46308b9670093e5f

SHA256
1696f7fc2303bd38d5977d7683d6b3a0e6f465f451418a024191900e170f7fbb

SHA512
3e96914ad4a9921a9ea7624e582d68397473e01b70215c8d2503fbb3e909a53149a46a21145f91d2463e52d388fbfe9b48282401ca1a2a56ff1839b69d0366ed

Download Submit
C:\Users\Admin\AppData\MouseRoaming\libcef.dll
Filesize
952KB

MD5
616d8e703aecc00727ea27db365a3214

SHA1
e305b74fc8eac9cb6ef5350a46308b9670093e5f

SHA256
1696f7fc2303bd38d5977d7683d6b3a0e6f465f451418a024191900e170f7fbb

SHA512
3e96914ad4a9921a9ea7624e582d68397473e01b70215c8d2503fbb3e909a53149a46a21145f91d2463e52d388fbfe9b48282401ca1a2a56ff1839b69d0366ed

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouse.bin
Filesize
3.7MB

MD5
2a8713429656db27aa1fcf1b33ac4f42

SHA1
fef201239c6df961ab9491cae76d32a01e81c92d

SHA256
f8b8f1c705e0f747c7e12789c4d11b8865e1e9404d81a432d725da08db8ce0d2

SHA512
a28e9ed05727422a6a97c40d4866851a818dc2de63d05f58b379a2fc84163097c0d197205b177a058b3342388e8226d12c76f8288bddfa16a499218470fbb852

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\NULL.bin
Filesize
50B

MD5
8a1a442fbe480b78ed1f5d466e881a5a

SHA1
e695a3aba418f2d1702556136ce269e4bc040680

SHA256
f00025df1b49caa55c60c2e094a979a3ee470b43287da7ab75a1c5e113d65b53

SHA512
63e6fd74de8d6a6740f26340696c10387d34f9dfb16270cc982210c8758e4466034fdc6a8cd3a7f0e2a2c79a28fb75d34215b48832832a83014de4e1202cb05e

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\scrnshot.dll
Filesize
936KB

MD5
a5d4d6ee291c0c7f7952c352f6ff9228

SHA1
c8365db1ef4abbe41d9f467da1a9491fa0c07f58

SHA256
0b264c0df87e57d1992e81b28a87a690fffca79544df5740f887cec4eb419f68

SHA512
502edd9e41e5806391ad51bab45a2bcc09b135184aa9f14030943769730ec10528bc962ec4694bc9bc916ed4ad3cf613fcf524801e2840e59eb550a8937e2a2c

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\scrnshot.dll
Filesize
936KB

MD5
a5d4d6ee291c0c7f7952c352f6ff9228

SHA1
c8365db1ef4abbe41d9f467da1a9491fa0c07f58

SHA256
0b264c0df87e57d1992e81b28a87a690fffca79544df5740f887cec4eb419f68

SHA512
502edd9e41e5806391ad51bab45a2bcc09b135184aa9f14030943769730ec10528bc962ec4694bc9bc916ed4ad3cf613fcf524801e2840e59eb550a8937e2a2c

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
Filesize
112.9MB

MD5
2cd62a83df66124097e1cd2a27ee8079

SHA1
110f1e0626accfe185281e9770092a71cf899290

SHA256
f9ab393bd93e347759732a9d91490c4b0d2d13714433a12042960ae70bf68ab7

SHA512
b74543c27ddff9262e01e96b823ea8f2194e21f71f0038b6201c1ab09a93a59b071ac60f2766af83b642cfd9b09cb44a571c6d8351a8cc17fe640b59ce5f0d54

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
Filesize
112.9MB

MD5
2cd62a83df66124097e1cd2a27ee8079

SHA1
110f1e0626accfe185281e9770092a71cf899290

SHA256
f9ab393bd93e347759732a9d91490c4b0d2d13714433a12042960ae70bf68ab7

SHA512
b74543c27ddff9262e01e96b823ea8f2194e21f71f0038b6201c1ab09a93a59b071ac60f2766af83b642cfd9b09cb44a571c6d8351a8cc17fe640b59ce5f0d54

