gh0strat | 785e9b07fc8ed60165bccab77cd09e1a7991ce1c54c6afb58a9d4d37b76e69e0

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2022 07:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Tele-CN汉化.msi
Size

49.4MB
MD5

158f0c8142dd01e983f1797a6264362e
SHA1

42c8e368334d75c6c6deeac9dac8f8cc0f9c812c
SHA256

785e9b07fc8ed60165bccab77cd09e1a7991ce1c54c6afb58a9d4d37b76e69e0
SHA512

7990f8e421be357b9e6adc50731b4c2b0b952718809a8765b1572979c6abc5dd38c1d77533afd74ddba44c19cc743e201498e73915687353a7567f6ead62c394

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 4 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/2080-192-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2080-190-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2080-197-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit
behavioral2/memory/2080-200-0x0000000010000000-0x00000000101C6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2080-192-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/2080-190-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/2080-197-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat
behavioral2/memory/2080-200-0x0000000010000000-0x00000000101C6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Creates new service(s) 1 TTPs
persistence

New Service
T1050
Executes dropped EXE 6 IoCs

Processes:

Mouxuycvty.exeMouseOne.exeSearchCefViewJLpih.exeTelegram.exeSearchRun.exeSearchRunCall.exe

pid process

4940 Mouxuycvty.exe
5032 MouseOne.exe
4364 SearchCefViewJLpih.exe
740 Telegram.exe
1388 SearchRun.exe
1776 SearchRunCall.exe

pid	process
4940	Mouxuycvty.exe
5032	MouseOne.exe
4364	SearchCefViewJLpih.exe
740	Telegram.exe
1388	SearchRun.exe
1776	SearchRunCall.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2080-188-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/2080-192-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/2080-190-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/2080-197-0x0000000010000000-0x00000000101C6000-memory.dmp	upx
behavioral2/memory/2080-200-0x0000000010000000-0x00000000101C6000-memory.dmp	upx

Loads dropped DLL 9 IoCs

Processes:

MsiExec.exeMouxuycvty.exeMouseOne.exeSearchCefViewJLpih.exeSearchRun.exeSearchRunCall.exe

pid	process
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
2332	MsiExec.exe
4940	Mouxuycvty.exe
5032	MouseOne.exe
4364	SearchCefViewJLpih.exe
1388	SearchRun.exe
1776	SearchRunCall.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exemsiexec.exewlanext.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	wlanext.exe
File opened (read-only)	\??\O:	wlanext.exe
File opened (read-only)	\??\S:	wlanext.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	wlanext.exe
File opened (read-only)	\??\J:	wlanext.exe
File opened (read-only)	\??\W:	wlanext.exe
File opened (read-only)	\??\Y:	wlanext.exe
File opened (read-only)	\??\L:	wlanext.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	wlanext.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Q:	wlanext.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	wlanext.exe
File opened (read-only)	\??\I:	wlanext.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	wlanext.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	wlanext.exe
File opened (read-only)	\??\U:	wlanext.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	wlanext.exe
File opened (read-only)	\??\V:	wlanext.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	wlanext.exe
File opened (read-only)	\??\T:	wlanext.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	wlanext.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\F:	wlanext.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in System32 directory 14 IoCs

Processes:

wlanext.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C	wlanext.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE\getip[1].htm	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A053CFB63FC8E6507871752236B5CCD5_FE3F60C572CBD4CBBF58A7AA61D0386A	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\ACF244F1A10D4DBED0D88EBA0C43A9B5_16756CC7371BB76A269719AA1471E96C	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	wlanext.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A053CFB63FC8E6507871752236B5CCD5_FE3F60C572CBD4CBBF58A7AA61D0386A	wlanext.exe
File created	C:\Windows\SysWOW64\LOG.OLG	wlanext.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SearchRunCall.exe

description pid process target process

PID 1776 set thread context of 2080 1776 SearchRunCall.exe wlanext.exe

description	pid	process	target process
PID 1776 set thread context of 2080	1776	SearchRunCall.exe	wlanext.exe

