928d544e79be10289013c00ab5358d4fcfbe80e86426cf7dca5e5e943865e611

Analysis

max time kernel
149s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cl2.exe
Size 32.3MB
Sample260805-pfxebsag48
SHA256 928d544e79be10289013c00ab5358d4fcfbe80e86426cf7dca5e5e943865e611
MD5 4e5c7d6821354382717986181f4f986c
SHA1 48d03c20cc99e3df001d91737f64fee9d59ad2e7
SHA512 622a00979366a6cea6050bffb9459b57c9f27364ddba027954ba3bc28ce7b148d0776d343efad7c43f15f201a69971d97bbc0620f5af2fd699aa3893707e383d
SSDEEP 786432:zZWYc2SmtcGA9PRcoNoZiHXzxUqVOwPAKSP:z7EZNI6XzxUqVOw5SP
TLSH
T1B9773317A28D733DE05A5A354862DD50543FBE61BA2E8CA3C6F43D4CDE3A4A10D7EB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4160	cl2.tmp
3860	clashmi.exe

Loads dropped DLL 22 IoCs

pid	Process
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe
3860	clashmi.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Clash Mi\is-9U47J.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\is-311BU.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\images\is-MDCBP.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-locale-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\flutter_windows.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\window_manager_plugin.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-J41RP.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-B032K.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\is-1S7BA.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-memory-l1-1-0.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-5RO39.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\packages\flutter_inappwebview\assets\t_rex_runner\is-PGUB0.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\unins000.dat	cl2.tmp
File created	C:\Program Files\Clash Mi\is-FQB2G.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-568UQ.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\is-LI22H.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\assets\is-B7ACM.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-convert-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\clashmiService.exe	cl2.tmp
File created	C:\Program Files\Clash Mi\is-V8PB5.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-QS4PL.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-FH7NT.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-2976I.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-2EU0I.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\packages\flutter_inappwebview\assets\t_rex_runner\is-4OQ9U.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-NG4KB.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-1FT6L.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-5P2T9.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-ANLP2.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\is-7KFM6.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\is-BA6B1.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\is-LIIHI.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\unins000.dat	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\protocol_handler_plugin.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\icu.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\vcruntime140_1.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\WebView2Loader.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-rtlsupport-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-util-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\url_launcher_windows_plugin.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-heap-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-math-l1-1-0.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-V68CF.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\datas\is-8AAIG.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-filesystem-l1-1-0.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-AATQO.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\datas\is-V7C8K.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\assets\is-VH2PG.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-QR933.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-processenvironment-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-processthreads-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-fibers-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-stdio-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-crt-time-l1-1-0.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-J2JBN.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\data\flutter_assets\assets\zashboard\is-0OT3O.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-debug-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-string-l1-1-0.dll	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\flutter_secure_storage_windows_plugin.dll	cl2.tmp
File created	C:\Program Files\Clash Mi\is-1VOA8.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-FES0E.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-9Q88U.tmp	cl2.tmp
File created	C:\Program Files\Clash Mi\is-GP6CI.tmp	cl2.tmp
File opened for modification	C:\Program Files\Clash Mi\api-ms-win-core-datetime-l1-1-0.dll	cl2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cl2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cl2.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5980-0-0x0000000000B50000-0x0000000000C5C000-memory.dmp	innosetup
behavioral2/memory/5980-8-0x0000000000B50000-0x0000000000C5C000-memory.dmp	innosetup
behavioral2/memory/5980-290-0x0000000000B50000-0x0000000000C5C000-memory.dmp	innosetup

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash	clashmi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash\URL Protocol	clashmi.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash\shell\open\command	clashmi.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash\shell	clashmi.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash\shell\open	clashmi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\clash\shell\open\command\ = "C:\\Program Files\\Clash Mi\\clashmi.exe \"%1\""	clashmi.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4160	cl2.tmp
4160	cl2.tmp
3860	clashmi.exe
3860	clashmi.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4160	cl2.tmp
3860	clashmi.exe
3860	clashmi.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
3860	clashmi.exe
3860	clashmi.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3860	clashmi.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 4160	5980	cl2.exe	89
PID 4160 wrote to memory of 3860	4160	cl2.tmp	92

