Overview

overview

10

Static

static

1

WeChat.exe

windows10-2004-x64

10

WeChat.exe

windows10-ltsc_2021-x64

10

WeChat.exe

windows11-21h2-x64

10

Resubmissions

31/05/2026, 23:22

260531-3cx4cacs7m6

31/05/2026, 18:03

260531-wnja1adv8t6

31/05/2026, 15:26

260531-st7c8sdv3k10

Analysis

  • user interaction
    yes
  • max time kernel
    300s
  • max time network
    303s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    31/05/2026, 15:26

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WeChat.exe
  • Size 45.7MB
  • Sample260531-st7c8sdv3k
  • SHA256 714ffc4698d8933240c43a1cf995038f32a29d6cd55b76a4c34710c264248bc0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectioncredential_accessdefense_evasiondiscoverynetsupportpersistenceprivilege_escalationransomwareratstealer

Malware Config

Signatures

  • Family: NetSupport

    NetSupport is a remote access tool sold as a legitimate system administration software.

    ratnetsupport
  • Suspicious use of NtCreateProcessExOtherParentProcess 6 IoCs
  • Drops file in Drivers directory 2 IoCs
  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks for any installed AV software in registry 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 14 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 4 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops file in System32 directory 2 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes dropped EXE 22 IoCs
  • Loads dropped DLL 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 29 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 10 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion
  • outlook_office_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\WeChat.exe
    "C:\Users\Admin\AppData\Local\Temp\WeChat.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1132
    • C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixprqba.exe
      "C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{EDFA6A0A-CE79-450E-9146-90EE4E06D263} {02358274-C423-4BC1-BCF9-2C9002037786}
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3868
    • C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixiuiba.exe
      "C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{6DB0ECDD-534C-4949-8918-22888AA9EFA0} {475CAA87-EAFB-4CE0-83F1-8CB22A3D91F3}
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4432
    • C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.be\WeChat.exe
      "C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.be\WeChat.exe" -q -burn.elevated BurnPipe.{3FD8C912-3126-4C5E-B177-C2F64DD5A313} {B7B65078-CBD8-4DBA-B832-198FC94659DB} 1132
      2⤵
      • Adds Run key to start application
      • Enumerates connected drives
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3476
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:3620
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:1204
    • C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe
      "C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe" /burn.runonce
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe
        "C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\WeChat_20260531162636.log" /burn.log.append "C:\Users\Admin\AppData\Local\Temp\WeChat_20260531162636.log"
        2⤵
        • Checks computer location settings
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2540
        • C:\Windows\TEMP\{B4002A1C-AE33-45A0-AE14-BA2C33DA1ED1}\.ba\wixprqba.exe
          "C:\Windows\TEMP\{B4002A1C-AE33-45A0-AE14-BA2C33DA1ED1}\.ba\wixprqba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{712982D9-D794-41C3-B903-8D71C7DF295A} {C5B05864-7483-4E48-9ADC-1B8FA70AD8BF}
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:1636
        • C:\Windows\TEMP\{B4002A1C-AE33-45A0-AE14-BA2C33DA1ED1}\.ba\wixiuiba.exe
          "C:\Windows\TEMP\{B4002A1C-AE33-45A0-AE14-BA2C33DA1ED1}\.ba\wixiuiba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{F2E1FDC8-CCCF-4403-8E05-B820AE66372E} {52B31706-BDA9-458C-A97D-FBB4605430FC}
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4484
        • C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe
          "C:\ProgramData\Package Cache\{A3AC9CC9-69D4-4148-B17A-85F335427B84}\WeChat.exe" -q -burn.elevated BurnPipe.{E03B662D-7D1A-4D9B-96EE-09E2BB1DA53E} {39646C74-2207-48A0-9464-3853C676B5B2} 2540
          3⤵
          • Adds Run key to start application
          • Enumerates connected drives
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:4892
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3652
      • C:\Program Files (x86)\WeChat\Render.exe
        "C:\Program Files (x86)\WeChat\Render.exe"
        2⤵
        • Checks computer location settings
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious use of SetThreadContext
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1556
        • C:\Windows\System32\dllhost.exe
          "C:\Windows\System32\dllhost.exe"
          3⤵
            PID:2832
          • C:\Windows\System32\dllhost.exe
            "C:\Windows\System32\dllhost.exe"
            3⤵
            • Suspicious use of NtCreateProcessExOtherParentProcess
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks processor information in registry
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3080
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
              4⤵
              • Drops file in Windows directory
              • Enumerates system info in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of WriteProcessMemory
              PID:4632
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffd07d3c728,0x7ffd07d3c734,0x7ffd07d3c740
                5⤵
                  PID:580
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1988,i,4029800058067120796,9618337671755131180,524288 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2168 /prefetch:3
                  5⤵
                  • System Time Discovery
                  PID:412
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1732,i,6041634196927148527,5389325511518218763,262144 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2132 /prefetch:2
                  5⤵
                    PID:3752
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1740,i,8362870122984801019,1639159883911522881,524288 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=2504 /prefetch:8
                    5⤵
                      PID:2248
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3008,i,7872893166377573085,5099794759792478530,2097152 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3016 /prefetch:1
                      5⤵
                        PID:3016
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,12554141918084278212,5126003132237020586,2097152 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=3040 /prefetch:1
                        5⤵
                          PID:1160
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4144,i,17416572968483086166,6449714392541085895,2097152 --field-trial-handle=2136,i,361885697020141395,10976893814744754031,262144 --variations-seed-version=20260513-010036.937000-production --mojo-platform-channel-handle=4156 /prefetch:2
                          5⤵
                            PID:4428
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
                          4⤵
                          • Drops file in Windows directory
                          • Enumerates system info in registry
                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of WriteProcessMemory
                          PID:5644
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffd04b7c188,0x7ffd04b7c194,0x7ffd04b7c1a0
                            5⤵
                              PID:5672
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,5141068630163333776,9268863447946125387,524288 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
                              5⤵
                              • System Time Discovery
                              PID:5916
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1768,i,12131640339213274909,15355301341038839197,262144 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
                              5⤵
                                PID:5924
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,13956440897116664920,6818736650140944019,524288 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
                                5⤵
                                  PID:5980
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,717493766405532338,8875173099067908779,2097152 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
                                  5⤵
                                    PID:6132
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,14754461047853863005,18304800391367274770,2097152 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
                                    5⤵
                                      PID:6140
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4044,i,4074094824948151561,16170275390203073686,2097152 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:1
                                      5⤵
                                        PID:5220
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,10866581642418856027,7938009447525602886,2097152 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:2
                                        5⤵
                                          PID:5228
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,8853172175427324,14598002337461685206,524288 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
                                          5⤵
                                            PID:5256
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,411348629507115237,17529239574660958126,524288 --field-trial-handle=2252,i,4037766747038167057,7277805400833726539,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
                                            5⤵
                                              PID:3460
                                        • C:\Windows\System32\dllhost.exe
                                          "C:\Windows\System32\dllhost.exe"
                                          3⤵
                                            PID:6028
                                          • C:\Windows\System32\dllhost.exe
                                            "C:\Windows\System32\dllhost.exe"
                                            3⤵
                                            • Accesses Microsoft Outlook profiles
                                            • Checks for any installed AV software in registry
                                            • Checks processor information in registry
                                            • outlook_office_path
                                            PID:5332
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless=new --no-sandbox
                                              4⤵
                                              • Drops file in Windows directory
                                              • Checks processor information in registry
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Suspicious use of FindShellTrayWindow
                                              PID:3032
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2e0,0x29c,0x2e4,0x240,0x2e8,0x7ffd1a35c728,0x7ffd1a35c734,0x7ffd1a35c740
                                                5⤵
                                                  PID:644
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