Drops file in Windows directory 11 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIEE7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF66F.tmp	msiexec.exe
File created	C:\Windows\Installer\e56ed62.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56ed62.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0BF.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C0C88077-0593-42AA-9DF4-8FC342D86439}	msiexec.exe

Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exesc.exe

pid process

2104 sc.exe
1976 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
2104	sc.exe
1976	sc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

wlanext.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wlanext.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wlanext.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Telegram.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Telegram.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	Telegram.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Telegram.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2248 taskkill.exe

pid	process
2248	taskkill.exe

Modifies data under HKEY_USERS 20 IoCs

Processes:

wlanext.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	wlanext.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	wlanext.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	wlanext.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption"	wlanext.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	wlanext.exe

Runs net.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

Telegram.exe

pid process

740 Telegram.exe

pid	process
740	Telegram.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msiexec.exeMouxuycvty.exeSearchCefViewJLpih.exeMouseOne.exewlanext.exe

pid	process
3564	msiexec.exe
3564	msiexec.exe
4940	Mouxuycvty.exe
4940	Mouxuycvty.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
4364	SearchCefViewJLpih.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
5032	MouseOne.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe
2080	wlanext.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

Processes:

msiexec.exemsiexec.exevssvc.exetaskkill.exewlanext.exe

description	pid	process
Token: SeShutdownPrivilege	1856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1856	msiexec.exe
Token: SeSecurityPrivilege	3564	msiexec.exe
Token: SeCreateTokenPrivilege	1856	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1856	msiexec.exe
Token: SeLockMemoryPrivilege	1856	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1856	msiexec.exe
Token: SeMachineAccountPrivilege	1856	msiexec.exe
Token: SeTcbPrivilege	1856	msiexec.exe
Token: SeSecurityPrivilege	1856	msiexec.exe
Token: SeTakeOwnershipPrivilege	1856	msiexec.exe
Token: SeLoadDriverPrivilege	1856	msiexec.exe
Token: SeSystemProfilePrivilege	1856	msiexec.exe
Token: SeSystemtimePrivilege	1856	msiexec.exe
Token: SeProfSingleProcessPrivilege	1856	msiexec.exe
Token: SeIncBasePriorityPrivilege	1856	msiexec.exe
Token: SeCreatePagefilePrivilege	1856	msiexec.exe
Token: SeCreatePermanentPrivilege	1856	msiexec.exe
Token: SeBackupPrivilege	1856	msiexec.exe
Token: SeRestorePrivilege	1856	msiexec.exe
Token: SeShutdownPrivilege	1856	msiexec.exe
Token: SeDebugPrivilege	1856	msiexec.exe
Token: SeAuditPrivilege	1856	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1856	msiexec.exe
Token: SeChangeNotifyPrivilege	1856	msiexec.exe
Token: SeRemoteShutdownPrivilege	1856	msiexec.exe
Token: SeUndockPrivilege	1856	msiexec.exe
Token: SeSyncAgentPrivilege	1856	msiexec.exe
Token: SeEnableDelegationPrivilege	1856	msiexec.exe
Token: SeManageVolumePrivilege	1856	msiexec.exe
Token: SeImpersonatePrivilege	1856	msiexec.exe
Token: SeCreateGlobalPrivilege	1856	msiexec.exe
Token: SeBackupPrivilege	4512	vssvc.exe
Token: SeRestorePrivilege	4512	vssvc.exe
Token: SeAuditPrivilege	4512	vssvc.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeRestorePrivilege	3564	msiexec.exe
Token: SeTakeOwnershipPrivilege	3564	msiexec.exe
Token: SeDebugPrivilege	2248	taskkill.exe
Token: 33	2080	wlanext.exe
Token: SeIncBasePriorityPrivilege	2080	wlanext.exe
Token: 33	2080	wlanext.exe
Token: SeIncBasePriorityPrivilege	2080	wlanext.exe

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

msiexec.exeTelegram.exe

pid process

1856 msiexec.exe
1856 msiexec.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
Suspicious use of SendNotifyMessage 6 IoCs

Processes:

