hxxps://dldir1v6[.]qq[.]com/weixin/Universal/Windows/WeChatWin_4[.]1[.]9[.]exe

Analysis

user interaction
yes
max time kernel
408s
max time network
410s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dldir1v6.qq.com/weixin/Universal/Windows/WeChatWin_4.1.9.exe
Sample260424-e46mssez2v

Score

9^/10

defense_evasion discovery persistence privilege_escalation vmprotect

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Weixin.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	3924	chrome.exe

Modifies Windows Firewall 2 TTPs 2 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3636	netsh.exe
4144	netsh.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Weixin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WeChatWin_4.1.9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Control Panel\International\Geo\Nation	WeChatAppEx.exe

Executes dropped EXE 9 IoCs

pid	Process
2828	WeChatWin_4.1.9.exe
5468	Weixin.exe
2512	crashpad_handler.exe
4932	Weixin.exe
3096	crashpad_handler.exe
4652	WeChatAppEx.exe
844	WeChatAppEx.exe
4156	WeChatAppEx.exe
3464	WeChatAppEx.exe

Loads dropped DLL 64 IoCs

pid	Process
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
5468	Weixin.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
844	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
844	WeChatAppEx.exe
844	WeChatAppEx.exe
844	WeChatAppEx.exe
844	WeChatAppEx.exe
844	WeChatAppEx.exe
4156	WeChatAppEx.exe
4156	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00070000000244d2-445.dat	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Weixin = "\"C:\\Program Files\\Tencent\\Weixin\\Weixin.exe\" -autorun"	WeChatWin_4.1.9.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\libEGL.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\wcprobe.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\mmcronet.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\WeChat.lnk	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\roam_migration.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WeixinUpdate.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WetypeInstaller.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\Uninstall.exe	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\install.7z	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\backup_drivers.bin	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\ilink2.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\roam_migration.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\install.7z	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\roam_server.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\XEditor.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatOcr.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\backup_drivers.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\libEGL.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\libusb-1.0.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\shared_andromeda.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatUtility.bin	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\plugin_info.ini	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatOcr.bin	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\Weixin.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\VoipEngine.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WeixinExt.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\wxpublic.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\mmmojo_64.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\roam_server.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WetypeInstaller.exe	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\RadiumWMPF.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\ilink_wrapper.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\mmcronet.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\shared_andromeda.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\Weixin.exe	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\ConfSdk.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\wcprobe.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatUtility.bin	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WeixinExt.exe	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\wxpublic.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\libusb-1.0.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\owl.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\XEditor.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\plugin_info.ini	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\libGLESv2.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\XNet.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\Weixin.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatPlayer.bin	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WeixinUpdate.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\XNet.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\Weixin.exe	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\ConfSdk.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\ilink2.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\ilink_stream.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\ilink_wrapper.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\libGLESv2.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\mmmojo_64.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\VoipEngine.dll	WeChatWin_4.1.9.exe
File created	C:\Program Files\Tencent\Weixin\4.1.9.23\WeChatPlayer.bin	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\owl.dll	WeChatWin_4.1.9.exe
File opened for modification	C:\Program Files\Tencent\Weixin\4.1.9.23\RadiumWMPF.bin	WeChatWin_4.1.9.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WeChatWin_4.1.9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2060	SnippingTool.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3924	chrome.exe
4584	msedge.exe

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WeChatAppEx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WeChatAppEx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Weixin.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WeChatAppEx.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	Weixin.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	Weixin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Weixin.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214786566347052"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000092ce1aa27d91dc015c043db38791dc01ef92cd7fa3d3dc0114000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Pictures"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\weixin\shell	Weixin.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\xweixin\shell	Weixin.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\xweixin\shell\open\command	Weixin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\weixin	Weixin.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e8005398e082303024b98265d99428e115f0000	SnippingTool.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "4"	SnippingTool.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\weixin\shell\open\command\ = "C:\\Program Files\\Tencent\\Weixin\\Weixin.exe \"%1\""	Weixin.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	SnippingTool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\weixin\shell\open\command	Weixin.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	SnippingTool.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\xweixin\shell\open	Weixin.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "3"	SnippingTool.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5468	Weixin.exe
4932	Weixin.exe

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2828	WeChatWin_4.1.9.exe
2464	chrome.exe
2464	chrome.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4932	Weixin.exe
4652	WeChatAppEx.exe
4652	WeChatAppEx.exe
5400	chrome.exe
5400	chrome.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
3464	WeChatAppEx.exe
4932	Weixin.exe
4932	Weixin.exe
5468	Weixin.exe
5468	Weixin.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5468	Weixin.exe
2060	SnippingTool.exe
5768	chrome.exe
4932	Weixin.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
5972	msedge.exe
2464	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe
Token: SeShutdownPrivilege	2464	chrome.exe
Token: SeCreatePagefilePrivilege	2464	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe
2464	chrome.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2828	WeChatWin_4.1.9.exe
2060	SnippingTool.exe
464	chrome.exe
2060	SnippingTool.exe
5768	chrome.exe
3016	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 4060	2464	chrome.exe	85
PID 2464 wrote to memory of 2044	2464	chrome.exe	86
PID 2464 wrote to memory of 2044	2464	chrome.exe	86
PID 2464 wrote to memory of 3924	2464	chrome.exe	87
PID 2464 wrote to memory of 1868	2464	chrome.exe	88
PID 2464 wrote to memory of 1868	2464	chrome.exe	88
PID 2464 wrote to memory of 2444	2464	chrome.exe	89
PID 2464 wrote to memory of 2444	2464	chrome.exe	89
PID 2464 wrote to memory of 2312	2464	chrome.exe	90
PID 2464 wrote to memory of 2312	2464	chrome.exe	90
PID 2464 wrote to memory of 4392	2464	chrome.exe	92
PID 2464 wrote to memory of 4392	2464	chrome.exe	92
PID 2464 wrote to memory of 4104	2464	chrome.exe	93
PID 2464 wrote to memory of 3784	2464	chrome.exe	99
PID 2464 wrote to memory of 5952	2464	chrome.exe	100
PID 2464 wrote to memory of 2852	2464	chrome.exe	101
PID 2464 wrote to memory of 1124	2464	chrome.exe	104
PID 2828 wrote to memory of 5540	2828	WeChatWin_4.1.9.exe	111
PID 5540 wrote to memory of 3636	5540	cmd.exe	113
PID 2828 wrote to memory of 5720	2828	WeChatWin_4.1.9.exe	114
PID 5720 wrote to memory of 4144	5720	cmd.exe	116
PID 5468 wrote to memory of 2512	5468	Weixin.exe	120
PID 2828 wrote to memory of 4932	2828	WeChatWin_4.1.9.exe	121
PID 4932 wrote to memory of 3096	4932	Weixin.exe	122
PID 5468 wrote to memory of 4652	5468	Weixin.exe	123
PID 4652 wrote to memory of 844	4652	WeChatAppEx.exe	124
PID 4652 wrote to memory of 4156	4652	WeChatAppEx.exe	125
PID 4652 wrote to memory of 4156	4652	WeChatAppEx.exe	125
PID 2464 wrote to memory of 5400	2464	chrome.exe	126
PID 2464 wrote to memory of 1324	2464	chrome.exe	132
PID 2464 wrote to memory of 1324	2464	chrome.exe	132
PID 2464 wrote to memory of 2120	2464	chrome.exe	133
PID 2464 wrote to memory of 2120	2464	chrome.exe	133
PID 2464 wrote to memory of 5800	2464	chrome.exe	134
PID 2464 wrote to memory of 5800	2464	chrome.exe	134
PID 2464 wrote to memory of 464	2464	chrome.exe	135
PID 2464 wrote to memory of 3740	2464	chrome.exe	138
PID 2464 wrote to memory of 3740	2464	chrome.exe	138
PID 2464 wrote to memory of 5768	2464	chrome.exe	139
PID 2464 wrote to memory of 3804	2464	chrome.exe	141
PID 2464 wrote to memory of 3804	2464	chrome.exe	141
PID 2464 wrote to memory of 3016	2464	chrome.exe	142
PID 2464 wrote to memory of 4040	2464	chrome.exe	143
PID 2464 wrote to memory of 4040	2464	chrome.exe	143
PID 2464 wrote to memory of 3732	2464	chrome.exe	144
PID 2464 wrote to memory of 3732	2464	chrome.exe	144
PID 2464 wrote to memory of 3968	2464	chrome.exe	145
PID 2464 wrote to memory of 3968	2464	chrome.exe	145
PID 2464 wrote to memory of 1920	2464	chrome.exe	146
PID 2464 wrote to memory of 1920	2464	chrome.exe	146
PID 4652 wrote to memory of 3464	4652	WeChatAppEx.exe	147
PID 2464 wrote to memory of 5100	2464	chrome.exe	148
PID 2464 wrote to memory of 5100	2464	chrome.exe	148
PID 2464 wrote to memory of 5152	2464	chrome.exe	149
PID 2464 wrote to memory of 5152	2464	chrome.exe	149
PID 2464 wrote to memory of 1160	2464	chrome.exe	150
PID 2464 wrote to memory of 1160	2464	chrome.exe	150
PID 2464 wrote to memory of 3132	2464	chrome.exe	151
PID 2464 wrote to memory of 3132	2464	chrome.exe	151
PID 2464 wrote to memory of 1140	2464	chrome.exe	152
PID 2464 wrote to memory of 1140	2464	chrome.exe	152
PID 2464 wrote to memory of 1668	2464	chrome.exe	153
PID 2464 wrote to memory of 1668	2464	chrome.exe	153
PID 2464 wrote to memory of 5408	2464	chrome.exe	154