                                                  5⤵
                                                    PID:5776
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
                                                    5⤵
                                                    • System Time Discovery
                                                    PID:5820
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:8
                                                    5⤵
                                                      PID:6124
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2808 /prefetch:1
                                                      5⤵
                                                        PID:5168
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:1
                                                        5⤵
                                                          PID:5148
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
                                                          5⤵
                                                            PID:5756
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:2
                                                            5⤵
                                                              PID:5980
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:2
                                                              5⤵
                                                                PID:5600
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
                                                                5⤵
                                                                  PID:5328
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:2
                                                                  5⤵
                                                                    PID:5072
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:8
                                                                    5⤵
                                                                      PID:3120
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
                                                                      5⤵
                                                                        PID:2868
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
                                                                        5⤵
                                                                          PID:1640
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
                                                                          5⤵
                                                                            PID:4972
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
                                                                            5⤵
                                                                              PID:5808
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:8
                                                                              5⤵
                                                                                PID:5216
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
                                                                                5⤵
                                                                                  PID:5224
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
                                                                                  5⤵
                                                                                    PID:4136
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
                                                                                    5⤵
                                                                                      PID:5640
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:8
                                                                                      5⤵
                                                                                        PID:4224
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:1
                                                                                        5⤵
                                                                                          PID:800
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:1
                                                                                          5⤵
                                                                                            PID:3724
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
                                                                                            5⤵
                                                                                              PID:3604
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
                                                                                              5⤵
                                                                                                PID:4680
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:1
                                                                                                5⤵
                                                                                                  PID:4136
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
                                                                                                  5⤵
                                                                                                    PID:3220
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
                                                                                                    5⤵
                                                                                                      PID:5036
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:2
                                                                                                      5⤵
                                                                                                        PID:2880
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:2
                                                                                                        5⤵
                                                                                                          PID:5504
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
                                                                                                          5⤵
                                                                                                            PID:5236
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
                                                                                                            5⤵
                                                                                                              PID:6032
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
                                                                                                              5⤵
                                                                                                                PID:1672
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:8
                                                                                                                5⤵
                                                                                                                  PID:2368
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875" --force-high-res-timeticks=disabled --field-trial-handle=1956,i,15991932994424058000,11564129663686631389,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=680 /prefetch:8
                                                                                                                  5⤵
                                                                                                                    PID:3812
                                                                                                                • C:\Windows\System32\cmd.exe
                                                                                                                  cmd.exe /c exit /b 0
                                                                                                                  4⤵
                                                                                                                    PID:752
                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RenderNET_7088\Manager.msi" /qn /norestart
                                                                                                                  3⤵
                                                                                                                    PID:2564
                                                                                                                • C:\Program Files (x86)\WeChat\Render.exe
                                                                                                                  "C:\Program Files (x86)\WeChat\Render.exe"
                                                                                                                  2⤵
                                                                                                                  • Checks computer location settings
                                                                                                                  • Executes dropped EXE
                                                                                                                  • Loads dropped DLL
                                                                                                                  • Enumerates system info in registry
                                                                                                                  PID:5060
                                                                                                                • C:\Windows\syswow64\MsiExec.exe
                                                                                                                  C:\Windows\syswow64\MsiExec.exe -Embedding D5479D69BFCCF55160537BC479D57A23
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:5200
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  cmd.exe /c ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{D1D9CD9D-4D33-459D-915D-50773522EC8D}\\nsm.lic"
                                                                                                                  2⤵
                                                                                                                    PID:3416
                                                                                                                    • C:\Windows\SysWOW64\attrib.exe
                                                                                                                      ATTRIB -R "C:\Users\Admin\AppData\Local\Temp\{D1D9CD9D-4D33-459D-915D-50773522EC8D}\\nsm.lic"
                                                                                                                      3⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Views/modifies file attributes
                                                                                                                      PID:3712