Telegram.exe

pid process

740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
740 Telegram.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

Mouxuycvty.exeMouseOne.exeSearchCefViewJLpih.exeSearchRun.exeSearchRunCall.exeTelegram.exe

pid process

4940 Mouxuycvty.exe
5032 MouseOne.exe
4364 SearchCefViewJLpih.exe
1388 SearchRun.exe
1776 SearchRunCall.exe
740 Telegram.exe

pid	process
1856	msiexec.exe
1856	msiexec.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe

pid	process
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe
740	Telegram.exe

pid	process
4940	Mouxuycvty.exe
5032	MouseOne.exe
4364	SearchCefViewJLpih.exe
1388	SearchRun.exe
1776	SearchRunCall.exe
740	Telegram.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

msiexec.exeMouxuycvty.exeMouseOne.exeNET.exeSearchCefViewJLpih.exeSearchRun.exeSearchRunCall.exewlanext.exe

description	pid	process	target process
PID 3564 wrote to memory of 2332	3564	msiexec.exe	MsiExec.exe
PID 3564 wrote to memory of 2332	3564	msiexec.exe	MsiExec.exe
PID 3564 wrote to memory of 2332	3564	msiexec.exe	MsiExec.exe
PID 3564 wrote to memory of 4940	3564	msiexec.exe	Mouxuycvty.exe
PID 3564 wrote to memory of 4940	3564	msiexec.exe	Mouxuycvty.exe
PID 3564 wrote to memory of 4940	3564	msiexec.exe	Mouxuycvty.exe
PID 4940 wrote to memory of 5032	4940	Mouxuycvty.exe	MouseOne.exe
PID 4940 wrote to memory of 5032	4940	Mouxuycvty.exe	MouseOne.exe
PID 4940 wrote to memory of 5032	4940	Mouxuycvty.exe	MouseOne.exe
PID 5032 wrote to memory of 2104	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 2104	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 2104	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 1976	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 1976	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 1976	5032	MouseOne.exe	sc.exe
PID 5032 wrote to memory of 2780	5032	MouseOne.exe	NET.exe
PID 5032 wrote to memory of 2780	5032	MouseOne.exe	NET.exe
PID 5032 wrote to memory of 2780	5032	MouseOne.exe	NET.exe
PID 2780 wrote to memory of 1932	2780	NET.exe	net1.exe
PID 2780 wrote to memory of 1932	2780	NET.exe	net1.exe
PID 2780 wrote to memory of 1932	2780	NET.exe	net1.exe
PID 3564 wrote to memory of 740	3564	msiexec.exe	Telegram.exe
PID 3564 wrote to memory of 740	3564	msiexec.exe	Telegram.exe
PID 4364 wrote to memory of 1388	4364	SearchCefViewJLpih.exe	SearchRun.exe
PID 4364 wrote to memory of 1388	4364	SearchCefViewJLpih.exe	SearchRun.exe
PID 4364 wrote to memory of 1388	4364	SearchCefViewJLpih.exe	SearchRun.exe
PID 1388 wrote to memory of 1776	1388	SearchRun.exe	SearchRunCall.exe
PID 1388 wrote to memory of 1776	1388	SearchRun.exe	SearchRunCall.exe
PID 1388 wrote to memory of 1776	1388	SearchRun.exe	SearchRunCall.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 1776 wrote to memory of 2080	1776	SearchRunCall.exe	wlanext.exe
PID 2080 wrote to memory of 2248	2080	wlanext.exe	taskkill.exe
PID 2080 wrote to memory of 2248	2080	wlanext.exe	taskkill.exe
PID 2080 wrote to memory of 2248	2080	wlanext.exe	taskkill.exe

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Tele-CN汉化.msi
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1856

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3564

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 7363F6C29CCA8C82671207B943F1FD77
2⤵
- Loads dropped DLL
PID:2332

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940

C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\sc.exe
sc create "XMouseUpdate" binPath= "C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewJLpih.exe" type= own type= interact start= auto displayname= "ÓÃÓÚÖ§³ÖWindowsÏµÍ³°²È«·À»¤Ïà¹Ø·þÎñ"
4⤵
- Launches sc.exe
PID:2104