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dldir1v6.qq.com/weixin/Universal/Windows/WeChatWin_4.1.9.exe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffffeb9c728,0x7ffffeb9c734,0x7ffffeb9c740
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1744,i,17178222424989887059,11874381965242160115,262144 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1616,i,2866997231175033699,13779594987292012488,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2392,i,11870692702559329459,11379554516687249091,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,18160270566258411358,6296876888547285064,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,731637885463180759,15162582212508273377,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4320,i,1870899567462690669,16585183709495437577,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,8216708747724334034,10330739390671697266,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,3783938338704105131,7024437767893489501,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1144 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5976,i,15287885611604689169,12978593878742476551,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,8315600036805399443,15341250044808729783,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,11602287455031088347,7062448411577939656,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5760,i,1807734550502154591,11649867560373533310,262144 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=4348,i,9574415642724612816,10609642653322087038,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1052 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5892,i,8894170734934423764,12287140456436685677,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6040,i,9661957556313204219,8904334269907458541,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,17520909650111933714,4449780846752210280,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=728 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,15510630328571144991,11395320125600662402,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5928,i,13223477213176130441,6054403910709698983,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:5768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6240,i,14770059669347299334,16175664055948096072,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,11267258996659185759,3476286799851139227,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5924,i,14734465653169929628,10408985651269550265,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6260,i,15070647677469955218,12598895216476202945,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6244,i,8049992016304079014,6397983356473323734,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6248,i,552461822947392523,1148783796938248582,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6544,i,5236242275401082280,13535089514438511894,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6276,i,12050890193079849149,3980934543774106571,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=4728,i,10621975453586135634,17985289345869708421,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5852,i,3658563744315220743,7629216323948967210,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6716,i,5666220194998815090,12973619085115557830,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=6280,i,9534864200706611392,14301324896717513857,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1544 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6688,i,5484729556666449549,2746976756669254754,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=5796,i,12745933999703297259,4024880204344796443,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6960,i,12723758178522042477,10033860684707281786,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5832,i,15406640439584433074,8872552073607227715,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6656,i,14945938662237886810,3665370885380053783,524288 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:3024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6360,i,1120345883323078440,15715583237925112692,2097152 --field-trial-handle=2016,i,14110268251664042643,6180106331742614970,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6892 /prefetch:1
  2⤵
  PID:4828

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5752

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5388

C:\Users\Admin\Downloads\WeChatWin_4.1.9.exe
"C:\Users\Admin\Downloads\WeChatWin_4.1.9.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Windows\SysWOW64\cmd.exe
  /c netsh advfirewall firewall delete rule name="Weixin" program="C:\Program Files\Tencent\Weixin\Weixin.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5540
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall delete rule name="Weixin" program="C:\Program Files\Tencent\Weixin\Weixin.exe"
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3636
- C:\Windows\SysWOW64\cmd.exe
  /c netsh advfirewall firewall add rule name="Weixin" dir=in action=allow program="C:\Program Files\Tencent\Weixin\Weixin.exe" enable=yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5720
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall firewall add rule name="Weixin" dir=in action=allow program="C:\Program Files\Tencent\Weixin\Weixin.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:4144
- C:\Program Files\Tencent\Weixin\Weixin.exe
  "C:\Program Files\Tencent\Weixin\Weixin.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe
    "C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\Tencent\xwechat\crashinfo "--annotation=ext_info={\"app_call_name\":\"Weixin\",\"app_name\":\"Weixin\",\"app_path\":\"C:\\Program Files\\Tencent\\Weixin\\Weixin.exe\",\"build_ver\":\"9\",\"crash_notify\":\"1\",\"input_action\":2,\"main_thread_id\":\"4604\",\"major_ver\":\"4\",\"minor_ver\":\"1\",\"module_name\":\"xwechat_win\",\"modules_dir\":\"C:\\Program Files\\Tencent\\Weixin\\4.1.9.23\",\"patch_ver\":\"23\",\"product\":\"Weixin\",\"report_type\":\"9999\",\"restart_app_cmd\":\"\\\"C:\\Program Files\\Tencent\\Weixin\\Weixin.exe\\\"\",\"version\":\"4065597719\"}" --annotation=product=Weixin --initial-client-data=0x260,0x264,0x268,0x40,0x26c,0x7ff70bf70af0,0x7ff70bf70b00,0x7ff70bf70b10
    3⤵
    - Executes dropped EXE
    PID:3096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://filehelper.weixin.qq.com/?from=windows&type=recommend
    3⤵
    PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://filehelper.weixin.qq.com/?from=windows&type=recommend
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:5972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x244,0x7fffe09fc188,0x7fffe09fc194,0x7fffe09fc1a0
        5⤵
        
        PID:4680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,13325201579210779633,7026847312389394323,262144 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
        5⤵
        
        PID:216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,3110566061060224883,14144745090840995866,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4584
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1400,i,8439245204014268493,5528877451369096484,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
        5⤵
        
        PID:5896
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3560,i,5386833020547022105,6644798295030583580,2097152 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
        5⤵
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,5640443896852243548,8200217164059699738,2097152 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
        5⤵
        
        PID:1692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4504,i,5957117580079524378,3424081306104292097,2097152 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:1
        5⤵
        
        PID:2120
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4640,i,13224000955828137270,8878269964964366978,2097152 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:2
        5⤵
        
        PID:1004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,402155828414287393,15563124714630483528,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:8
        5⤵
        
        PID:5904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,855189597642653566,8230893674410567754,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
        5⤵
        
        PID:6412
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10400492814483281076,104988648632167076,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
        5⤵
        
        PID:6476
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,10212699677405926579,12882817822524687487,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
        5⤵
        
        PID:6484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13738938705712223187,1928156954144511158,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
        5⤵
        
        PID:6608
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13738938705712223187,1928156954144511158,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
        5⤵
        
        PID:6624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,8967895959539256459,6948002031145931910,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
        5⤵
        
        PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,3325681362680292706,7472434626205844901,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
        5⤵
        
        PID:1680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,4671428463520419478,9641052560862829543,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
        5⤵
        
        PID:640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,5513610952355233542,10250629113863200630,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
        5⤵
        
        PID:752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,13422747769875368665,9716502908890725556,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
        5⤵
        
        PID:7124
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,6335244835767406967,18039091123700619835,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
        5⤵
        
        PID:6652
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4748,i,8891561082276080739,7678502626433674054,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
        5⤵
        
        PID:6704
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,12835379799069865393,8251766273840323796,524288 --field-trial-handle=1968,i,6355708845471101833,16180146845749455158,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:8
        5⤵
        
        PID:6720

C:\Program Files\Tencent\Weixin\Weixin.exe
"C:\Program Files\Tencent\Weixin\Weixin.exe" -autorun
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe
  "C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe" --no-rate-limit --database=C:\Users\Admin\AppData\Roaming\Tencent\xwechat\crashinfo "--annotation=ext_info={\"app_call_name\":\"Weixin\",\"app_name\":\"Weixin\",\"app_path\":\"C:\\Program Files\\Tencent\\Weixin\\Weixin.exe\",\"build_ver\":\"9\",\"crash_notify\":\"1\",\"input_action\":2,\"main_thread_id\":\"1572\",\"major_ver\":\"4\",\"minor_ver\":\"1\",\"module_name\":\"xwechat_win\",\"modules_dir\":\"C:\\Program Files\\Tencent\\Weixin\\4.1.9.23\",\"patch_ver\":\"23\",\"product\":\"Weixin\",\"report_type\":\"9999\",\"restart_app_cmd\":\"\\\"C:\\Program Files\\Tencent\\Weixin\\Weixin.exe\\\" -autorun\",\"version\":\"4065597719\"}" --annotation=product=Weixin --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff70bf70af0,0x7ff70bf70b00,0x7ff70bf70b10
  2⤵
  - Executes dropped EXE
  PID:2512
- C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe
  "C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe" --log-level=2 --helper-handle-value=277782429 --lang=en --wechat-files-path="C:\Users\Admin\Documents\xwechat_files" --product-id=1002 --wechat-sub-user-agent="MicroMessenger/7.0.20.1781(0x6700143B) WindowsWechat(0x63090a13) UnifiedPCWindowsWechat(0xf2541917)" --web-translate --client_version=4065597719 --wmpf_root_dir="C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium" --enable-applet-v3 --wmpf-drm-plugin-path --instance-index=0 --wmpf-yyb-plugin-path --mojo-platform-channel-handle=2912
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe
    "C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --client_version=4065597719 --enable-crash-reporter --wmpf_root_dir="C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium" --instance-index=0 --product-id=1002 --disable-mojo-broker --field-trial-handle=2564,i,295539322367093291,4262851813057136471,262144 --enable-features=OverlayScrollbar,WinSystemLocationPermission,XWorker --disable-features=AudioServiceOutOfProcess,AutoupgradeMixedContent,BackForwardCache,DigitalGoodsApi,NotificationTriggers,PeriodicBackgroundSync,TFLiteLanguageDetectionEnabled,Vulkan,WebOTP --variations-seed-version --log-level=2 --mojo-platform-channel-handle=2548 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:844
- - C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe
    "C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe" --type=gpu-process --client_version=4065597719 --enable-crash-reporter --wmpf_root_dir="C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium" --instance-index=0 --product-id=1002 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --disable-mojo-broker --field-trial-handle=2548,i,295539322367093291,4262851813057136471,262144 --enable-features=OverlayScrollbar,WinSystemLocationPermission,XWorker --disable-features=AudioServiceOutOfProcess,AutoupgradeMixedContent,BackForwardCache,DigitalGoodsApi,NotificationTriggers,PeriodicBackgroundSync,TFLiteLanguageDetectionEnabled,Vulkan,WebOTP --variations-seed-version --log-level=2 --mojo-platform-channel-handle=2544 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:4156
- - C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe
    "C:\Users\Admin\AppData\Roaming\Tencent\xwechat\xplugin\plugins\RadiumWMPF\19749\extracted\runtime\WeChatAppEx.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --client_version=4065597719 --enable-crash-reporter --wmpf_root_dir="C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium" --instance-index=0 --product-id=1002 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --disable-mojo-broker --field-trial-handle=792,i,295539322367093291,4262851813057136471,262144 --enable-features=OverlayScrollbar,WinSystemLocationPermission,XWorker --disable-features=AudioServiceOutOfProcess,AutoupgradeMixedContent,BackForwardCache,DigitalGoodsApi,NotificationTriggers,PeriodicBackgroundSync,TFLiteLanguageDetectionEnabled,Vulkan,WebOTP --variations-seed-version --log-level=2 --mojo-platform-channel-handle=1868 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:3464

C:\Windows\system32\SnippingTool.exe
"C:\Windows\system32\SnippingTool.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