                                                                                                                  • C:\Windows\Installer\MSID67C.tmp
                                                                                                                    "C:\Windows\Installer\MSID67C.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2536
                                                                                                                  • C:\Windows\syswow64\MsiExec.exe
                                                                                                                    C:\Windows\syswow64\MsiExec.exe -Embedding 7D78FE6D4E9604AABF6F83F88BE841C4 E Global\MSI0000
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies registry class
                                                                                                                    PID:3968
                                                                                                                  • C:\Windows\Installer\MSIDB65.tmp
                                                                                                                    "C:\Windows\Installer\MSIDB65.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EU
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2764
                                                                                                                  • C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe
                                                                                                                    "C:\Program Files (x86)\NetSupport\NetSupport Manager\checkdvd.exe"
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5456
                                                                                                                  • C:\Windows\Installer\MSIE163.tmp
                                                                                                                    "C:\Windows\Installer\MSIE163.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EV"NetSupport School" /EF".\Log Files" /EF".\Bookmarks" /EF".\Tests" /EF".\Store" /EF".\inv" /EF".\Resources" /EF".\Help" /EF".\Image" /EF".\Sound" /EF".\Video" /EA /EX /EC /Q /V /Q /I *
                                                                                                                    2⤵
                                                                                                                    • Sets service image path in registry
                                                                                                                    • Modifies WinLogon
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Modifies registry class
                                                                                                                    PID:3712
                                                                                                                    • C:\Program Files (x86)\NetSupport\NetSupport Manager\winst64.exe
                                                                                                                      winst64.exe /q /q /ex /i
                                                                                                                      3⤵
                                                                                                                      • Drops file in Drivers directory
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Modifies registry class
                                                                                                                      PID:5624
                                                                                                                  • C:\Windows\Installer\MSIE6D4.tmp
                                                                                                                    "C:\Windows\Installer\MSIE6D4.tmp" /G"C:\Program Files (x86)\NetSupport\NetSupport Manager\" /EI
                                                                                                                    2⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5512
                                                                                                                  • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
                                                                                                                    "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe" /Q "C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32.ini"
                                                                                                                    2⤵
                                                                                                                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:5436
                                                                                                                    • C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe
                                                                                                                      "C:\Program Files (x86)\NetSupport\NetSupport Manager\pcicfgui_client.exe"
                                                                                                                      3⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      PID:5328
                                                                                                                • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                  1⤵
                                                                                                                    PID:2644
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                    1⤵
                                                                                                                      PID:5936
                                                                                                                    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                      1⤵
                                                                                                                        PID:6032
                                                                                                                      • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                        1⤵
                                                                                                                          PID:832
                                                                                                                        • C:\Windows\system32\svchost.exe
                                                                                                                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                          1⤵
                                                                                                                            PID:4464
                                                                                                                          • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
                                                                                                                            "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *
                                                                                                                            1⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:5808
                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5808 -s 1044
                                                                                                                              2⤵
                                                                                                                              • Program crash
                                                                                                                              PID:4260
                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5808 -ip 5808
                                                                                                                            1⤵
                                                                                                                              PID:3252
                                                                                                                            • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
                                                                                                                              "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" /* *
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                              PID:5540
                                                                                                                              • C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe
                                                                                                                                "C:\Program Files (x86)\NetSupport\NetSupport Manager\client32.exe" * /VistaUI
                                                                                                                                2⤵
                                                                                                                                • Enumerates connected drives
                                                                                                                                • Executes dropped EXE
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                • Checks processor information in registry
                                                                                                                                • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                PID:4920
                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                  "cscript.exe" C:\Windows\system32\Printing_Admin_Scripts\en-US\prnport.vbs -a -r NSM001 -h 127.0.0.1 -o raw -n 52102
                                                                                                                                  3⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  PID:3492
                                                                                                                            • C:\Windows\system32\drivers\nskbfltr.sys
                                                                                                                              C:\Windows\system32\drivers\nskbfltr.sys
                                                                                                                              1⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              PID:2832
                                                                                                                            • C:\Windows\System32\svchost.exe
                                                                                                                              C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
                                                                                                                              1⤵
                                                                                                                                PID:4052