C:\Users\Admin\AppData\Local\Temp\cl2.exe
"C:\Users\Admin\AppData\Local\Temp\cl2.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\is-Q9B81.tmp\cl2.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q9B81.tmp\cl2.tmp" /SL5="$502AC,32660639,1035264,C:\Users\Admin\AppData\Local\Temp\cl2.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files\Clash Mi\clashmi.exe
    "C:\Program Files\Clash Mi\\clashmi.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:3860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService
1⤵
PID:2940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MSVCP140.dll

Path C:\Program Files\Clash Mi\MSVCP140.dll
Size 562KB
SHA256 9057d39b36b6c7d054865ee2bf9cde7a490fe3b01ec4e82514687e24f576269f
MD5 cfdf6eaf5328fecbdec268b7f9e21f3a
SHA1 100c8a08de6544b8554a542ad55af831f86565e7
SHA512 a81feb56ae3e4939abb21597f4f60429b704e04e6c20fac402a0518fe7b29606bf8824347a7570d98f3c44684c15bf6b520e350321bfc2a42ec5597989215782
SSDEEP 12288:N9W8APqgSqvJP85TAv/kLRNKjxDJN7e12QEKZm+jWodEEVx7/:NPW9ILRwjxD62QEKZm+jWodEEb7/
TLSH
T1ABC40823B74D05E0E195E3B8A1878306D7F1BC4A8312A3C792EAD69D2F577D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Clash Mi\VCRUNTIME140.dll
Size 117KB
SHA256 da72e6677bd1bcd01c453c1998aaa19aeaf6659f4774cf6848409da8232a95b2
MD5 943fc74c2e39fe803d828ccfa7e62409
SHA1 4e55d591111316027ae4402dfdfcf8815d541727
SHA512 96e9f32e89aee6faea6e5a3edc411f467f13b35ee42dd6f071723daeba57f611dbd4ff2735be26bb94223b5ec4ee1dffedf8dc744b936c32a27d17b471e37dcf
SSDEEP 1536:R9TXF5YXWbj8qr51XlN+dULTCe1IGhKWyxLiyaXYaWEoecbdhUoTtHez9FazR:REnsvReGsWyxLizXFCecbd1Tt+i1
TLSH
T168C37C8572A002FBD17AC274C1A36A17FB75B94487A0A7CF03B58A660F53BE09E3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Program Files\Clash Mi\WebView2Loader.dll
Size 162KB
SHA256 1d963a02d8a7fa3e7eac2e936dad5559c4d63327f35b0a09787ffc1d58f9c18d
MD5 0ad9319fa14d39c0812583337546ca20
SHA1 0a76b27dc44f46756984a7a5f93f9a9b024aedb5
SHA512 01bfb6516ea8d2347863fdf6de7ce1bc598d0798a7a388a0b4478a8be4bad66362185f366ed52adb19008f518c05fbaedf46268051bbf26e448e23b017af669f
SSDEEP 3072:RbAne8TlTRTSpL1ThTNTRyMDjRb/hy75HGRtVBviiZsZ5AalCPTOCEtJxWPg8EhJ:RbyTlTRTUL1ThTNTRyeLq1GRtVBvPZsd
TLSH
T1FDF36C5776E8007BE06B8274C9A34A11E777B4510760ABEF03A447791F23BD4AE3EB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clashmi.exe