VoipEngine.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\VoipEngine.dll
Size 18.4MB
SHA256 7185197a8526a46110e167f602af6e97867b9044b1cec268b89741d8e690b036
MD5 eba9a5672f43b469b4c9c04e065264c8
SHA1 a9a2857b443622095ac66d64596188acb89870a0
SHA512 c16205c6b7f4b9d9ef745b7377e8ef506fae697c37dde8231f36ee61b9b33904d70ef6a834caa1f2ac7c3014f57e061dbad9823895232330b80be0fa1e3d47e8
SSDEEP 196608:fCskhv28DC5bCuZM2kAlFGIQ3tdAlOMHzVVf:tkhu95fj5GdAlOyzVh
TLSH
T19717AF9EE5D782D4F027C4F087AAB513FB68785D03940AE725C995702E63AC86B7BF01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XNet.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\XNet.dll
Size 7.0MB
SHA256 62900cafd2bda860e3c2b626be3fba9fbd78e7540e3a9aba60fe012e0090d69f
MD5 db1c039de0d07dda904f410485722265
SHA1 58469a7267ff75df2345cba75dc15f4197620094
SHA512 60f424616a06bee35d6d4711482fbbd8bcfce9963005de23cbc9d7e960c84f7c66841e07711341101ed95b7dd3f6b655ecdf44b489a46800860e618898ce4f09
SSDEEP 49152:Z1F6Ukn4dqNiesjB8+TYY9Y3ccsGNfzNe8ZvwdVX0TBVoAggkaHIUXeX06t9LA+L:c7P+3WtwuMVNs0ad0uA49C
TLSH
T1E9769E32B1E942D5D4BBD074C7076E67E772388A4238EB7F08B545521F2BB61A93E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashpad_handler.exe

Path C:\Program Files\Tencent\Weixin\4.1.9.23\crashpad_handler.exe
Size 2.1MB
SHA256 76353b92ffd16c20f796064a0cfd9b64026d3f5ba02632925f62e1b94350ec47
MD5 be9d6d58ef428964b9478e1ece18c637
SHA1 1c1ca3159214c7e226bd5ca538e28ada99c81305
SHA512 5a0a79eef9bb97df5fa397aaa8148e455e99915ece2657790fa7d62b481b8559eaf1cfddd8beedb2abf06643531b7526e0f82444e496c30676e6b28e35d2b0b8
SSDEEP 24576:NCvnXZkd3wP4aHHjnNIkG889X4asVrvcEvsjpSQeaEmbSQgJe9:NCvpkd3PIHjc9X4asVrvj0jAQMmL
TLSH
T1B3A55C03B16580DAE06AD9FA874A8131E5F07C990BB5B2CF1280B7551FB7BE41B3E764
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ilink2.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\ilink2.dll
Size 10.6MB
SHA256 0debc4c80e32ad0d2fffc352adf8c60c913cb34310b709b7aa33bd5f086e719b
MD5 c906f75f8c49305e023dee2c31383e5b
SHA1 b5460b7b08fb198256cb2982c06f98f53af0a106
SHA512 d6f8b0841700fb958193b4284aeefae42cadcdb9d0d47a099323b991005bd00a8aed088640f3fdf6337df03bb35434a60343e8a8111f48a33c36125d851915bb
SSDEEP 98304:nSl8SbDgfhwy/wjyKjmCdVFjXGI+MkLBP/B57tuFM4t/:K8iohwy/weKjmCbFj7kLBnBHu+4t/
TLSH
T11AB67D17629901A8E0BBC07CCE5B9A03E7B6345A03319FFB06A046AB1F57BE45E7D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ilink_stream.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\ilink_stream.dll
Size 1.2MB
SHA256 6d042cfe6107c04ac7b515069e06e073d55c1757c446dbbd2329cc3ad98d0185
MD5 922484a45c2ed71ae4a38836ad5718ec
SHA1 23348c0abecb229de08586311fa554300606692f
SHA512 e7253492b9275a9099d5157fe6ce766b1f83d790045b024c4ea71baad5b22e677d8fafc9ede761d6adcf29b018a429d9c281e5b808f0e36e5320e244ac59db0a
SSDEEP 12288:HvfzbnO+vp+X2RmJj/QvOHLolJiEnB5V2v6vcD:HDbO+vpm2Rij/xHL+iEni6vcD
TLSH
T1B2454C6A325A01E5C13AD2BDCADB4B06EAB2785307519FCB02D1CB672F9BBE4457D700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ilink_wrapper.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\ilink_wrapper.dll
Size 233KB
SHA256 bf69bc93a3e587be35db9db028f24dda193e98a8764f5a4df3afcd2f8940e24d
MD5 e531c97774185aa889dd95ef1454f868
SHA1 6a87076ccfb4f6dfc4d313654b02446d33df4e7b
SHA512 a0148cf3dc8735d1c7af13babf0c077b66fcc69dc805807dc6f15bea6d43f0313094b6b3a8e35a6f2a09d0048b5c55b91be1ff5853e5c67c0dc21b52801f1b6e
SSDEEP 3072:nPqCWYQegLVpbCJoDlBvtNEbyF08LjQ2xV7qRiX29nA7MyAYv9WWTid3aPsmDTdz:nXWYQbNEbF8Lj3xRqG2qMcWWk3axDx7n
TLSH
T1BC346C5B72A504A5CD6BA278D9474A02F371B8510711EBDF03E0833E9F6B3D4897EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libEGL.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\libEGL.dll
Size 187KB
SHA256 13a6edef7a8411bcdaf8636d65bfab32b556a51b6e80951bcf0e6840c6b45e4f
MD5 93b4f295cdfda9d00210c7e3dd994878
SHA1 65e82e49bc1d1dcbfeea3a1f118c145e9bc4dcce
SHA512 fbc8e42a13e23d4e4672f308ac94584b97a22af61a8986b7ceb41ed98f204579264efb1f6eb14fcf339f243edd3aca46abc6dadc3bb39d97fe09edc01b34f1c5
SSDEEP 3072:OIw+zurYDkQh0xdRokJUeSEseCZ75LSZxpPEKSIbMhjf:TzurYDFyxdRomno1ZVsxcIbMhL
TLSH
T1E0147D26B2E4017AEC678274CD530A42EAB3B8514760A7CF13A483369F6F3D4A73D765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libGLESv2.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\libGLESv2.dll
Size 5.1MB
SHA256 c4df8e229b22129942070b5b3c50aaa5f513c1ca651760991fcdb9bdaedc70cf
MD5 39e3479fe96187e676ebfd5a42997a30
SHA1 eeb20091c7e4dc6f56f2d021991b8438adb76fa7
SHA512 734dfbd51ca89a9a8a0a1989755180e4482bfdca3bf74a6f40dd83b1ae60580b9ad00fcb331e2454b744c550aba54f21154f12a213d336b860fa7cc32583356f
SSDEEP 49152:MI0wyhurMR7BZ5KU2yNzuFZX5qevH1GIalYdlCJmwLcFFOJ+bqGTDJk1m5TZTDnU:U76ZGIrqmwLk/RGKTLrSn0PK
TLSH
T135467E03F25250EEC85AC139575BA223F631B89907207BDF279897351F62BE06B7E760
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmcronet.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\mmcronet.dll
Size 7.6MB
SHA256 b756267c3758b436659f9c04887306c1ab8334c0fde1382536c2eafdd9089af3
MD5 3745f068f8efee46f7192c679ec5601e
SHA1 63775bbc36f48f9852cd6e5978313ff97eb2d17d
SHA512 12ad80d506963d0f11f7ef6187d2dfa7e61a90840a83b735b5e362bc257a58ae32efdcd275bd0f5e834cbfdd1cb7010cf6d4d2b25c721a4d485831b4afbda18a
SSDEEP 98304:k2fRmAzJEAynmp2oW3o2740t7gWCBWJDJqTT7fFoi/9so:9mQ1vO740lgWVoKiO
TLSH
T143863913F2A650E9D05DC1B987079232FA72BC890B35B5EF06507B252E77BE0A739B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mmmojo_64.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\mmmojo_64.dll
Size 2.4MB
SHA256 5e8b77a0c7c151b7f8c4e847de9f873de5da4f0e14ed03718bf68daa9b01d106
MD5 edf4d2933f49005fd1de025857b5ada6
SHA1 958ce1746a0a6787ebcd912f89adecccd30557e2
SHA512 bb450f3e6f60219de1ef344b0cb852f3a82f1974a2fc5c94b7b1c28b8e47849f3399b710b0fd8d099ab922330295283092b5d3c22d3f7d74cc4bf2709d7478a7
SSDEEP 49152:f7+Cfzi8lBP9LUrm9yw/8luUG04yHVmZIQRwqj+jzs8Xw1mq1MX:jd7RSbWhqyRw1EsqC
TLSH
T1ECC56A13F29901E8D059C1798B4B8632EAB2BC850B35B6DF069077592F7BFE46B39710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

owl.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\owl.dll
Size 1.5MB
SHA256 8917119997972e20428585f3876460df03548e3619878476c6dbab55cd41ae9e
MD5 751780a055c7113b22aad0841c3d7d20
SHA1 2bf0c270bf7a1289d47fdd64228e28c672a23104
SHA512 bfee0f2622bf0eaeeafa0c58379978cbe41e55c8be78f53c3756c8cb561015f7fd58eb3a86a8597f78c815a9208b19fc69ad61bee7ee186568667078db7a5a22
SSDEEP 24576:O6Qu61gv/a0GCy0S+NwWbhpQpZI2ORxzFw6OgFaizG/1BbJ7yDE8gbL:O6sCv/a0aLwBwbORxzFw6DjzG/fJ7yHg
TLSH
T175657C16727A01E6C1BAF2BCC98B4D12E37178011B25AFDF42D292660FA77D526BF710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin_info.ini

Path C:\Program Files\Tencent\Weixin\4.1.9.23\plugin_info.ini
Size 118B
SHA256 b813fec5eb7a9fa34959bda0f779b1d6433b02ea56ed93a637ca5f20738ae0a6
MD5 ee58f7e387b9609b28247f5f03957980
SHA1 c697731cc82b80bfd27c88dd97bf3fb1a4393ae8
SHA512 f51fa3dddbbd9f51e9297e4969acd6710e1fa0f75e07e0b5fd035d6006efb8f4a0c047bad50f811f9ae6bc321fd554b1e52e6f3c3359463c09b4aceb273050ec
TLSH
T181B092320B0802911886270B6909E393253CDF694BE2A872746012660AA53BE1F234AC
MD5 SHA1 SHA512 TLSH

Submit Download

shared_andromeda.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\shared_andromeda.dll
Size 6.2MB
SHA256 af2ab0da8b0f50d28209581eaf2b44fb7df82ef70929f2f8222405d4fc5791ea
MD5 967fcb9a9af217914ed3b8060acde385
SHA1 c64e304d12347b59fc022638c1f55f9e68d9b01d
SHA512 9b362d72cc79e6e96b683e209ec17ba36bc7374265a9a65fa83bf5064eb0b9d564648d81ba3d0ab0ed77b1e7739b952470391c3d045350fd974b07a7412cecbd
SSDEEP 98304:PtiNQCu4QsizeAsmK8e9HtUcuLUgsGyBXMQ:ViGCu4QsizeAi8KHKcuIVGiXB
TLSH
T100668D5B72B411BAE0EBD178DA479907EBF6784A0371974F06A103AB2F533715E2E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wcprobe.dll