                                                                                                                              Network

                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                    Reconnaissance

                                                                                                                                    Resource Development

                                                                                                                                    Initial Access

                                                                                                                                    Execution

                                                                                                                                    Persistence

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    3
                                                                                                                                    T1547

                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                    2
                                                                                                                                    T1547.001

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Create or Modify System Process

                                                                                                                                    1
                                                                                                                                    T1543

                                                                                                                                    Windows Service

                                                                                                                                    1
                                                                                                                                    T1543.003

                                                                                                                                    Event Triggered Execution

                                                                                                                                    1
                                                                                                                                    T1546

                                                                                                                                    Component Object Model Hijacking

                                                                                                                                    1
                                                                                                                                    T1546.015

                                                                                                                                    Privilege Escalation

                                                                                                                                    Boot or Logon Autostart Execution

                                                                                                                                    3
                                                                                                                                    T1547

                                                                                                                                    Registry Run Keys / Startup Folder

                                                                                                                                    2
                                                                                                                                    T1547.001

                                                                                                                                    Winlogon Helper DLL

                                                                                                                                    1
                                                                                                                                    T1547.004

                                                                                                                                    Create or Modify System Process

                                                                                                                                    1
                                                                                                                                    T1543

                                                                                                                                    Windows Service

                                                                                                                                    1
                                                                                                                                    T1543.003

                                                                                                                                    Event Triggered Execution

                                                                                                                                    1
                                                                                                                                    T1546

                                                                                                                                    Component Object Model Hijacking

                                                                                                                                    1
                                                                                                                                    T1546.015

                                                                                                                                    Defense Evasion

                                                                                                                                    Hide Artifacts

                                                                                                                                    1
                                                                                                                                    T1564

                                                                                                                                    Hidden Files and Directories

                                                                                                                                    1
                                                                                                                                    T1564.001

                                                                                                                                    Modify Registry

                                                                                                                                    3
                                                                                                                                    T1112

                                                                                                                                    Credential Access

                                                                                                                                    Unsecured Credentials

                                                                                                                                    1
                                                                                                                                    T1552

                                                                                                                                    Credentials In Files

                                                                                                                                    1
                                                                                                                                    T1552.001

                                                                                                                                    Discovery

                                                                                                                                    Browser Information Discovery

                                                                                                                                    1
                                                                                                                                    T1217

                                                                                                                                    Peripheral Device Discovery

                                                                                                                                    2
                                                                                                                                    T1120

                                                                                                                                    Query Registry

                                                                                                                                    6
                                                                                                                                    T1012

                                                                                                                                    Software Discovery

                                                                                                                                    1
                                                                                                                                    T1518

                                                                                                                                    Security Software Discovery

                                                                                                                                    1
                                                                                                                                    T1518.001

                                                                                                                                    System Information Discovery

                                                                                                                                    6
                                                                                                                                    T1082

                                                                                                                                    System Location Discovery

                                                                                                                                    1
                                                                                                                                    T1614

                                                                                                                                    System Language Discovery

                                                                                                                                    1
                                                                                                                                    T1614.001

                                                                                                                                    System Time Discovery

                                                                                                                                    1
                                                                                                                                    T1124

                                                                                                                                    Lateral Movement

                                                                                                                                    Collection

                                                                                                                                    Email Collection

                                                                                                                                    1
                                                                                                                                    T1114

                                                                                                                                    Command and Control

                                                                                                                                    Exfiltration

                                                                                                                                    Impact

                                                                                                                                    Replay Monitor

                                                                                                                                    Loading Replay Monitor...