Path C:\Program Files\Clash Mi\clashmi.exe
Size 464KB
SHA256 a85db799c08feeab73d00a5fa3bb03c314266eb7a003bb528abf807977ef5709
MD5 134931a775db306d68768ec49f689349
SHA1 4a1a4298cee353d7755ec4ebe9188f76b08f0527
SHA512 1e20c2984e0dcb873b9c7694101d1b9731decda1032c0f47c4a96e9fca22274d959635c78959c3db84baac52cd7a6121af35bdd6803efb5c857d5e25b6723f42
SSDEEP 6144:i+1Wue6j6rbKlE1oqMZHuAx9yHthFf2z3WkWQ5ip1G/RgQxrXgbngzB65sUxsbAU:Ze6j6HtfG/RjLzB65sU+KbPUCk
TLSH
T129A49E59A2416D98FA27483CC9F69AB0F8637C0DBB91E9C7076079E91E37DE80739211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

clashmiService.exe

Path C:\Program Files\Clash Mi\clashmiService.exe
Size 33.1MB
SHA256 3783d4e4c691377ec98d0b7a351b2afd35c2350bed5fdb76edf35d00e441b5ef
MD5 d898de008bd76ce40ac0e2ee4056f1d8
SHA1 ad20efccf281acc8e86f9d2eda99a5a28e5f0573
SHA512 676c33f75ce32c2589d0c5d954a655fa0b84063a3175424c711d030d88b2957e24989f23d372eaa8c5d6811598ff5d54bb0fda2ea2001a6d8d7f059a9a5e52d1
SSDEEP 196608:3ulAgX3O+ldZuelEamTCtHzAdqpTYskykf6yIi0orao63ZZogKq:3ngX3OEus0dqpcpaN2
TLSH
T151776B47FC6549E4E5E9C538C1A69213BB707C598B2523D72B60F7282F7ABD06EB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\Clash Mi\data\app.so
Size 10.8MB
SHA256 39a0149b40c4a5708fdeb7460e2bcde2cd115ada69d5b95d46540455d34fa14a
MD5 bda9505d95c3caa9f45dd30bca48a6c3
SHA1 8aa538babf28fa29b69d8e3436a0f959434ca161
SHA512 d9730ea5e5ec56e3abff9eb026d880d9d6f283b70aacc0bf8676950d8174fc639ce74ee294909412626713f84ce450f7982035d0b50ebdfa31103b625a52c278
SSDEEP 196608:LXvpTYBmQaTWac7UQ5jnNQ6KGJDreV/YBUUU76:LXvpTYBmQaTWac7Uu7UUe
TLSH
T18FB62A47D0E547A0E472E772B75F6AA69E24B8CC4E30778A07C45A653D87CE04ACE336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\Clash Mi\data\flutter_assets\FontManifest.json
Size 272B
SHA256 2a3edae87ed90a84c84581f0bf5cd41f894a92f3139f772b5ff21f0bdef9c4c7
MD5 cff86ecb3bd8891ac22685eabcfa754c
SHA1 f2c9153d38015c8fab71b0ea7426ec1dd6f4d506
SHA512 00f7f02f50dcf1e1e15127dab2297b7f6a16ef79fcb5a972e32a62895d4771e1fc6d957f2e2abffddb3016c47553c96548fbf597e83bb90b1573bb8edd6a6658
TLSH
T1D4D0120F58190AF5458C8845F0E61293BC5429466A8AEC8EE3A40E94E7B12651739277
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\Clash Mi\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

ASN.mmdb

Path C:\Program Files\Clash Mi\data\flutter_assets\assets\datas\ASN.mmdb
Size 10.5MB
SHA256 e07682cb2e1263c5555834cafd8aeecea3aa749e071a839eacebaab3581fe1b1
MD5 43b73c6241a980d6b77b05c41ed79380
SHA1 f4513ae4da6736dc8e0d9efb73a423bf62ac6f3b
SHA512 8294d60afb09cbe75a62bee419a36af58a21455c961ad143c0432db276415585d3465b57ea7b5c7308997d5b5bd71379d91c54934070120f87f4e0849c9f70fd
SSDEEP 98304:5DMkLQl32xn3DtP7+jku8rRFIw8bkfJ+lqhdV7/0kjoMp0VNF:5D5D3hIP8laBwfwlU7et
TLSH
T19DB6BE13A9D1D442820E01D21F94FDA3E199188EEA6EFF566E7D0C70A9CD03BD61DEE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geoip.zip