Path C:\Program Files\Tencent\Weixin\4.1.9.23\wcprobe.dll
Size 7.0MB
SHA256 aec8531a0ea60dd9b3584e077d94b4b953f4aeb87fdb3dfabc5a29e124ad9739
MD5 fc4b63e5415e1604c94e2d76de2cc8cc
SHA1 7b4873b6109be72ee2ba379c892d3230250d289e
SHA512 bf17056c3acebd292c37ac7bb2619d0c74b0a510d2c5970c8db21b71f78cf20c64fdb531587823a3ad8df56d3a9d53750e31f62294d007ac0d3512746e45422b
SSDEEP 98304:r+h1v3Ftrnnt0cfedu1l/OpuFWmilcyJYVLDtupQ/tjHoV25vxFa:o1Lnt0cfe0HTWmiKyJ6F/tsVSvx
TLSH
T19276AECF25AA0279D89B8034C65E6EB5F7B678341FD0E1EF3DD080A42F468D1897A752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Weixin.exe

Path C:\Program Files\Tencent\Weixin\Weixin.exe
Size 3.0MB
SHA256 d265b238896719e1f00d3d777ae29029a72dc825c65f2158ea0c46d8520b0368
MD5 150b77b191e96b45263a8c46950280be
SHA1 f408c79ce4ed54d8ec5f8d9209cebcc705b7b129
SHA512 eaffbbc77554cbbab2ccdb3a550faf0973ac6cf3ae44a679448ca05c1b1eb4192aaa2d73e53108d72eb0d68e24eebe0dbeba844cfaf5c243107f047d8cdae260
SSDEEP 49152:hdPyDNXkVwASOiGtlqIlIU6inE8sbhw6MQsWE+90aC1ecTPGuxLldPsesz8/H:DPKN+i+K9FcTPG+B6eszK
TLSH
T190E58C16B25400FDE8B6C07485464033E6B1BC9A6BB0ABEB02A5F6791F77AF45F39704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 48c95640b2a66e214f44f69f324028887786296499e40891fbff6b1e7e0077fa
MD5 290c07642735fcd7af41c835dd97db85
SHA1 e659dd85b656f2ced78bb7c7a91197e1fead5422
SHA512 a684aee37edc36ab637dafd2814fd52cc88acc5afe24fe8945b3f78d2ba26e112b27b67f6f448bd5652f2167945194d771f73081424d0eaf1ca9ac280fbc3879
TLSH
T174E02BB6D821D83B09FD175C60510746E700231B2BC0454F3A3DC34C8FB0676098685D
MD5 SHA1 SHA512 TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000007
Size 66KB
SHA256 398d2b08a7b49d285fe53ee0339e49113c125ee67c4a6fe51de27bcf138a2337
MD5 44334eab6971cbf5bda184b100196d0b
SHA1 5cb9b2a90f18ee997115f15666b75bc8ff4d054a
SHA512 fa7e3b85c0df77557d2efd5dc6336c7ff481e59d21c59b4412910c1d96e0515211fa04e8a8a64624897664f922c7792458dca81cc3886b75d5545490c1377cfd
SSDEEP 1536:oLz/FOUDvzeagJ1o+gH88rKWfSvawAzTmmQYku8q7z+6GqK97zln:oPFO2qagIH9tKvaw8mJYyq5Lg7l
TLSH
T15263026F4083DD104A7B0DF89927BC256687437A896E1773CC0BA0F97D29418AE94E9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002a