C:\Windows\SysWOW64\NET.exe
NET start XMouseUpdate
4⤵
- Suspicious use of WriteProcessMemory
PID:2780

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start XMouseUpdate
5⤵
PID:1932

C:\Windows\SysWOW64\sc.exe
sc description XMouseUpdate "Microsoft°²È«·þÎñ"
4⤵
- Launches sc.exe
PID:1976

C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
"C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe"
2⤵
- Executes dropped EXE
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:740

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4512

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewJLpih.exe
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewJLpih.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4364

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
"C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388

C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
shhsjdhljslkdhj
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\wlanext.exe
wlanext.exe
4⤵
- Enumerates connected drives
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im ipaip2.exe
5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

New Service

T1050

Privilege Escalation

New Service

T1050

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\MouseRoaming\Mouse2.bin
Filesize
2.5MB

MD5
4c18d5d80cd1034619ef80dc1c75c19d

SHA1
f4363beef741062c7e3949594e0e40954edeac45

SHA256
33c17fc203e13c4c2ce980f108fd7e840d5ef5351b29948ce629ec572688cd8f

SHA512
391f592cd6b5a8e0e41d9e064ed7347ecbe69fa1623923387f22bdbf0d016950cb8791b1b7ee1d4cb6353803b0fa380e87fd59e3f13a348d71ebbe8dd0fa85a2

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseOne.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRun.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\SearchRunCall.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\WGLogin.olg
Filesize
403KB

MD5
0e96965cd96a51f301df104047fee3f3

SHA1
7655b536330d387a9947a48b720e6d02fa8dbb16

SHA256
776b4bb11a91f19f91c25f26b54275e8bf7174bc6082d0b32b95dbca9b1aab68

SHA512
df03d29af37e082f1f16d8f97b22b1ba85426582427ba1bee7b618e1cdb6e0d9e1031d2c7cdaa1a710017320de0e0b5c0c1bc0c6ae772001d8c41734432ea9d9

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.dll
Filesize
908KB

MD5
42e7a4eccf05af577af88e5bb52b60fb

SHA1
f93312f14039ba9abaa410e056c600a09a46cdf2

SHA256
cd72e87268d73bc433e8b3da28157a325b03d506d67015e86f31c1fffe8fbf41

SHA512
28ac6c3dc13defa10b2176d00c164af9561486adab7098fa5bddc2afe980de2477671f7523e15ad599f5fcdf0efb842d3f8fc9c9289745a1fe0dd0d56d0895e2

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.dll
Filesize
908KB

MD5
42e7a4eccf05af577af88e5bb52b60fb

SHA1
f93312f14039ba9abaa410e056c600a09a46cdf2

SHA256
cd72e87268d73bc433e8b3da28157a325b03d506d67015e86f31c1fffe8fbf41

SHA512
28ac6c3dc13defa10b2176d00c164af9561486adab7098fa5bddc2afe980de2477671f7523e15ad599f5fcdf0efb842d3f8fc9c9289745a1fe0dd0d56d0895e2

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\libcef.olg
Filesize
908KB

MD5
ba23edab2fa42d957f183dfc37e7b589

SHA1
e4abe02d6a7ccb4bcb998c7cc1fe6ea0c2ac6a7c

SHA256
7285b03a4d984d7da77b713fb27cd0a486fbfaaaafd91ba663e1c677ac98b511

SHA512
3c9747ff7a414653b02a87e3d93f5ef1ba599d9c87ee7b4b85942069e9ede90cde302ed170b117f53ceb05dd7e6a4f178202620cb12f9dacbc9c80bdb89b28a4

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\scrnshot.dll
Filesize
872KB

MD5
bf5299c399d3d734974eb83fa0d8b9ca

SHA1
aff35d159f032ce958b6ff0d2062307f2af87d15

SHA256
d50b2128dcd038a4aeb8174d9320d016e7e3b4cf670cae5354d26b8735ec9566

SHA512
0667b25b8633296628ae712f2d96ba771501a596264348d659937d9f04f0b72207a495086bc652c26aad6a842ab9addb67171f8ddf05a8c3da679f8557ebbfe7