Path C:\Program Files\Clash Mi\data\flutter_assets\assets\datas\geoip.zip
Size 3.7MB
SHA256 975b784fad8bd8c293914092b5a8c186a783dcdd92e14b0dedbe2740515a75e3
MD5 b55f6362308d49fa87b690d3f8d75d3b
SHA1 a8829322e30b710724a3f4c790255d8285466ec1
SHA512 f5951b65895ed777833bd98d037e15174671693f873d50bdc04f5df819e271309c52995152189efdba54016fb92c15aed0f8ca0a4c4059bf8c934bd3d871f39d
SSDEEP 98304:ZvSc+7LO/Olp3o2l18uJv3nznRBdcSGP1+tmmK9D+36:xT+7LOAlF3LJvznRBWSGN8bwj
TLSH
T16806239AEC7E9D06E279D23C914636FD02F66894AD11C0CA77A9B10056FFBF5281C32D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

geosite.zip

Path C:\Program Files\Clash Mi\data\flutter_assets\assets\datas\geosite.zip
Size 1.7MB
SHA256 0ee249036bbee7492e27fbe989d36b01ed9e2b55f4d79ec8adb66ae084f762c9
MD5 96b2d93d6bcc6e83868fa2592d68ac29
SHA1 f85efc224357219e7bee98c3612d7bee5f4dabc5
SHA512 629f47f363a2903b265fe4e1f02139d5df2547c5e5dad9333fe7fbe022a644af9a01b5fd9a5612ba3ad8c56384fd0d3ec1ae1a0516a1a19db5820cba31b68fff
SSDEEP 49152:bd4V26CVlXuGWmTx+U/0WT35+Nq3+Y8pE3J:p4V2fVFpWA+UbYNq3z8G3J
TLSH
T13485D07ED2EB2A45C23987B46087966EB774B05B0A30C64F45E533216CDB7724EA432F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

grey_tray.ico

Path C:\Program Files\Clash Mi\data\flutter_assets\assets\images\grey_tray.ico
Size 201KB
SHA256 7d7bf89824f63c20883006b2fd9a290a365590de8b3e8cb61518d42f9662b246
MD5 6ccfe34761cc9b66eea8761c20505d6e
SHA1 6440a7b2d68258ce17567883c34be2c9a939a037
SHA512 ae1a2455ec1e381f53fc052989cf8f75869a697d4604db503b42967e7a86cc37c7ad73f1846fbf95843f1c55ba8305e96dc22d8c096f2dbfb642b170d3b1571c
SSDEEP 1536:hDq0OMnGxgeqZ8zoT3MeGDgzrdHe55xl0:MMIgllGDSHsD0
TLSH
T1481473515AEB41C4C8F2CCF2626A54F1E37DB0FA4BFD84AB294CA515848C9C78D4FA9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\Clash Mi\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\Clash Mi\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Program Files\Clash Mi\file_selector_windows_plugin.dll
Size 109KB
SHA256 ee312f4e672a57f2016845f119f5dc4601ffbd41ab80b37449d65a93261236ac
MD5 b6347e544e65687f77f70bf2e69bc725
SHA1 0c188b8f9896c1991cec1345000b75fb4c3f0f2d
SHA512 c289561005deba4713f8df88a025dbb76a840413f51de106dbe8aec9249f564c6910e3853c960d4cb17a7e26ec3981a27178da40a356bec2d145edd1f914b385
SSDEEP 1536:IBXrl+wCXtRGN1jl/nHu9kxFnKxpm61ab6ho1uCpVMfZGrxe+5:cblHCKHueFKq64b6ho1J7MfZGrxe+5
TLSH
T124B31B2BF61D40BAE26AC47CCE539901DB72B8954790A7CF57900ADB0E67BE45F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_inappwebview_windows_plugin.dll