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a
Size 361KB
SHA256 02ff49f4431a46d64078b37db37186bd2f8c65655c9a81086ff174ead4486a18
MD5 10f1c35cb246fe221073a913340b48a8
SHA1 8101001026872a40a3653a4ece0da291b90458a5
SHA512 00031ac8af944b437463ef2027fa381873b6e08f68945248e58007a4ef7a5cec37adff6d14f67fcf7de2f5c85ffd1e723c1f1652d6a014eee66f84bdcaad2a6b
SSDEEP 6144:0OJ1vV2jDLDukAPWOlTbj19gCY/tqglNixzN4LtBDRPqyQK6+fWAyU+8tWncBl5y:0OJv2PLKkAPWATbj1ah/cgnAN4LtBDR8
TLSH
T14974236687ED80BD68F6890D1BCC7FA768CF928FF46EC8D9428E5185C408F7921B7611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 9a3e2a9689344962c067d0c3b024adcedfb6cb47ff14f8cac0e473d23e55228d
MD5 48537d15f3c74ff1c93711915491a387
SHA1 c368c06c24b9b53214e0fa672940f94b337d71a4
SHA512 1f7370eaac9d370264d09b21bfb36df12e3b541e192910091449e8e193a8f3837d05f8f67d5112e5f40979103ebf182bbbaedd8004245ab61fec7178ad65f010
TLSH
T1E111040BD6D1FBE0DFBC17B19C1A090E6AF41D5BC1A3428581D7E07A0792B986C87331
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 1d6f93783086264ae2bafeb8d51ec7cab3956d5029151c5f6cf3de2079a3283c
MD5 338d35c76dbf9e3e840761885f0d0d2b
SHA1 4790c6b0c92fbf99045bb828719e691996264b62
SHA512 a492dc64cb636e977200d4b1e02739cfeb02e9cb24ad4de402351f2a5abb91e45e7cf4c26190d269710f43e85f6be6f7392d5041e526402b89887fb7e20eb580
TLSH
T15821270BC1A2F7E0EFBC17B19C5A0D1F2AF45D9B81A3468581D6D57A0351B98AC87731
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 63a32086be6def7e00f85940605925b0324c72f36171d8eff3307ab74e2fa205
MD5 20e978aa60b868ef85f0294bcef365b6
SHA1 0c9e250f43948e3c54466c684d12d986f88d296a
SHA512 5880315c83421adeb0002ffe4f10093f027d9d75ef7f001df1a49de237283b9092a9b8cab61c86ff3d56676a9a6b1ae645fc6c53843a015b669ed946683b68fa
TLSH
T16851761BA5D0E7F0FFBD06708BC66E0EF6B0594692438F4A40E5907D0392BE4999773A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 9da2de9b29504535136d8c24e23e27353cdee1d134c22dd7c90f60db2d238fa9
MD5 27d3ecf1f71f5d169ca37fdcb2fe2200
SHA1 702a2fb879ac72603b3d2429cb55e1bde6a2df80
SHA512 3c62342529002edb72f76651da41e187ddeae5da069ccf1c5f26c1b8c762bc39ca2b7890e43ea35fd28ba3c4c00fdae81378ee9318ab0604dc30edae8253d9d2
SSDEEP 384:DBjT1yXwxAiJsJnJmZG4Zz72kZbILpvaIaeqsZolO5gamdfUNLmoKYAEY2Y4oYCh:IlXoEg
TLSH
T15D7290F7C3D8862DC41256F4AB29BE1BCE1D092453283C6A89E4EF4B93E1472D25564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 afa2cae8efad46a24027f3cedcace71598d8df537b6139c66fda5f0b712e07dd
MD5 d743a798a28982420ec5a0c38fc914c6
SHA1 c142402e9a2ec36a3ba051e0b803158b274ca4b1
SHA512 ff9ef8bc6b46e15cd1b4912abe8f87d66a6d18486cbdaa9e17eda758992dbc2fdb87f43021f23fa00b06b44543a5e6a6608ce1d8926d7bc9bf02841614664445
TLSH
T15B4189F793B4897E860196E4EA15AE2FCE6D0524031C7CA688D4AF1B53F2972D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 0dfd61196acc8bf24e4a207a72fdb79e8685065d180a06050113a8cc915ecfb6
MD5 9f17eba553caffe8fc59194e3f531ed7
SHA1 fe7b1b85eb4257f94d5a9cb0cddb0b7d9d19ffaa
SHA512 5ba17abab0782a30e2da6fbae1c3e26c0900a2b4e814cc25e58d6fe24d56156afb2308bfbad7034e6b00231b0f9f50a08511eeca3310ad77100cc4178225e1c9
SSDEEP 192:DBjT1yXwxAiRaIaeqiECODoQ+jzkn5318NP5:DBjT1yXwxAiRaIaeqiECODoQ+jzkn5le
TLSH
T18BE1BCF7C3D8C62DC95256F4AB25AE1ECE2D0A18431C3C66C8D8AF1B93E2871D21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e44dfd0ed92e92d60cbfa497e78bf5c78d6e410d71e311be731b31bd63e50033
MD5 9626868924b2412320878cf75c5d863c
SHA1 db9c938d7c7f7ef2f0fd8588366ae282a4df7cd7
SHA512 62432cc868eeabacf636333b3e2e556c44e66986efa41f6b3caf8e972fd1e635b115025570c1f0b32b8bea32650cd21ec259a68b663eeec856b64fdebe477e7e
SSDEEP 192:DBjT1yXwxAiJsJnJmZOaIaeqiECODoQFzkn5SmaPOvlfPMNPTuNoKYAE/K42g:DBjT1yXwxAiJsJnJmZOaIaeqiECODoQz
TLSH
T1CA32AEF7C3D8C62DC91156F4AB25AE1FCE2D0A14432C3C6AC9D8AF4B93E2871D25564E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fa8c29cf59290ff44409cb89321224a2b1dc37dc0dd9ea17a3fdf8cc48449cb7
MD5 5974aa1a9c4165671078596f5bb49a17
SHA1 9f558ec33d22907a796e2cc23b304374743e4406
SHA512 946730ce281e06a180b0b8f90875f2d7fa93d798080c05f0547c0adfac6da604b9734675476aca0efe38626f09921a230b32780bd42061a8a3462c085c309524
TLSH
T1C441ABF793B4997E861192F4EA15AE2FCE6D0524031C7CA689D4AF1B43F2972D20178F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 038d0a84a464647c830db4f3584ab67f19f734530643fa80770254c54f4cb319
MD5 a16bf3bcac1f2356826ff325f33bc729
SHA1 78feb9449ebae73f2fa6f2576d546c0716b9f7e4
SHA512 7076f31c4bd6624ad1f5e9fb27f4fbdd1ddf24138f849b823f23da9fc1dac8fe4f975e208e38fcec6f98c80c03e2989db07e04da4dd3feb059d0ff8eeca5c131
SSDEEP 192:zRlgQoRzrQDfKv7CMTDPRpXgpt+rv93Hsb+WNTedi/K2u2I/+jwefbeGkq2draEH:zRl/7Gx3X1xwV2NBejkq2daFE
TLSH
T11662E86FA8206A3B5DFAC219F911BB1BE7F1102161C52D88EAFCCA2C11E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 fd40615f43faca325decfa4f2ae6ddd24618f08cd9ddb4335152513028c583f9
MD5 a261fe4131c222d120db73fbeef1ee71
SHA1 7ce6504e466ad607500c9297eafa791dcde21231
SHA512 c1366babbe23e0d0339e8c893ed6b0d9c4269d5c4b93ec7af9c089142e80e117de3d95d7766e0a687765af519a42f0987f2e4f12527abe9d4c207fd23d2400d3
SSDEEP 192:sRlgloRzrQD8Cv7CMpAPRp2u93Hsb+WNni4P1beGkq2drazQFVyIsnAUge:sRlOYOxUXZxw5P1kq2daUe
TLSH
T14B42B42EAD24793B5CEAC32AFA217B57D7F5202171851D88EAFCCA2C15E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c4385997cb40e07a6cd1339da560b4b8d34f36d328aa4b624a8e46ebe1de4fd0
MD5 c9c7d30cd357b64481e5ae850ee4ee31
SHA1 a3b1cdf769925c5f40b8dcd53bd1180c6c74e812
SHA512 c405c6499b49e6f52f3c23e8ca1170df293c16661b9c574b142f21dd632092be87d17e8df43d66f298e284c16607f96e865b2ea347652895a9f67d4d61009b7b
SSDEEP 192:ERlgQoRzrQD8Sv7CMpDPRpXu93Hsb+WNnRv05beGkq2draDQFVyIsnAUgE:ERl/Y+x9X+xwp0hkq2dakE
TLSH
T1BA52D72EAD14693B5CEAC319FA117B57E7F5202171D52E88EAFCCA2C11E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 b216f047487596d57e43a4af157dfb09a241fa5034b3b04fef637fff54d2b918
MD5 1c1a8d7a30d3ce8c27c12576ff799f68
SHA1 263e1e4a3c2319c633460709abe578be144613df
SHA512 0f8b79fa464f42e902e281380560ef663dee7c56d1723735dedd3d9d486da873173a4ffeec9b79c96f9e0636ee0c19b3c4524513ab1aee78a01764c97729272b
SSDEEP 192:ERlgQoRzrQD8iv7CMpDPRpXgpt+W93Hsb+WNTe33A2u2ebeGkq2draEQFVyIsnAI:ERl/Yux9XMxw+o2gkq2daFE
TLSH
T11E52E96FA9206A3B5DE6C319F9117B5BE7F4202161D52D88EAFCCA2C11E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8360e862133c13151517e3ef6e704bebdefcc1236c976299e8b625480efd29a3
MD5 d52d48edbaaa757e876289b7f90ff11b
SHA1 f1d91e2e1cdcdaba1bdfca3914c5b90a8db2ecda
SHA512 6f95732099404825a50bb4739a75ce0cde4df425ed55fc95be910dd88634d15bf206597d677d30764ab8177f63dddcad82a5ee8f9a7c7103b42ca805b578c371
SSDEEP 192:sRlgQoRzrQD8Sv7CMpAPRp2u93Hsb+WNni4PebeGkq2dra1QFVyIsnAUgE:sRl/Y+xUXZxw5Pgkq2daOE
TLSH
T16942A52EAD14793B5CEAC31AFA217B57E7F5202161C51E88EAFCCA2C11E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 1f2e34c3c2cf988f3826e0f26b0ce5a012fdbeda229c22d9fd857e6337bb218d
MD5 5ad315ec2e0ff495bc27119b9ada3382
SHA1 3ee740fe93f485b4b84568d098bb56f7f7422d53
SHA512 27c219600abc8771c103e1910def8e3744448856f62889d1bd84d0b93485248be1435af4ee00cb48cdd0cde8290745a5ae3adce3598875912de22223ff2ff878
SSDEEP 192:ERlgQoRzrQD5Mv7CMpDPRpXgpt+NH93Hsb+WNTe33A2u2I/+Lj2gbeGkq2draEQw:ERl/VYx9XLxw+oNi2mkq2daFE
TLSH
T11262E86FA8206A3B5DEAC319F911B75BE7F5102161D52D88EAFCCE2C11E76CD2227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 6a23e08e13e87e824ecf25f0917a109e6f19a530d80c14463b8af97524ec8557
MD5 db38535cfea3effdc32a9a1abe70881e
SHA1 f91332c1144421054a00865b143abcb8e346cefe
SHA512 3d81f18eefff0969fd4994e0d6dedcce2802ba868882d28b4445563cc5127d164191f1485747ccc06162462d5cc911061d355ab07419cd3dd202d38aa92d3318
SSDEEP 192:ERlgQoRzrQD5Kv7CMpDPRpXgpt+Nv93Hsb+WNTe33A2u2I/+Lj2gbeGkq2draEQw:ERl/VGx9XLxw+oNi2mkq2daFE
TLSH
T1EC62E86FA8206A3B5DEAC319F911B75BE7F5102161C52D88EAFCCE2C11E76CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 b1a0a6303a4e44c23228f362b777c0398f55d417c40ec868a8a74cee4bdbfcd6
MD5 7ae0eebb4c8c3fa5fe7b33f41eb5811d
SHA1 9a8750628342179aa9a72806538ec93ee5cbfc53
SHA512 e8e15b04044bab89173f063a35990eb30654428ae33da22a670df7db0fbce8d0a7513d828663c5fd28878d6bdb5002b364dd8dbc720e9b9c810c5b5f22db0563
SSDEEP 192:Y3RlgQoRzrQDyKv7CMnDPRpXgpt+rv93Hsb+WNTQ/NSN2u2I/+jweNbeGkq2dray:Y3Rl/WGx7X1xwFxNBeNkq2daFE
TLSH
T1B662D86FA8206A3B4DF6C219F911B75BE7F5202161C52D88EBFCCA2C11E76CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 d38d7ad63a8b423350a7b9da82a04f2834c43b39614e1ae0bc0b451812aefd4a
MD5 0df9f02df70d61c11574ea3c078e9b40
SHA1 ccb9cdacf08eecca1f905cf91f2d83b5a425acd7
SHA512 c7c5dad2390db9b5fa51da0f1712d8a2c65b1ce90676c2cc4ed18a79d0a41adcba88889bdc3678d1339ec876b706aa3412c198cb94eea34f7a004cfe0867d0b3
SSDEEP 192:Y3RlgQoRzrQDPKv7CMnDPRpXsdpt+rtM93Hsb+WNTQ/NSN2u2I/+jws5m2FbeGkR:Y3Rl/bGx7XcxwFxNBn2Fkq2daFE
TLSH
T19262D86FA8206A7B5DF6C229F911B75BE7F1202161C51D88EBFCCA2C11E76CD2227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 59562939be82925c114be06814054e46c3a8c7f8e93bfb05423921396507a723
MD5 19b3768cba9f0b0ba2f760b8e1fd642f
SHA1 f766a1dd0b41c4d7261485e8e9305da550e22f6a
SHA512 07eb03270ab2e9fd2ea373062068acae762ad80936db19c52a23f0971a910be99414cca76d2045eaddfd1a2ad3a74c36ffd83f8718200df87808efc7ca4f8a62
SSDEEP 192:ERlgQoRzrQD54v7CMpDPRpXgpt+NH93Hsb+WNTe33A2u2I/+Lj2gbeGkq2draEQw:ERl/Vkx9XLxw+oNi2mkq2daFE
TLSH
T1B062E86FA8206A3B5DEAC219F911B75BE7F1102161C52D88EAFCCE2C11E76CD2227413
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 c23cd1370b02365602c21de5293fcbb01ce5b22dd107b8dd4dce857c4d5823b5
MD5 4d70399ee5155f2f1af4475053700acd
SHA1 734093e8d6dba79c844d524bea03417a60eedea5
SHA512 185a76970d0fcc438d578c0a0ab812513cdc2f29515ce24949d5e4597039957ffbcb057f31ccd46ed25882b29e5ebba43247192f8b7c2050aacb1d32af24e5b5
SSDEEP 192:sRlgQoRzrQD8sv7CMpAPRp2u93Hsb+WNni4PebeGkq2dra1QFVyIsnAUgE:sRl/Y4xUXZxw5Pgkq2daOE
TLSH
T13B42B52EAD14793B5CEAC31AFA217B57E7F5202161C51E88EAFCCA2C11E75CD2227017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 9c430f8c17feb865c008f25efcb04058f5ca91ec3e589c4f1ad8c3f157cbd990
MD5 d8cfe36a6891342c51bc518f22217e71
SHA1 73290bff0114201260216b0cb931cd9bda0228c8
SHA512 7e9778e0fd6323fceb05d3cc91303d1d284a486f525d995ef288db3363d58c76ff756e8e5e9add87e5a95e7ffd83adb3cf949ed5b7444a047d33f0fd1fa9184a
SSDEEP 384:AmjUj7KxkXqKf/pUZNCgVLH2Hfgsl5x7pLuLcifuvXODUf+ErU3xeHGHHe7omBcw:AGUj7KxkXqKf/pUZNCgVLH2Hfgsfx7pH
TLSH
T15772EA677C4C9D3B0F94C68CD816BF4FADB6024B55ED886443FA982903D5ACB110A2F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 35f0e90441725716332e59994d2310258188a650b933335cbf071000cc6a5b9e
MD5 06006d2f0cbb672d29ec4ac35f7cd1d3
SHA1 1b003a390e23be96a342cd558509922726216498
SHA512 edc0c5a49d4e118e7fa6f4100838c70c17b04a804e77dc41e5d158d6a292b26e7a9c6f8e8d3a94c0831d83b4b5737f30daebd7e10949c935ef79a58bf4e02e1e
TLSH
T11BB012508405DD41C40302F4138604883154DF108709130153E47971982B1E0C015150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 a2c279663e53bf991d2e2e1cb5e5f0f8663e71b37435cf08ea1d92e394df5136
MD5 91ad3c35a0cf11580dc629289c6ab4be
SHA1 0046de6bd782f59f1eefda65926584b7113034af
SHA512 1cff4c24771b3cb5f9409f1ecbcc646b79fc5f8df96815a6dc38a009e74b652c0a5cc5747073f699d7929f5f735082429c860903091bfbc8732fb10317091cf0
TLSH
T19DC01251C209F6B5C44603F419DB899C72DC9F2DDF15134DA3E06D3AAD3521142752AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586cfd.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586cfd.TMP
Size 96B
SHA256 2a30b699b519a35ad0cfdf7f786d40eebed4bc8c1b94a02d61108d59e5fec500
MD5 836b8d8ce062025f656eeffa40c2f127
SHA1 fd31120a909cf5372114a4572a3b53634a02f49b
SHA512 4554dda9a60dbfc7036bc1333abafb345cb26ef52494987bcd18a562c1e35a6df618f8eccb570f79fdf8cfb04c15bd391513e71b2ecbeb4735e48abc95f412ea
TLSH
T1BCB0222BC202A202C20203B03A8282C83020CF20C2032202C2E00A22EC23BE802A2020
MD5 SHA1 SHA512 TLSH