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\Run\scrnshot.dll
Filesize
872KB

MD5
bf5299c399d3d734974eb83fa0d8b9ca

SHA1
aff35d159f032ce958b6ff0d2062307f2af87d15

SHA256
d50b2128dcd038a4aeb8174d9320d016e7e3b4cf670cae5354d26b8735ec9566

SHA512
0667b25b8633296628ae712f2d96ba771501a596264348d659937d9f04f0b72207a495086bc652c26aad6a842ab9addb67171f8ddf05a8c3da679f8557ebbfe7

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewJLpih.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\SearchCefViewJLpih.exe
Filesize
1.8MB

MD5
2511055c29667d45efff43a764c06638

SHA1
a93170ac639af888a27cd208bdaaebfa610bf139

SHA256
990778505aef963c4636e46393e49c6dfb635ae57ba32df243032102d56100f4

SHA512
efa23854f589f1af6abbb41f4f0ad120dcf19f710457a4c981ab135b00f79c5ef48fdc72e38cbadc2365b7892be5dc2f63790feb41f370405b435c1c1e879e1b

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\libcef.dll
Filesize
896KB

MD5
8492a87b7077f00d2b1c1946cf898169

SHA1
64b01f85f3cd70ca640fd5a22d680f3e8109e9bf

SHA256
1b2f0d00ed3f59d0077c6f1efcaef1eae1a700d92025e771d711132eae65b924

SHA512
f25f07b26ba518a3efa8ea6e7ff29e27dd0ee2aea81ae230d0400b3205a0b9ee1140a23a991b14ffe7c3b2313a2f87995ebc67ec7313a7c4e570c69bb3a52807

Download Submit
C:\Users\Admin\AppData\MouseRoaming\MouseRun2\libcef.dll
Filesize
896KB

MD5
8492a87b7077f00d2b1c1946cf898169

SHA1
64b01f85f3cd70ca640fd5a22d680f3e8109e9bf

SHA256
1b2f0d00ed3f59d0077c6f1efcaef1eae1a700d92025e771d711132eae65b924

SHA512
f25f07b26ba518a3efa8ea6e7ff29e27dd0ee2aea81ae230d0400b3205a0b9ee1140a23a991b14ffe7c3b2313a2f87995ebc67ec7313a7c4e570c69bb3a52807

Download Submit
C:\Users\Admin\AppData\MouseRoaming\NULL.bin
Filesize
50B

MD5
8a1a442fbe480b78ed1f5d466e881a5a

SHA1
e695a3aba418f2d1702556136ce269e4bc040680

SHA256
f00025df1b49caa55c60c2e094a979a3ee470b43287da7ab75a1c5e113d65b53

SHA512
63e6fd74de8d6a6740f26340696c10387d34f9dfb16270cc982210c8758e4466034fdc6a8cd3a7f0e2a2c79a28fb75d34215b48832832a83014de4e1202cb05e

Download Submit
C:\Users\Admin\AppData\MouseRoaming\S-erNa
Filesize
22B

MD5
b42340de313b7a6f8550a888f78d3108

SHA1
8c4502d98bf21c4cd03eacdb2fbb563e219851ce

SHA256
e66c813b6c0831b3db04cc822103e40fd3d3ef9da6a6dcd29865c31c9c87c61f

SHA512
6d25f4db931c2d7522f6740fb81eba7292a6fe86d2b27a9ce33ca6e5745588434fa11f5409b913ea490a994a7177c50633148b03bbdb348172790b11619ee9a0

Download Submit
C:\Users\Admin\AppData\MouseRoaming\libcef.dll
Filesize
952KB

MD5
616d8e703aecc00727ea27db365a3214

SHA1
e305b74fc8eac9cb6ef5350a46308b9670093e5f

SHA256
1696f7fc2303bd38d5977d7683d6b3a0e6f465f451418a024191900e170f7fbb

SHA512
3e96914ad4a9921a9ea7624e582d68397473e01b70215c8d2503fbb3e909a53149a46a21145f91d2463e52d388fbfe9b48282401ca1a2a56ff1839b69d0366ed