                                                                                                                                    Downloads

                                                                                                                                    e586a6e.rbs
                                                                                                                                    • Path C:\Config.Msi\e586a6e.rbs
                                                                                                                                    • Size 43KB
                                                                                                                                    • SHA256 e42653c8615f147fd07efc2b8d96a735dd4cfa482d621bad10ec256e35e4e3cd
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    e586a70.rbs
                                                                                                                                    • Path C:\Config.Msi\e586a70.rbs
                                                                                                                                    • Size 3KB
                                                                                                                                    • SHA256 0f43bddeb9a70bf2057f7204425013e394ace80f8925ebc387f6bcc8815be945
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    e586a74.rbs
                                                                                                                                    • Path C:\Config.Msi\e586a74.rbs
                                                                                                                                    • Size 41KB
                                                                                                                                    • SHA256 93c6d1204a0cb4f2ee460b738a605f5206beef6f02e30a9095cf08493c935195
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Client32U.ini
                                                                                                                                    • Path C:\Program Files (x86)\NetSupport\NetSupport Manager\Client32U.ini
                                                                                                                                    • Size 1KB
                                                                                                                                    • SHA256 fcd48e31f90ea52cd641f2ac5150d594b23703d69679f34392e0b3a1505b2df6
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    NSM.LIC
                                                                                                                                    • Path C:\Program Files (x86)\NetSupport\NetSupport Manager\NSM.LIC
                                                                                                                                    • Size 251B
                                                                                                                                    • SHA256 dbdf2ce82d13459ed457ed3b2072152a7155ee301168d683888c72f1d0136dd9
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    WINSTALL.EXE
                                                                                                                                    • Path C:\Program Files (x86)\NetSupport\NetSupport Manager\WINSTALL.EXE
                                                                                                                                    • Size 745KB
                                                                                                                                    • SHA256 c5ea1071954d5253bfeafbd170544757c064456c3dec55b6884fe0cad7d2300d
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Accessibility.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Accessibility.dll
                                                                                                                                    • Size 20KB
                                                                                                                                    • SHA256 07f3b895293e26ba5b7c0d1289865b9b00f63d2c9977bd0bb8153e94dad23fdd
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Guna.UI2.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Guna.UI2.dll
                                                                                                                                    • Size 2.1MB
                                                                                                                                    • SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Microsoft.Win32.Primitives.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Microsoft.Win32.Primitives.dll
                                                                                                                                    • Size 15KB
                                                                                                                                    • SHA256 82e7ee3dcc764689eceda4e311e22a699f377583a13358b74f64b763e1790b50
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Render.deps.json
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Render.deps.json
                                                                                                                                    • Size 38KB
                                                                                                                                    • SHA256 3b9c69b7b370898abbf8b6b497174afbfd3cd85899d64885b74bd1d1f6ed25d8
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Render.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Render.dll
                                                                                                                                    • Size 407KB
                                                                                                                                    • SHA256 025849ebe6605f56a7124748e05b9b8329c47a8d06e05bf1ae2d6a2f665b82a3
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Render.exe
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Render.exe
                                                                                                                                    • Size 148KB
                                                                                                                                    • SHA256 9825ac479cee08b6e687ecd555f45d7f29d81162c10eeb4ca1ce9ea9e1913bcd
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Render.runtimeconfig.json
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\Render.runtimeconfig.json
                                                                                                                                    • Size 525B
                                                                                                                                    • SHA256 b2f0cdf39adc944b5d97a201fc16eecf67a2b1ed104ba25e61686b6a03ff2d63
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Collections.Specialized.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Collections.Specialized.dll
                                                                                                                                    • Size 102KB
                                                                                                                                    • SHA256 961c58a2537f51b5d67a12d057b2d7b6c96116f6753d6c88530882061f1b78d3
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Collections.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Collections.dll
                                                                                                                                    • Size 254KB
                                                                                                                                    • SHA256 b299a07c12ffe54b8c2cc2051992f41d8212deef92da9f84a092e494ed5a8f13
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.ComponentModel.EventBasedAsync.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.ComponentModel.EventBasedAsync.dll
                                                                                                                                    • Size 46KB
                                                                                                                                    • SHA256 717d4b578e0202e182a2153f58e10cbbe6956322c79be419f3763c9bf29973ef
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.ComponentModel.Primitives.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.ComponentModel.Primitives.dll
                                                                                                                                    • Size 78KB
                                                                                                                                    • SHA256 d270cda927ed66abbc4b8a4cf701b9188706b71288c9f029f10cf8a146d86d53
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.ComponentModel.TypeConverter.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.ComponentModel.TypeConverter.dll
                                                                                                                                    • Size 730KB
                                                                                                                                    • SHA256 320c39dba33e22935da45027431f44661d80e2e926102183ddbebf5b0e148ee5
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Diagnostics.TraceSource.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Diagnostics.TraceSource.dll
                                                                                                                                    • Size 142KB
                                                                                                                                    • SHA256 29e2f184dba243b7a3ff8d1454be643aa339013bc937993a5a0db21fc661c2d6
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Drawing.Common.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Drawing.Common.dll
                                                                                                                                    • Size 461KB
                                                                                                                                    • SHA256 5cdd76dfeb6b6fb9f3ef122b669abbea8713aff9834fec8d265dfffabf1159fc
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Drawing.Primitives.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Drawing.Primitives.dll
                                                                                                                                    • Size 130KB
                                                                                                                                    • SHA256 3b4f54e988205353a79b86ef7654eb5593e0cef00f68907a3801e458b911c736
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Drawing.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Drawing.dll
                                                                                                                                    • Size 21KB
                                                                                                                                    • SHA256 81c71d92e03dbe659c386956d8908d1f39af4c528c0474349b3e5a7ed950df20
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Memory.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Memory.dll
                                                                                                                                    • Size 154KB
                                                                                                                                    • SHA256 43b89fbd9fa20b0e875ec92d1d073f826819463f438580d8cb7fa087394f505d