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\754D72BC3CEF17BEs
Filesize
326KB

MD5
e3ec74015bd05491d9f49e2211a1189d

SHA1
d2158ae895969a37e8f4892aa06669793838242f

SHA256
35e625b7bf0c76ee76f4977a5fc8f589309d1671f70ca25bcaeb89abf6b4059c

SHA512
2ceca593b149c763eb840d8b26e95c8e6599070c1b1a5db746770b8292f6a5c2f79d287b03b33537c495283a015f45df0de239f3ff0e2030f74bc2ba27f894a0

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\settingss
Filesize
1KB

MD5
7fbb22b43dc8098ca8938695d75f4413

SHA1
d904ab079c3364040ba5571219d2bd65868f6d94

SHA256
efded9c235cbfcdde00a8e0d0c5857946cfc6bc49909aa88d2d0cc5a5904783e

SHA512
0a56f666e1c04092c047d80c6ba183d1eba2a81493043e20378d06f34e24917c84ce147daf346fa938992a9f27a1f1ffa10998519e155e842576b7a873089265

Download Submit
C:\Windows\Installer\MSI611.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSI611.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSI93E.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSI93E.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSI98D.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSI98D.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIA3A.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIA3A.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Filesize
23.0MB

MD5
e3cdb7e86c9db63ac1bcae6b32eb5b04

SHA1
fca3e326893d4da85360402fbfccbd7848319b70

SHA256
09e1e69dd23f52a6c0269492aec520ff2b9377f836259777e088f333fcfadfe0

SHA512
28fd08504be0476506536aab56f18bea8df188d9d42715a4d6f0b21650f5283c7d82f3c3a42038549da3b12fcbca15f513e8ad11f334e38d50fe361551d59d65

Download Submit
\??\Volume{df02d55c-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e044c9cc-9f7e-4847-8247-2afa6775c23a}_OnDiskSnapshotProp
Filesize
5KB

MD5
016424c1fa7914b0feda19a0b7031895

SHA1
ff4c6d1ba5849b5700474d2416bccb4a0428ebae

SHA256
ab803e6451b22802815efd36679382692ea3c53c014727e852f51c9e560fcc61

SHA512
bd7e8e2a505b5375f74b3d32cdc10e1f934ad06b4b6eaf0dd872b3b928e03dea1cdc6e1505d0cb5a1993b436f5438f372b60958f448c80e55ef0a2265dbaa15c

Download Submit
memory/520-202-0x0000000000000000-mapping.dmp

Download
memory/1052-184-0x0000000000000000-mapping.dmp

Download
memory/1088-178-0x0000000000000000-mapping.dmp

Download
memory/1716-162-0x0000000000000000-mapping.dmp

Download
memory/2432-161-0x0000000000000000-mapping.dmp

Download
memory/2584-132-0x0000000000000000-mapping.dmp

Download
memory/2824-170-0x0000000000000000-mapping.dmp

Download
memory/2896-144-0x0000000000000000-mapping.dmp

Download
memory/3056-160-0x0000000000000000-mapping.dmp

Download
memory/3244-193-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/3244-195-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/3244-204-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/3244-185-0x0000000000000000-mapping.dmp

Download
memory/3244-186-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3244-187-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3244-190-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3244-191-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/3244-199-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/3244-197-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3244-196-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/3420-159-0x0000000000000000-mapping.dmp

Download
memory/4108-198-0x0000000077500000-0x0000000077510000-memory.dmp

Filesize
64KB

Download
memory/4108-151-0x0000000000000000-mapping.dmp

Download
memory/4124-133-0x0000000000000000-mapping.dmp

Download
memory/4320-176-0x0000000077500000-0x0000000077510000-memory.dmp

Filesize
64KB

Download
memory/4320-167-0x0000000077500000-0x0000000077510000-memory.dmp

Filesize
64KB

Download
memory/4592-168-0x0000000000000000-mapping.dmp

Download
memory/4592-177-0x0000018F6D900000-0x0000018F6D910000-memory.dmp

Filesize
64KB

Download