Submit Download

db67ee7acf7f8b88_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\db67ee7acf7f8b88_0
Size 171KB
SHA256 064c2339bc3a6720270f6144355873750d9785ac64f892a84b608b399a1cb0af
MD5 c04166bd25d92e28fd3f78f56b7c6342
SHA1 8fbefbfa06f554b2b378b6b00e12a50cb2741f93
SHA512 89fe7046e0bec2815e3eef4840535d8d163811d754d9fd694fa9d3ef0cdd7c4efc52b6f7fbbaf690a76926e1317efaa67a9a72331e79da1c207323bb556a1aab
SSDEEP 1536:KoOegBegBEcLS23bJnd3bW/IV6QjtIsUnZlZ7W32WtvHabHXc50iIReIN/lTrW1:u3ZSYbZ6IVDg7Sr9IrN/lP3
TLSH
T1F5045C326300B83B6513CE61A57E7F4E3C35E16BED0686FCA5E4E570AAD6CF20525788
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 b28eb8269d8c90788439b03bb62f08598242c2a4039907f9193b5dff0dedbc8f
MD5 00159f6c71cfbef91ae19f41baca6fb9
SHA1 e3e823be9569957326d488670b5f3d1f98ec88fe
SHA512 fd3350e9bfde83d9764847f3e55e6602475b6baf8557d0b315f4a8fb4d3a9914d94d103649f939a247cd020c6edbc72b83bf4138e15c3444c0190d14cec4a3cf
TLSH
T127B0025C88C8C6C7D57403BD18F3609DB1F30C10034605E543B5B079A976BA467264B5
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 3164f2c114bb5765d65d6373cda2506bc7a305f43fa747f6d95851a376e6d12c
MD5 2091a6cac54b6ccf3a893c92a1919556
SHA1 6d32c28622e571b10e5a2f1a69f848bd2b346a89
SHA512 e591fbaeecde33442218d4bbc24d5e81d6390e423466185f6329258415b27b294d3f7291d4ed74b6b76bd1f7800c5ae1b4cbe4b50ba42cb5d8640bbc4290d51c
SSDEEP 1536:qpicYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:n3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T16B9302BA8E2A4AF799BD5691729E7909CD12130D705FA8CC7168974C21D41CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 830ac84f0e23c421151bcb5f8657004bcc17d469d471f8a46f28f8ae7b49c5fc
MD5 bbd88f902630d83021a67955eff1846e
SHA1 9028b28b2795164d8617d6cc555400812301556a
SHA512 aa634814f7988032fae0dd4856efa4ea2fcedce04bfdae4e5f962ff748f9819e31c5f6f75333abbc0db772f037a35631308f0f33fb911440b4eeba026bd7785b
SSDEEP 1536:qpicYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:n3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1EF9302BA8E2A4AF799BD5A91729E7909CE12130D705FA8CC7168974C21D41CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 ad6a3f3ea383fc0617671020ffc6e8b53a721ae3480308bdb533ecec898436fc
MD5 01477be3b4ba49ad938f839f2bea86a8
SHA1 7d1f5ecc8aaf49068bdfcc73a65147e85ac3c807
SHA512 c966618430fb6150875c9fdc5fbd58f02f1f091fd22d853b4e1916d2f94c1f47f8ec1429fde8f3cdc3289e3c664df30d63fda8877e31dabb923c65abb6cba581
SSDEEP 1536:qpwcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:N3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1E89302BA8E2A4AF799BD5A91729E7909CE12130D705FA8CC7168974C21D01CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 56198d6a9dbd56209245719d1a5c34614979795745353a08a8692211fdb1775c
MD5 ab2106a2e6a02f288bc0d008c548e5bf
SHA1 f3d23adc3974608d4d48eab4dd6f1a293c933151
SHA512 9c1bb1799c081f2c01b4d8555cb92ed9920b098164f50713c46065b9990360c3f3bcf93d7fbe8ff5d54c9c274e8ea9e8f01b7b45a14ce5e0cde0d53ad7cb1dc5
SSDEEP 1536:ip/kcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YW:ak3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1F59312BA4E2646F7997D4A8176AD7909CE12534D705FA9CC316CA38C61D02C82F72F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b1bdc7d42411a40952106969d4973aa2f5f265df5d9c8802d9d4b92c58b56c4f
MD5 365bf8aab0141dc54500ecbd7fbe8c3e
SHA1 636bdc687ce7ed798950707a32c6d9e87f7119b7
SHA512 22b6eb6662c0e9945a6c8d4062c32c4287c0bebbdec4866dd73e71a1723c91229d54f928cca8c97410c2631cf43996d05e85f45fd5ca35a36e4f54df82ca7b02
SSDEEP 1536:qpXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:e3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1B69302BA5E1A4AF799BD4691729E790ACD12130E709FA9CC7268538D21D41CC2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 9d6e6962f22be16dfae04d2e4b800f06ac46709cfb1bc621cf8b55667ac2c72a
MD5 cf85bea3369b947f9f6986757065ff2d
SHA1 6907310b19888955d252e5b720bce9944a6f6dc5
SHA512 4175595efd34045b59fdaa92e3c9ead30e7244890915d7fba75b02b3d7f4058370def9087b4f182f90aec87bfe042b1360afefa08c1040cfef3f5c0581df925e
SSDEEP 1536:qpncYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:S3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1989302BA8E2A4AF799BD5A91729E7909CE12530D705FA8CC7168974C21D01CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 8517c66cbb98b763f5f4f40ce8d248269505d4749570f025ecf9e04cd49b5e80
MD5 f7d3757d25ebca6f9de8e389faad688d
SHA1 4514ca44881206b7d77cd8493046c143848436ba
SHA512 9f21a2bd69195f99725b4af6c0aca991826ebe35627588806dedc896e65fd80a5abcfd5cb5381da5a768cbdcabc9bf8d6866fbc60c5d36647b302cdd8b7e3cd6
SSDEEP 1536:qpYcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:F3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1A39302BA8E2A4AF799BD5A91729E7909CE12130D705FA8CC7168974C21D01CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 d2c40c819223e2e19c045f162f74903fd78fa6c48373ab98efed732850aedd3d
MD5 139e999a46ab48f6d23f8bd644134e2b
SHA1 2280bb6e16f03142c4740f3bc7efa3ff5761fff3
SHA512 d69c08d5f65ca8959f55bbad4af242573a4aab58afc2422298c0d43fbfd5eea973e1c6e79799c96a737ec60527650a4b99e4f84faef1f4bdc67f4dadc49d1a66
SSDEEP 1536:tpXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:z3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1719302BA5E1A46F799BD4691729E790ACD12130E709FA9CC7268538D21D41CC2B73F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 feb5a1de5477790c253753ecfcecc68a0a231ef36f317829ca4b3554018ec92a
MD5 4498a76da1958ba049a308ac29bda9ba
SHA1 b2d94a343d88d48e1aeb75fbdcdb919d903ee5c5
SHA512 28f3aec21994a4099d7c259393f4e4e784c02e4faee00725cd55af54af8f084ac98e234585d44d32880bf167c88f8147648951f8a63363759ca7f753bc15e153
SSDEEP 1536:qpZcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEx:c3Qw/xLANk0mUW5GmRntSFCjEENL
TLSH
T1439302BA8E2A4AF799BD5A91729E7909CD12130E705FA8CC7168974C21D41CC2B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cf0266ac99d59d8e7bf7d06daaae58886aa69f3d629c74fbbf7794adfd2219a7
MD5 855c93f4f21d237e49deeb0724f94d4d
SHA1 9ddc8ddc10d3e5b48f893c6a47c2caefbff1140f
SHA512 0ffe3618dda92cf0c32f53b88d8586e4100a7bf6ff98a8c85877c4ffa8b392b45a5f3092f9ce911a0b58f4fa82e09244626a391f4deb58dc0c7adc95b0ed3fe9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P71:fwUQC5VwBIiElEd2K57P71
TLSH
T151B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b65e3f6d57bee85b90392c47f2236ea7ffcfe9cba07ca29930764c7dacc0ea2
MD5 726476576ad538c648305e214c389ece
SHA1 03960d925aa07a6736b28a431ddf422fa8bba04d
SHA512 7b99250e71a507574a7ea1c326ff4f687cffd7e1a0eb1ba5aa847f5b5e0c5d997dbef37ede7c2815a11e03b25f291a4f19173dd0aa9d22472d224e9b1d6349a5
TLSH
T11ED0808995F15C35D5D78CF1154B37067915C577DF42932374633C3C8C435D19546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d084fddc35d62ab10457432373865714cd0577ad9bebe9188135998b9f802bd3
MD5 ff587c8337b9997eb40f19fb41bffd1a
SHA1 75e9be1412e32cbe6e960e041e872bbb48ab464e
SHA512 d50cc729f4f047045aba003643fd356cb1ac85c1d90f9ed992f787f682a862005a91103e9e388ad5cbd4f884c2668a35a0e5a0d011d0684ef2d6bc59a10b1701
TLSH
T15ED08089D5B15C35D1D78CF1154B37067915C577DF42532274633C3C8C435919546283
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecc103220659b15b56c51e9002281cb930975deca8db44af194bf80a64b234af
MD5 9fed310f4dbdc9a2461971b19f5052c0
SHA1 115846f0655f86ee9b0df9e6162b98f6759f0431