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Numerics.Vectors.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Numerics.Vectors.dll
                                                                                                                                    • Size 15KB
                                                                                                                                    • SHA256 64e1b1f75624fe4e32eb121d540f095669fd3f51a4932e6d3052a3b855cfd795
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Private.CoreLib.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Private.CoreLib.dll
                                                                                                                                    • Size 12.6MB
                                                                                                                                    • SHA256 172450b7845657a0763e656e76305f71cf521b416e79b8fee7765e94212e7ba1
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Private.Windows.Core.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Private.Windows.Core.dll
                                                                                                                                    • Size 835KB
                                                                                                                                    • SHA256 73df588df9f834271f0bc3a0bd286e784af0ff340ef84227b6d90cb6316e2f58
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Resources.Extensions.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Resources.Extensions.dll
                                                                                                                                    • Size 134KB
                                                                                                                                    • SHA256 b8ed72c028248915021b0d2019f9bab200d48de28cc75858ea0e8ef413182d5c
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Runtime.InteropServices.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Runtime.InteropServices.dll
                                                                                                                                    • Size 94KB
                                                                                                                                    • SHA256 5324392c7f218574b85a9dce94032dc62b560fadd31a88a606e2458e5fe3ad47
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Runtime.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Runtime.dll
                                                                                                                                    • Size 42KB
                                                                                                                                    • SHA256 65e64e10af70836e7bd1ffc86535f6b110216615c2446136942641ab6ca7717d
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Threading.Thread.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Threading.Thread.dll
                                                                                                                                    • Size 15KB
                                                                                                                                    • SHA256 b3d98cab6d45ec45f7b189c50b617dd6d0d2d8fadfff733a9003b2d0f9cf7b9b
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Threading.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Threading.dll
                                                                                                                                    • Size 82KB
                                                                                                                                    • SHA256 3542f41462c500ca0b0512001a2a1f529f28b4ddbd260706d63ade42d427220c
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Windows.Forms.Primitives.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Windows.Forms.Primitives.dll
                                                                                                                                    • Size 2.9MB
                                                                                                                                    • SHA256 4b1ed31540a215eedcbaccba53945e6a7d523472189748d09612c92074a457e3
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    System.Windows.Forms.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\System.Windows.Forms.dll
                                                                                                                                    • Size 12.9MB
                                                                                                                                    • SHA256 5bc8b448b593d9c975b46790ff6f870db2ecb5a8698bab0dfe584f7148dff3ce
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    clrjit.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\clrjit.dll
                                                                                                                                    • Size 1.7MB
                                                                                                                                    • SHA256 fec1da303a5905090e00d15f3c30c1a6950048073415ba34b9f6659e9f3c57bc
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    coreclr.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\coreclr.dll
                                                                                                                                    • Size 4.8MB
                                                                                                                                    • SHA256 cdc9cad0b6683b4409332604ff557797b851722d027c09d3ab0eac2f37aa1bbf
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    hostfxr.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\hostfxr.dll
                                                                                                                                    • Size 358KB
                                                                                                                                    • SHA256 b4bae1174ef93ac8ee233bf4fb3caabc4a8bc66eecacd748dd76a745e1f08b24
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    hostpolicy.dll
                                                                                                                                    • Path C:\Program Files (x86)\WeChat\hostpolicy.dll
                                                                                                                                    • Size 397KB
                                                                                                                                    • SHA256 6313bf15c8465ebb62eb87a071c6778d86c2022855022227dc5c62d51fb8be81
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    SCT Auditing Pending Reports
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                    • Size 2B
                                                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                    • Size 115KB
                                                                                                                                    • SHA256 d6f63da425ec95276c89f4f56d21e38816526219389ed0a51e1df881399dfb3e
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    settings.dat
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    • Size 280B
                                                                                                                                    • SHA256 c0f239c7ed32f1c492df19d463edf2073ad4d721081b4a3b14c372062cca32ba
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    settings.dat
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                    • Size 280B
                                                                                                                                    • SHA256 ce9a45431fb053f46812395470c2ff6c9ccd1803075551fd01e4a51c3c4ecd4b
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Edge Profile.ico
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                    • Size 70KB
                                                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 a73a5bada03e61ff257f62cf9dc736dc3fe59f36d19b0f7f465f81e3954b287e
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 44a2b423242076a17140557d8e7b7d2698aea8e32edb7053a56d672176d14d7f
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    90df46bf-3452-47b8-adec-32a9353e4149.tmp
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\90df46bf-3452-47b8-adec-32a9353e4149.tmp
                                                                                                                                    • Size 147KB
                                                                                                                                    • SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    7d1eb28b
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\9872f0dc\7d1eb28b
                                                                                                                                    • Size 40KB
                                                                                                                                    • SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    DLL_{D1D9CD9D-4D33-459D-915D-50773522EC8D}.ini
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\DLL_{D1D9CD9D-4D33-459D-915D-50773522EC8D}.ini
                                                                                                                                    • Size 7KB
                                                                                                                                    • SHA256 bc864d4df59abc1493c24f64f8dab9b03b072f97e7d8935678dd90eefbda5082
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    81c46784-1c5b-4e8c-a127-c3ea43c326ac.tmp
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\81c46784-1c5b-4e8c-a127-c3ea43c326ac.tmp
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 a6b73d18d85e52eefc1ff14c3d9b5064723654f07ab3eb3095219604d0dd19a0
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    914db39d-2a3f-4cfa-bf19-c0545b1efdf3.tmp
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\914db39d-2a3f-4cfa-bf19-c0545b1efdf3.tmp
                                                                                                                                    • Size 17KB
                                                                                                                                    • SHA256 5c2a487bb9076bdda7fd9b1b10b380538b254f3319e893e95b96a71ed3593d6c
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                    • Size 72B
                                                                                                                                    • SHA256 0ae10003beb0f3af84bfc8c45814bb42299772a92ee1f7f700b734473443617b
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index~RFe59f1b9.TMP
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Code Cache\js\index-dir\the-real-index~RFe59f1b9.TMP
                                                                                                                                    • Size 72B
                                                                                                                                    • SHA256 766fccf1596c03ac7b5a6fe92c1403d16fe0b8e7128ef1adeee2af2c6014e4fd
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    data_0
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\DawnWebGPUCache\data_0
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                    Submit Download