Download Submit
C:\Users\Admin\AppData\MouseRoaming\libcef.dll
Filesize
952KB

MD5
616d8e703aecc00727ea27db365a3214

SHA1
e305b74fc8eac9cb6ef5350a46308b9670093e5f

SHA256
1696f7fc2303bd38d5977d7683d6b3a0e6f465f451418a024191900e170f7fbb

SHA512
3e96914ad4a9921a9ea7624e582d68397473e01b70215c8d2503fbb3e909a53149a46a21145f91d2463e52d388fbfe9b48282401ca1a2a56ff1839b69d0366ed

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouse.bin
Filesize
3.7MB

MD5
6b6e1ebeaf2e60cc46fefb221c5eb047

SHA1
0a81b1df93c7a0bb7609662390a88b73fa3c4a36

SHA256
2db4482b3ac8061145212c2da97e36325394bdda39fa71847a0548a8255ba72e

SHA512
5e1a8a85443c7f0b2debf89b1e0bcd66528a08deb8f79ed4e8f876913ee4eb3e1eef803f3ea5e8a7dd02cea2b07352a64d955da90f2b3c60a40d7fb7f59dfa87

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\Mouxuycvty.exe
Filesize
183KB

MD5
7c8270f9d0106ffaf862790f527737ce

SHA1
beab49677deb4ef1188294ef13b91f0b571f83c0

SHA256
0b87153beed1a7ac3f743f5117eea3f6c594774d77e7e0e36d82d9cc41dd9c87

SHA512
64da62c8ae3783349f85e27389f5596e925f5485b02f4290e85fae38bbb4aab4ee593dcb44738050bb7cfa43c5df70b65bb93a3aafc498c15ca163e03896c605

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\NULL.bin
Filesize
50B

MD5
8a1a442fbe480b78ed1f5d466e881a5a

SHA1
e695a3aba418f2d1702556136ce269e4bc040680

SHA256
f00025df1b49caa55c60c2e094a979a3ee470b43287da7ab75a1c5e113d65b53

SHA512
63e6fd74de8d6a6740f26340696c10387d34f9dfb16270cc982210c8758e4466034fdc6a8cd3a7f0e2a2c79a28fb75d34215b48832832a83014de4e1202cb05e

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\scrnshot.dll
Filesize
936KB

MD5
a5d4d6ee291c0c7f7952c352f6ff9228

SHA1
c8365db1ef4abbe41d9f467da1a9491fa0c07f58

SHA256
0b264c0df87e57d1992e81b28a87a690fffca79544df5740f887cec4eb419f68

SHA512
502edd9e41e5806391ad51bab45a2bcc09b135184aa9f14030943769730ec10528bc962ec4694bc9bc916ed4ad3cf613fcf524801e2840e59eb550a8937e2a2c

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Mouxuycvty\scrnshot.dll
Filesize
936KB

MD5
a5d4d6ee291c0c7f7952c352f6ff9228

SHA1
c8365db1ef4abbe41d9f467da1a9491fa0c07f58

SHA256
0b264c0df87e57d1992e81b28a87a690fffca79544df5740f887cec4eb419f68

SHA512
502edd9e41e5806391ad51bab45a2bcc09b135184aa9f14030943769730ec10528bc962ec4694bc9bc916ed4ad3cf613fcf524801e2840e59eb550a8937e2a2c

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
Filesize
112.9MB

MD5
2cd62a83df66124097e1cd2a27ee8079

SHA1
110f1e0626accfe185281e9770092a71cf899290

SHA256
f9ab393bd93e347759732a9d91490c4b0d2d13714433a12042960ae70bf68ab7

SHA512
b74543c27ddff9262e01e96b823ea8f2194e21f71f0038b6201c1ab09a93a59b071ac60f2766af83b642cfd9b09cb44a571c6d8351a8cc17fe640b59ce5f0d54