Path C:\Program Files\Clash Mi\flutter_inappwebview_windows_plugin.dll
Size 1.1MB
SHA256 6570c83b098013bda40aeeef6c7fa4c6f4ab869903547e8b62f3a2f920d26c7b
MD5 7101640ac4bd15434ec5037f1fd6bba2
SHA1 8aeb4b511626746fa24906e1800dba04095df138
SHA512 f6c730b133624c6bab48c11bf201b6d5158d8dce912766df7b6e7349d9efd035886d77ce7cec103d707a7dc323a9037890b67b8cd2f3c195ff092ea08473b389
SSDEEP 24576:eEUhwXy/JFW/B0dqBMf3duNu7v/6nhXhxchAxCMpZGkdj4bu:eEUhy0d5du478hXhcMpZGECu
TLSH
T167455B2A775D00A8D0BAC2BC8EAB8A95E7B2749607718BCF16D0470E3F677F44D39611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_secure_storage_windows_plugin.dll

Path C:\Program Files\Clash Mi\flutter_secure_storage_windows_plugin.dll
Size 156KB
SHA256 3122212d6b01f65a7dec38c84544dfb616b6cb43d5828bc2a0482f37254d19d3
MD5 01f69dd2797208cac53d23df35a9d59d
SHA1 f404cff733e31995893ee494e2f741f67e27934d
SHA512 fb231e6a4b93b8f144ced450e9701bd078e2f0f470fda678854b3222814ad094c109a9d6b92fe532c4a9997c3c7ddf4a7af8dcc7983deddeab26d22805a77e6f
SSDEEP 3072:K/YxFHBz7zLNk3gjlYuWVnB80oN6qa7SVqPVBDcUIDMAWrd47bCZ:K/YvHBflk3g5YuWVnB26qnDMAm47bCZ
TLSH
T1CCF34C27B759007AE266C1BCCA834A52E7737C454761A7CF07914BBA0F27BD86E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\Clash Mi\flutter_windows.dll
Size 19.8MB
SHA256 86022babe7b66785ad5aad2184aa348720f2eb951a97bfcc45f10f40f4336e49
MD5 da2b0c4031874597ff5148a60b345c05
SHA1 c70370e0037319da4a7deeb96005b93e6017acde
SHA512 1c854459388f9cd1b1433e2bcc29ec2b5cbca53fb4125b4d8671429acd71dfeeef844541efb141a431fc585f84988133062b0f5f680c661d5f8b76c548695c01
SSDEEP 98304:YKfW27f/6x7PosWp61UwcYRdKcgH0Blvgj3IGwdseNTKdfuFdoSo8e0M1dz+8mHR:Y+c9bdKcWc7mJz+qQ8ThTACM9aW
TLSH
T117276B03F29640ADC45DE178971BAA27F671B8490720B6DF27984B223F66FE05B3E750
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hotkey_manager_windows_plugin.dll

Path C:\Program Files\Clash Mi\hotkey_manager_windows_plugin.dll
Size 104KB
SHA256 fb5c62458270f65adbb4f77af32f1b8c1ad4429ca33b0ff534080670328d48be
MD5 d698b636e3ab1b0a14767cec317d9375
SHA1 8ed4ffd1a4d3e7f71e9fcf01babcee9eac76c706
SHA512 ca9b2fb18f26c2ecb18a302afa615e177320e16fbec94d5fdfffbf5ae0d4d7493666cff70274c3bcf7aa896ee816e8678b372f55942c008dec44312044dbfcea
SSDEEP 1536:yiKblVJQryWHrgI16uBxFc+YZOHn2aMuOOYyicuT:0bpEgO6SO+YUH7MuOOYyic
TLSH
T192A3293BEB6D50ABD26AC57DCA474945DB71B88107A1A7CF57900B9B0F17BE80E3E600
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libclash_vpn_service_plugin.dll

Path C:\Program Files\Clash Mi\libclash_vpn_service_plugin.dll
Size 105KB
SHA256 d2dd6f489762ab72176bf20dd843639d4c8b45b7984cd868fe12bb91b01007bc
MD5 29a86a59acd2f2c0d6c9eecd661bf391
SHA1 4549bb90d21a07e225120f7b1bc84195a2403118
SHA512 58002834c2f325db652fbe1474974ea373511154994270f51188f9dee244e27a2c476a6a6da188d5bcd6015a9660d183cffe8eddf3c10e8a96e80ec7b303a906
SSDEEP 3072:XgMVordyT8LguCh6BOJnCNRf2R5M8jCjGkOW:XgMordPLghh6BKR5M8jCjGkO
TLSH
T14DB35C2BBA1D40BAD269D47CCA578912DB72B8C507A197CF17900A9A0F23BF45F3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