                                                                                                                                    data_2
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\DawnWebGPUCache\data_2
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                    Submit Download

                                                                                                                                    data_3
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\DawnWebGPUCache\data_3
                                                                                                                                    • Size 8KB
                                                                                                                                    • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                    Submit Download

                                                                                                                                    dasherSettingSchema.json
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\dasherSettingSchema.json
                                                                                                                                    • Size 854B
                                                                                                                                    • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    service_worker_bin_prod.js
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.106.1_0\service_worker_bin_prod.js
                                                                                                                                    • Size 121KB
                                                                                                                                    • SHA256 dfd0ec0bc928d34168470caa909b172ce231abeec84c1c1a9f4fb56c5fc24bb6
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    messages.json
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                                                    • Size 593B
                                                                                                                                    • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    craw_background.js
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                                                    • Size 531KB
                                                                                                                                    • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Network Persistent State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Network\Network Persistent State
                                                                                                                                    • Size 59B
                                                                                                                                    • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Network Persistent State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Network\Network Persistent State
                                                                                                                                    • Size 1KB
                                                                                                                                    • SHA256 f9494311a9c884c0ddc56c85913dfd04a767a32261a25b64d268fe136dda2f6a
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Network Persistent State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Network\Network Persistent State
                                                                                                                                    • Size 1KB
                                                                                                                                    • SHA256 ac8cc7d732f72d3f8476741a5a198a88c765987f6571151c6b7f6574a13d793c
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Preferences
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Preferences
                                                                                                                                    • Size 9KB
                                                                                                                                    • SHA256 dd742e770589fcdd134904985e77da1266cc19bd3e8f64ba2c902dd4ab2f23d0
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                    • Size 120B
                                                                                                                                    • SHA256 8e22c24a142604fbaf4b9eb154f1e4754eee4485c85824ac263432f66aa46bea
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index~RFe5a0502.TMP
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a0502.TMP
                                                                                                                                    • Size 72B
                                                                                                                                    • SHA256 73a6c09a031a7cb3efd21c2d1d8bb409a3c1d72bb4fa35b79dfe6e40bd9bb782
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    index
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
                                                                                                                                    • Size 24B
                                                                                                                                    • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                                    • Size 48B
                                                                                                                                    • SHA256 10a8c1bc4eeea339aa34120092ce1a62293c67c3bf63689849e39ac5e3bf688d
                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                    Submit Download

                                                                                                                                    the-real-index
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                                                    • Size 72B
                                                                                                                                    • SHA256 3d899c27927aa57c0fd72c4423cdab9ad0ac096aee31776c8c1cf9dd6118b63e
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    data_1
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_1
                                                                                                                                    • Size 264KB
                                                                                                                                    • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                    Submit Download

                                                                                                                                    CURRENT
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Sync Data\LevelDB\CURRENT
                                                                                                                                    • Size 16B
                                                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                    Submit Download