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\Telegram.exe
Filesize
112.9MB

MD5
2cd62a83df66124097e1cd2a27ee8079

SHA1
110f1e0626accfe185281e9770092a71cf899290

SHA256
f9ab393bd93e347759732a9d91490c4b0d2d13714433a12042960ae70bf68ab7

SHA512
b74543c27ddff9262e01e96b823ea8f2194e21f71f0038b6201c1ab09a93a59b071ac60f2766af83b642cfd9b09cb44a571c6d8351a8cc17fe640b59ce5f0d54

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\754D72BC3CEF17BEs
Filesize
326KB

MD5
e3ec74015bd05491d9f49e2211a1189d

SHA1
d2158ae895969a37e8f4892aa06669793838242f

SHA256
35e625b7bf0c76ee76f4977a5fc8f589309d1671f70ca25bcaeb89abf6b4059c

SHA512
2ceca593b149c763eb840d8b26e95c8e6599070c1b1a5db746770b8292f6a5c2f79d287b03b33537c495283a015f45df0de239f3ff0e2030f74bc2ba27f894a0

Download Submit
C:\Users\Admin\AppData\Roaming\Telegram Desktop\tdata\settingss
Filesize
1KB

MD5
7fbb22b43dc8098ca8938695d75f4413

SHA1
d904ab079c3364040ba5571219d2bd65868f6d94

SHA256
efded9c235cbfcdde00a8e0d0c5857946cfc6bc49909aa88d2d0cc5a5904783e

SHA512
0a56f666e1c04092c047d80c6ba183d1eba2a81493043e20378d06f34e24917c84ce147daf346fa938992a9f27a1f1ffa10998519e155e842576b7a873089265

Download Submit
C:\Windows\Installer\MSIEE7B.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIEE7B.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF0BF.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF0BF.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF0FE.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF0FE.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF1BB.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
C:\Windows\Installer\MSIF1BB.tmp
Filesize
260KB

MD5
f0e3167159d38491b01a23bae32647ca

SHA1
6c385f0ceaaa591b40497ee522316a7987846ed1

SHA256
15fb0bda4e4644d5769b90108c87a469cc75f74113d03240236f272396aa49fb

SHA512
dce7ebec5f1a101805467536972f08505f7ebf0e01a276af1228ed6b2a0e424f17faf402fd3c0ae5e93cda95b8c78f1d5fe163dfe8d4ed2012da4491e1498b90

Download Submit
memory/740-165-0x0000000000000000-mapping.dmp

Download
memory/740-174-0x00000263B7230000-0x00000263B7240000-memory.dmp

Filesize
64KB

Download
memory/1388-167-0x0000000000000000-mapping.dmp

Download
memory/1776-175-0x0000000000000000-mapping.dmp

Download
memory/1932-159-0x0000000000000000-mapping.dmp

Download
memory/1976-157-0x0000000000000000-mapping.dmp

Download
memory/2080-186-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2080-192-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/2080-200-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/2080-197-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/2080-181-0x0000000000000000-mapping.dmp

Download
memory/2080-182-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2080-183-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2080-190-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/2080-188-0x0000000010000000-0x00000000101C6000-memory.dmp

Filesize
1.8MB

Download
memory/2080-193-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2080-194-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/2104-156-0x0000000000000000-mapping.dmp

Download
memory/2248-199-0x0000000000000000-mapping.dmp

Download
memory/2332-132-0x0000000000000000-mapping.dmp

Download
memory/2780-158-0x0000000000000000-mapping.dmp

Download
memory/4364-173-0x00000000776B0000-0x00000000776C0000-memory.dmp

Filesize
64KB

Download
memory/4364-164-0x00000000776B0000-0x00000000776C0000-memory.dmp

Filesize
64KB

Download
memory/4940-141-0x0000000000000000-mapping.dmp

Download
memory/5032-191-0x00000000776B0000-0x00000000776C0000-memory.dmp

Filesize
64KB

Download
memory/5032-148-0x0000000000000000-mapping.dmp

Download