SHA512 fa56e883ae91402b4ea0c534c2613509a62d2b9143aa63ac21e6964c2160f26457b4535ce353ca6ca04a2cd6e78c64013c6198649d03713abde28dc1800ee193
TLSH
T19DD02375FDD9D006D33A04B3135353516746C6157F434011F055C40CDC557BEE3C5582
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dfa31889c927e8cdaff05e65697336947a470006fbdf30d92807265375c4cf39
MD5 ea31f7a527b9025bc4d21b3e8fcae904
SHA1 68810c2c1672b32571858f5f94598d736d58c12a
SHA512 873914974e419c70864682645716c1217f2da6dd6cb10af16814ae306dcf6459ac797a2b212c7520328687dcf49316eaa3cf1c992e6fc7140ebfdc3efdc79d50
TLSH
T10F713C4560A98354E3E80C7482F124A9323C77993D771EAA36F388FC9B92B22D0CD81C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da04a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5da04a.TMP
Size 3KB
SHA256 0b4507793de9fff5094e1e1a52e0d079a80619f204efbdbdeb74c3ea5e3f6f3f
MD5 2e670a69677ab5a52adfd2d27b3cb6f4
SHA1 f4423b8313b212e6377642f90c3d7deae376accc
SHA512 e377a8d5b6ba5fe1f76c4b206d29b92fb2a30eb3ed1e17317c7baa174124fb727af1c80ee36025457f1062cb4c70090a552e4aa76fc631a40404416709c7ec95
TLSH
T1C6612E4671A98314E3E84C7446F52469323D77993C771EAA36F388FC9B92B62E0CD91C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 c919760504d55747ac86be5b6f620b70ed5fdd356f186652ed608c384f50a71e
MD5 83cedd033148a5eaecebae48534394a7
SHA1 f8fb1983db5eaf0b420abf4e7a1dbb81f80eb8a7
SHA512 e5e58b29d4d175e3a16addc7dd881107c6e6d5c26b17d81535ae22e8c40ff65c52981a1bc92ec10387dcdfb2e10145eae0e990d15c56b43ac93f62dcb8e53f70
SSDEEP 3:MsEllllkEthXllkl2zEkln/8T:/M/xT02zn/+
TLSH
T166440415FFC04545CD0010344011C35003F4D4104F1157C334D104135DC75400DC1110
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8f0f1771909042fb3d7304de4a529f3f61ac0318b06640b6c3bfd3999480dcce
MD5 4418ddcfd642c504e07b72ba9fe5eaa3
SHA1 da7021d618dac6dea650069d340373aa9a93be44
SHA512 409b038c6d577c5359f8ca412897f2b53c6a6d7b5d5839978df22af18b703692ed248f97e94f8de5d1666c37c75058cfdad2c3ac2865e1f06027f85b257a3b7d
TLSH
T11441C0F7C3E8856D8A0155F0AB18BE1BCE1D0515832C3D5AC5E4EF5B93E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7d19e454f3abecd700df9c66ff01d2d7604d9ede04df0911b55a129ed1fdb142
MD5 d9869203fc9e06a58358855010fa77d8
SHA1 a4c79657dcb8c80f34fdea1e88bb07114f0cb36b
SHA512 e99523f0263230945307934eeba769a975711eee35c30ef0519110a95a5be5516cb5efe1a721b689f9afd97a6a78f38ee3f53e60cf23f7e56370fd52ae08f104
SSDEEP 192:sxZER5yM//K1Ml8Mj5/fPsYOFQoIgZdGDIdpSkHW6+WNRXY/YJb0RZlnIg/mWJ:sxZER75/fPsjmvcXHbi/T1Oi
TLSH
T11252FA166A349A7BCCD7D209B955BF53D6F91462D2900E48AEFCCA0C04E6BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 15929432749247e9a89723ba7bdc4b600339dc63cc2ada47ba7aafcd3efe1d0e
MD5 93e63715ff8095f2fb53e6544de26d22
SHA1 80834bc52b14daa5129a4ad98a30ab98e3cd3c16
SHA512 51b633daf74246232e4040c965b606af93f7f6f0c59b1acd421b9adb9eff9f63f3c94f641c897b233ab293bada860d119db7b5c0e7f266c2dfc1e1fd0267715b
SSDEEP 192:sxZER5yM//K1Ml8Kmj5/fPsaWpVGORQoIgZcGDIdpSkHW6+WNZpFXY/YNt0QZO5i:sxZERbi5/fPsaWvFqucXHbHO/QMni
TLSH
T18562E9566A349A7BCCD7D209FA55BF53D6F9146292900E48AEFCCB0C00E6BDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 0fc24b8cc3b7e894ca2041762a924da75cccbd7ed5cb71415707d715babb4e9a
MD5 4fe0867f2d56f024c6eec21f2239a698
SHA1 644668f9aa6fff4afc3f5ef706ea3441c9b59cda
SHA512 3ca1a46ba4aac652dc17fc437aa47dbbc5e56989dd48c392259cf53b5b68746056ab3b2c46857c8d2b78244b1c99d62733e72c9b9052b1230743dcfe9b6fa677
SSDEEP 768:1uQv2rj7pLuLneqWve+l+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVdt+0FLllnWhAr0:1uQv2rVEneqWve+l+u1ja8o0FLfWhLxB
TLSH
T199F20C3B6C0CCB7E4F804E9CEC2A7E8A6DE801CB9698895447FA845C03C66EF55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dc7a10bfa7256dfba851a98450ea7ce9673d0fd25af17a9973f200f3d15469dc
MD5 c1ed642b407ce901b6f41d1120fc007d
SHA1 a2e84123c7d2cb2db46db22176042cbe1dde41dc
SHA512 88106a2bba22842f8e547a1a3de3d7f3565d6e9f12bc245fb61ba7752b8194446bd0423fa44897780171f4bdcb9e1bb92e3b47315d1d08880f88aeee46a0516b
SSDEEP 96:KkE4Kh6CGNaKGMaOLeK8YjoQKRum+92KOI7YnuqQE:SnxFtP/tL
TLSH
T199E15151313B12813A7E398E9969B92F06C271673548E46B3FB904B64F27E20CDFD8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ab2e484c23b26be6308f56c805a96da72f740b2fc1a22909454f890d40fdc79d
MD5 1415b01c4668c8081bce077cb9297e96
SHA1 822b8f63290b3b3cff9ebe693ee4380e0ea664ee
SHA512 42348ad5478632d5aaad4df6a6ea218481bcc01f7e3d1b36cd3c900174f592388fc04cadbf14bb31a5ff9a4e2e0693202b71c392e6ce77df050d98a39773f529
SSDEEP 384:n4jccCs+Bt0S39sN1fKBRwgDi+iMM6c5B834X4df3j:mccQdrNWJH6c5BPMj
TLSH
T18E826C7268B45C3B8DF39560F04B37535EB490AB97842F68D9CE9B1D05EF2AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 eff214340eb04b9567cc43ecb6a18c53e5d16dbd8b9d83df86d8ee53d1f91452
MD5 4ceb8303e1873d17d0d882a7a9fa976c
SHA1 ad9f9231a05a7c7912dc82d88ef70a040122bfc1
SHA512 bc4b72b549a855de5882940d8e0067dda0de26b439be50b780549fa694d20f93b3fdca9614e3a2b8c4d7cf39e2f02be2ef98eedb6c1d137a7047df0060cef2dd
SSDEEP 384:nJjccCs+Bt0S39sNsIKBTwgDi+iMM6c5JqAStc1/3c5T4e0dK834X4df3j:JccQdnNWJH6c5bSGc5T4e0dKPMj
TLSH
T1EDB26CB1A4A59CFB44A2D8C8A187F6536DB050778A8C4F1CEAF9B73D309F5F81716920
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1799a42524b65f845a34ea0a858ad6eaa2f42271291eb34b20bf59f1c2bf04df
MD5 8383f9df056a6ceb99c7b3c041ef997f
SHA1 55f69fc60abe16719fc3ad7218a70089a08943d7
SHA512 c3a22a6f8a1419dca35d37ac25f9c87ff251214d62ca920ba1569251724b9d2610f31e1b0e3c7d7600c13449a0f3ef4fba0af737a350b2e54bcce8fa2b50ae9c
SSDEEP 384:n5jccCs+Bt0S39sN1IKBRwgDi+iMM6c5B834X4df3j:5ccQdENWJH6c5BPMj
TLSH
T159826CB268745C3B8DF39560F04737535EB490AB97842F68D9CE9B1D05EF2AC130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8a190d9fd363a1be50184347ad47cf903e2bf769ebd45dba844a24dd524d5638
MD5 36af46d1dd5f3bdd405b001820b3a71c
SHA1 3fafb47e289a0e9495026a5615ae9c316f2d5e5e
SHA512 777e37cf1b0b88166db29e61ed58834765342ba39a48270b68c6bb5b66aedc22ad2faffba5ee81f0c5f479555a32bc78a13778c8d58ae612e8ba03323a6919ce
SSDEEP 96:iqONkbQsjpfKTzDXcJRC5ih/cIPURHl8h4otop5cyDsLBEPgpYvJKxCbTqNGLUxR:ZON/6IT0JZQmiUy7GOgibF4+ikFu9lU6
TLSH
T1E202E875A8686C7F8EF36E45B48B3B275FA4206FDA952F98C9E44B1C04D765C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e3d328167d7cb1573d75d7304ae2b3e202e76602fafe4eccea5b6b6558e06fc
MD5 b744e8909621783b671a7229c96b71d8
SHA1 33da37d86b3f8268f592e61b6bc28b1be6b74dbc
SHA512 50d8e8dd786674bd9ee9182af4aa61f405ac290b94147d78ce8e3b45863a04f9cb864567e40cdb9ff384831b71f16ac1f31905463a2d6c5515e3cfd3f991932f
SSDEEP 192:FONA6IT04QmiUyAGwgibF4+iMM6Zioh1qqpU6:FONA6Aqwgii+iMM6cOBU6
TLSH
T171123B76A868AC3F4DE368A1F04736239EB4916BDB897F94C5DC1B1C05DF69C5307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74ce6095-e226-4311-8ba4-56d68e2e890c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\74ce6095-e226-4311-8ba4-56d68e2e890c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 73e20169dfa5ad8fa39daf72bb6a379a5d5eb033c46cd974862657f2ada41eca
MD5 1f1846910f529d5f5701794aeff303be
SHA1 183d8f5292984c73639e7164ed45d888b3fb1c7c
SHA512 98a34d39a6e1dedd0ffaabcc27f53c72696be64b00cfccaac146f9a33a59a74322cd7e1ebb2c142f8c73e78807af74fb1ea1d4d1ed988f3c7ba8419b8150a630
TLSH
T156412B9CA6E90148B3B7AE599BF6A86D487FBC772F47D05E00110D4F0A62B40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

d63ea594-b680-412f-8c81-7cf6ec70af10.tmp

Path C:\Users\Admin\AppData\Local\Temp\d63ea594-b680-412f-8c81-7cf6ec70af10.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