                                                                                                                                    MANIFEST-000001
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Default\Sync Data\LevelDB\MANIFEST-000001
                                                                                                                                    • Size 41B
                                                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Local State
                                                                                                                                    • Size 119KB
                                                                                                                                    • SHA256 97cbafc2ec921f216c2eca8e2beb178c012a6f90ed80e795430e9cd2cb2450b1
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Local State
                                                                                                                                    • Size 119KB
                                                                                                                                    • SHA256 f1c6a84d193e66670739fa56efabcdc2feeb4285e4462457de3a9f0e4de0842f
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Local State
                                                                                                                                    • Size 121KB
                                                                                                                                    • SHA256 620b89ff713be3f47dd20245be6c6cb98fec054dd3c08e16055c3c214e37f054
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Local State
                                                                                                                                    • Size 121KB
                                                                                                                                    • SHA256 c1a6801e8604212c51292ae033320293acd9f4e0bf69b6b58bd6f054858e8691
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    Local State~RFe59ca4b.TMP
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\Local State~RFe59ca4b.TMP
                                                                                                                                    • Size 1KB
                                                                                                                                    • SHA256 a1958f0bd97426815000bdc5a814da56d95b63daa7c30c3eff41ab700966308e
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    c7143537-f2de-426d-aa43-d161140848d3.tmp
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\HeadlessChrome3032240754875\c7143537-f2de-426d-aa43-d161140848d3.tmp
                                                                                                                                    • Size 121KB
                                                                                                                                    • SHA256 2750b2f3f5405087d368f477fa7d3d4edf33d4ba02df62d1fb14f21deaf1923a
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    WeChat_20260531162636_000_MainInstaller.log
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\WeChat_20260531162636_000_MainInstaller.log
                                                                                                                                    • Size 35KB
                                                                                                                                    • SHA256 d6b966fc09789046bbd66f26c63617d6842db9904f78e70df0d260b4a55fe828
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    messages.json
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3032_1475396917\CRX_INSTALL\_locales\en\messages.json
                                                                                                                                    • Size 450B
                                                                                                                                    • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    product.dat
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{D1D9CD9D-4D33-459D-915D-50773522EC8D}\product.dat
                                                                                                                                    • Size 506B
                                                                                                                                    • SHA256 065d817596d710d5a06060241acc207b82b844530cc56ff842ff53d8ff92a075
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    MainInstaller
                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\{EE83096C-0C19-4216-AD7E-213274D00B70}\MainInstaller
                                                                                                                                    • Size 44.7MB
                                                                                                                                    • SHA256 0cc932d4240c5392e89747fb5de793b254cca8db085bad41211b657ab3cf86bb
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    MSID0E9.tmp
                                                                                                                                    • Path C:\Windows\Installer\MSID0E9.tmp
                                                                                                                                    • Size 487KB
                                                                                                                                    • SHA256 18ec3daeb006483e7d2f96f67338ec7b42853aea899fdfedac23c8d189fec5c4
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    MSID292.tmp
                                                                                                                                    • Path C:\Windows\Installer\MSID292.tmp
                                                                                                                                    • Size 511KB
                                                                                                                                    • SHA256 03d91c8cd20b846625a092a3dae6a12369930c65d6216a455a00449ebb0dc289
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    MSIE5D8.tmp
                                                                                                                                    • Path C:\Windows\Installer\MSIE5D8.tmp
                                                                                                                                    • Size 244KB
                                                                                                                                    • SHA256 4ab23609cdc64d10b97c9ccb285ed7100f55d54d983cd50762da25ecac4357f9
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    e586a71.msi
                                                                                                                                    • Path C:\Windows\Installer\e586a71.msi
                                                                                                                                    • Size 39.7MB
                                                                                                                                    • SHA256 e276bf8744f29c54c0a975d98e31e0229cf020bdbb9b8032731aa395b6421c33
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    BootstrapperApplicationData.xml
                                                                                                                                    • Path C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\BootstrapperApplicationData.xml
                                                                                                                                    • Size 2KB
                                                                                                                                    • SHA256 51b35df7b16837cac0541e6862f07f99b7a3bbc810c5b273019706d967d28b96
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    wixpreq.png
                                                                                                                                    • Path C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixpreq.png
                                                                                                                                    • Size 797B
                                                                                                                                    • SHA256 a401a225addaf89110b4b0f6e8cf94779e7c0640bcdd2d670ffcf05aab0dad03
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    wixpreq.thm
                                                                                                                                    • Path C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixpreq.thm
                                                                                                                                    • Size 4KB
                                                                                                                                    • SHA256 a00021ce3988e95b902e3e4b287a7e2e9bce19a1ad558e5fe62205bd0fe7bcf6
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    wixpreq.wxl
                                                                                                                                    • Path C:\Windows\TEMP\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixpreq.wxl
                                                                                                                                    • Size 3KB
                                                                                                                                    • SHA256 e63ed75b5fbb09c9bd90c9a3f240d5cab8f514eca1803575684416b5305ddd5d
                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                    Submit Download

                                                                                                                                    wixiuiba.exe
                                                                                                                                    • Path C:\Windows\Temp\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixiuiba.exe
                                                                                                                                    • Size 300KB
                                                                                                                                    • SHA256 702a7f4f960a81efda763a830ea1eb7fd485bd472647ef4c3250fec62022ee56
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    wixprqba.exe
                                                                                                                                    • Path C:\Windows\Temp\{EE83096C-0C19-4216-AD7E-213274D00B70}\.ba\wixprqba.exe
                                                                                                                                    • Size 432KB
                                                                                                                                    • SHA256 236934a5cc966af361e1a00021de15d4927b424b2efd8fc67dcbf9c88e3f2c62
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    WeChat.exe
                                                                                                                                    • Path C:\Windows\Temp\{EE83096C-0C19-4216-AD7E-213274D00B70}\.be\WeChat.exe
                                                                                                                                    • Size 1.2MB
                                                                                                                                    • SHA256 da338a4d024774b03453621a85951c3e25ce4b86345bb4b5d93df4617d74b280
                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                    Submit Download

                                                                                                                                    memory/1556-571-0x0000030141340000-0x000003014191D000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/1556-364-0x0000030141340000-0x000003014191D000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/2832-2047-0x0000000000010000-0x000000000001D000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-357-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-745-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-805-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-804-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-803-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-801-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-800-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-812-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-813-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-811-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-816-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-815-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-814-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-817-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-810-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-797-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-802-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-796-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-818-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-819-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-795-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-778-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-359-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-358-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-779-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-350-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-777-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-759-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-768-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-747-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-746-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-798-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-743-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-742-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-738-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-348-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-739-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-609-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-667-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-367-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-356-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-355-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-354-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-529-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-532-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-438-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-410-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-365-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-366-0x00007FF7E8B20000-0x00007FF7E8BEF000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-379-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-380-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-378-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-376-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-377-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-375-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-374-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-372-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-373-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-371-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-370-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-368-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download

                                                                                                                                    memory/3080-369-0x0000000750000000-0x0000000750133000-memory.dmp
                                                                                                                                    Download