de39b01b-3859-4371-9ca7-2e920b73700b.tmp

Path C:\Users\Admin\AppData\Local\Temp\de39b01b-3859-4371-9ca7-2e920b73700b.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FindProcDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuDD1E.tmp\FindProcDLL.dll
Size 492KB
SHA256 bda8e0ddb672ea3558ad68634c49da06cd72f93d7fca642ca41df00e26512df1
MD5 633625aa3be670a515fa87ff3a566d90
SHA1 de035c083125aef5df0a55c153ef6cc4dd4c15b4
SHA512 3c687ddf0e4e93a6787a23a93e2011df42898f6d21101c848a1b7c7bd2eddd5d49fdd0748e47e6235e7808596d00a1ecf79b5c975d050dd8d00a95f515a444a9
SSDEEP 12288:LAeafIS4J8anXexYWGRhvgbTu4RJ6//sCMUx:04J9/WGRS33+
TLSH
T156B44B00B660C01DF4FA00F9D2BAA95DAA1979B0573C94CBA1E5F6CE07395E5AD33393
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuDD1E.tmp\System.dll
Size 12KB
SHA256 1d0ff7a0b131aca891833a39eb5771f77ff595d91f00102071661b8d00888555
MD5 a08c2581acfe27b4f8797c34b0043bb7
SHA1 370ab892cc8805e53e82a69c197b97499b49c0d1
SHA512 e4ea98f5c282c2051e5138063416f14bc3f1449c6bf5eebd2486d0c1190a1fbc20a87651bb96b8e98df7697a49043695d1d6f7a59953ccccb00326bd2eb70976
SSDEEP 192:ycT+SdpWQVDZ0VeqeUCFRJYTkvBo9LnNWNkRHE1MMSm:f+85GVesCFR8kJo1nE0E1Nl
TLSH
T1BD423943BF614AF2E9554736046A7F1B4B3CEE5503D4469BCFD39444A8B10E324396E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WeChatInstallDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuDD1E.tmp\WeChatInstallDll.dll
Size 3.4MB
SHA256 de80cc999d526bab4c642b0b0fa98bd2632d99e1dae956a971189794bb42e562
MD5 688f43c005c5c970a8d72cd7de6739b1
SHA1 a18d79ec58dcfd89616e2af48a98ffd1b29248ac
SHA512 7e3f7c8688bcde47f06aea33edfb9639a067fc353259ca080cb1de15bdefe832494459df529329fae43f29fa7faadac721a264c6d14bb2c15626a93b9e576600
SSDEEP 98304:SW/+542YdKDelbPqx55PPwiLR5md9L/w3d:SWG54awi5qd9DwN
TLSH
T1A9F5C002FB82D272E59A0274617767BB4DBDAE30A73588C3D7E03D7588305D2663A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsis7z.dll

Path C:\Users\Admin\AppData\Local\Temp\nsuDD1E.tmp\nsis7z.dll
Size 434KB
SHA256 c5417a6a4cb05b820158f03fda7f3af8346891086fbb5475783c30ac8b281b0a
MD5 87b6d4e6e8990338484693e0075ef478
SHA1 810f29bfdcf70e12cbd868234e509bf3fb7e6d97
SHA512 8d091f190e255e6f0fd00d2576022a12e43b01911fff9d1d2f5e2d2360ef313281f0c46304137eb9022f4c13ff6bddff77fecd22908641b88c1b77fdca04f0d6
SSDEEP 6144:AfeNsrsm15wiycorFCpcLWNZDn4Ahj/wblRtQM7Y3P72dJfeEdv19:A/rXByD5LKZj4A1WlPQM4723/19
TLSH
T150949D12B692C9B6C16E02309A18F76935FEF3B0486DD61B739C4E6F1FB04C19719A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5972_1745497858\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1305254c-3e77-430e-b827-3f217144adfb.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5972_677758037\1305254c-3e77-430e-b827-3f217144adfb.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

plugin_version_info_CourgettePatch

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\XPlugin\info\plugin_version_info_CourgettePatch
Size 4KB
SHA256 ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7
MD5 620f0b67a91f7f74151bc5be745b7110
SHA1 1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d
SHA512 2d23913d3759ef01704a86b4bee3ac8a29002313ecc98a7424425a78170f219577822fd77e4ae96313547696ad7d5949b58e12d5063ef2ee063b595740a3a12d
MD5 SHA1 SHA512

Submit Download

51a1fffea11325a1e4104c6b3de47af7.ini

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\config\51a1fffea11325a1e4104c6b3de47af7.ini
Size 11B
SHA256 ba490ab30031176a796a99132b8731f8eb20d0558d7138dc9974d78bd640a756
MD5 dc0def6bdcdc6a1a24d6f00fda80001c
SHA1 7a949a35bc4948c405ebe2c5ca6d108999af6a98
SHA512 4f4b91c51401470b93a50b93ba01f63816e4ee01d17baf515bc418e165db9b33fbc18c1dae6c6589a5f395e69c984cde5446ec4c5e658e6f2525a3cf65206535
MD5 SHA1 SHA512

Submit Download

98ae43cd6a1870deb10154bfed5f9eb6.ini

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\config\98ae43cd6a1870deb10154bfed5f9eb6.ini
Size 24B
SHA256 865ab4c38b8e32f851284789540133088be3f53614c43252051b1d7444338b7b
MD5 c03bfe807da1b1dbb443bcffe800040d
SHA1 ba008d2bfadcf3fac30ae7a5af68d01c3997b5ab
SHA512 026840942c2cf20ebbe41fc7029215a8bad137f2bd7fed22cc82754ef213824a4f15cb7749042ac97c83ab65646023eb3f320680fd604ebddb1e576fcfe59534
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\crashinfo\settings.dat
Size 40B
SHA256 f96368d8a800116bc8df96c5a19711a11a6cf9af76d6e7aa8f6e560523212e34
MD5 4ec11c48a979b22274d1329df4d43111
SHA1 8e0fc5e829625f2909f1cddbbc690f6f9a4c3648
SHA512 91abe2176abd0dcf6e01d266e8324a00c10d87f5b70635edc17c3e4ea158d4ecb98ca99752585e8f8229435c19095545d1a85ffd39705d65201a0aa783c39504
MD5 SHA1 SHA512

Submit Download

mm_20260424.xlog

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\log\mm_20260424.xlog
Size 17KB
SHA256 c588bbaa97ed31b3e6857c20d7c34c2df518e499f8f9735baddfdb88e96d3935
MD5 340d4190c281bb2a44d362f1451b3146
SHA1 6f013a2b2e07a0bdbb12d4a2c06a1cc7e65200a0
SHA512 2849adfd65e6bdd47a45a1ed2117494616cab960015e2209037a118b9ee2f6f1c3df03de85b3f6a4ffe0d8b18181c77fe62c6eca895c3fced76609629db89bcb
SSDEEP 384:sRjIbJs9lAl6aawfDPdD9G4+oUjCKHV1+Jc1VBg:QMsgRawLPjG4+jC+oJcBg
TLSH
T1E782D00DF9091199C46B388AC0123D2D2B779AC8D1F4923A61D0F69FE9602FE85837DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup_20260424.xlog

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\log\setup_20260424.xlog
Size 407B
SHA256 e4182f98098a2e14d0b6df46f8416da9b29242ab27dbd985fc5da2d5a1b1008e
MD5 bcd56750a7259d967881af6133127fcc
SHA1 229aceb477cfc8e0ef269dcc8dd689e7af98f510
SHA512 320a404af209fdc3bb1f98c377baab903d627a4091533157d647fbf69690a8ea906cb32261b7d771e6e236642c34abcbc915142db68cc442726f7332a5e45dd3
TLSH
T157E02B8F0049DFC0C8888A2A288A4089068070229620CC49DA95B865E2A6BA6092B202
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\game\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 88435f72d2d90e11946f6957da090eaf8d63f8ccc74a7545e8b2a15ae26fc132
MD5 06780c3ede3153c33770bc9cef05f37d
SHA1 05b88de300643a37194fb870c94ff8ed9410a22d
SHA512 87f2b529b63236ef5d05d892bf089a6dba4749f763c37c75332a1556e196375d41a5f50ef668eb185fea7d9b4e67aca8d188cce2cb9e4e131fa41ce11d624ec9
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\game\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\game\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

90827a2e-baec-4fa5-a147-1ff561a1f6d7.tmp

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\game\Network\90827a2e-baec-4fa5-a147-1ff561a1f6d7.tmp
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\game\Shared Dictionary\cache\index-dir\temp-index
Size 48B
SHA256 8e837ec7ca6a41afa2c020dc67a4d850eb32bd84481971a43a071bd4f10222e0
MD5 5c26db40fb3cfd90a23cfa80c1a6f14a
SHA1 51766b2ba4d954c9c5961d473d69fd1f758bcf39
SHA512 3b52efa9f56109ccd72c0eee541754557a7aea71f542154407388c2cc1b08c0e3a350b767c7ea3bcece35733dbcbae3c36576eae6691cdf05e929abe17663aed
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Tencent\xwechat\radium\web\profiles\multitab\Local Storage\leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

client_config.crc

Path C:\Users\Admin\Documents\xwechat_files\all_users\config\client_config.crc
Size 4KB
SHA256 5a52184c8a9c39ef102de029a59156b0dc2341240f15f46fff7adee2e6cce2d5
MD5 c702eb58e428ee131e2cc62150d2ceba
SHA1 d9b946cc21d4e94c265f10724bc9578ccdc3ccfc
SHA512 505d282c1fea1b092c88e0c1c03c8a8aadc0613e1d7383677737ddfef9ed6d004f36deaa7661adbb11f643fd29a3cd3acd30c3d687ebdf52215354dd951560b7
MD5 SHA1 SHA512

Submit Download

memory/2828-110-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/2828-130-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/2828-116-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/2828-412-0x0000000000B40000-0x0000000000C1C000-memory.dmp

Download

memory/2828-151-0x0000000010000000-0x00000000100AB000-memory.dmp

Download

memory/2828-150-0x0000000000B40000-0x0000000000C1C000-memory.dmp

Download

memory/2828-473-0x0000000000B40000-0x0000000000C1C000-memory.dmp

Download

memory/3464-924-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-925-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-923-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-922-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-926-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-921-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-920-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-915-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-914-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3464-916-0x00000185E2800000-0x00000185E2801000-memory.dmp

Download

memory/3636-139-0x0000000001AA0000-0x0000000001B7C000-memory.dmp

Download

memory/4144-140-0x0000000000C80000-0x0000000000D5C000-memory.dmp

Download

memory/4652-529-0x00007FF7CC2D0000-0x00007FF7CC2E0000-memory.dmp

Download