open_dir_windows_plugin.dll

Path C:\Program Files\Clash Mi\open_dir_windows_plugin.dll
Size 84KB
SHA256 d8f3a47e37ea8bb5993b07ad6387d52d94bb200fdcecadb33c19325bf550c82f
MD5 a53934ab95bd74c2fd9d1c9944302a1a
SHA1 4e76c8d9032547100daee650fa66127c699e8bb7
SHA512 e44bf642c3c79062568ed8d4ee2dfb00b26d355edb3cc647101fd6c2c558f69814dcef62ee716ca3372feccd1bd47d8efdc0a569f1c83e4b94507c149827377f
SSDEEP 768:VHB5Hsa9kqft3Axx00M/6mwAPWxd4ULuO1RwFO4tPOsfIAUPBh7M8111cYdqzkw:v7xpAK6j9xdpgBOKwh7M8111cYdqww
TLSH
T1EB831A2BFA1950ABE219C879CE834945DB72B8954BD1A7CF57500FDA0F27BE44E3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocol_handler_plugin.dll

Path C:\Program Files\Clash Mi\protocol_handler_plugin.dll
Size 95KB
SHA256 d863d5aee48d77ad7e8ebaf93f8fe25a29a05d6aeb0615e6e737cabf97d28def
MD5 5416e2fac73d9e2bd21dbef21b2974b9
SHA1 596a4d7d3caa561b8cf103e874c62588a7c3cb28
SHA512 d5574ada95ee92da9a5cf23d5d452be80fee49b855982dc00bd7ab6a0e6c8bb516d2a8701e3fc727ea98e7748b72ea8adbb433870076e79680e09cfdfbb5770b
SSDEEP 1536:zJRVlgpVv6NfbxyBDZdNrK7ssTZIMpZJ+CbZyanDE/w:zzAp16rcrK7ss+MpZJ+CbZya
TLSH
T1DBA32A2BF66D509BD22AC47CCE538905DBB2BC954791A7CF5B500A9A0F17FE80E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_capturer_windows_plugin.dll

Path C:\Program Files\Clash Mi\screen_capturer_windows_plugin.dll
Size 104KB
SHA256 435aba44aad5191f964358d1ea352af746183014a9e0790cd32d0b5c50f95185
MD5 1e7ea4cd30e5e453ba11c2d8f72c1000
SHA1 2fb81a24af8cb5bda2a71775b439c26619b4771f
SHA512 37e975f6989d9e575a002b242b7c1f9acf26dd0b059ee3dc4ab28be709a3db4c48da1a5b35a0da0d7b94a313583318bd2a1cfd7f9291cc32babef1651d32b05c
SSDEEP 1536:pzcDtne6K4n6ft2xDbpWgwsRSTNYCQNM8qo41/f+C:ZSein6IJwsRk2CQNM8L41/fb
TLSH
T1F7A34C3BB65D40AAD25AD5BCCA834A06DF71BCC14761A7CF07914ADA0F27BE44E3E211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\Clash Mi\screen_retriever_windows_plugin.dll
Size 116KB
SHA256 87a83fcb131658715c391ed6d9a0a6496bd2c38375d0a548bffdd0527cdf76ca
MD5 4022abddc0e090988c72570b60b89130
SHA1 3d53ad5eb66c1b340592dde197f9217394ca8457
SHA512 d13fc77172427e9d0070692107c18fd57f9c8e1d88639e2dffc48fbde8da2695ce3f990afb3f6e510e55c3e26c853dd06ae6a30a597ac9054eeb02ea5b541556
SSDEEP 1536:80sILOR6ScJJsKeRcz06Z7xS+kI3hhrSoqz1wKnqMp+eCZA+SHvD:80DOcOw063KaGoqvqMp+eCZA+s
TLSH
T1FAC33C2BF75940A7D26AC4B9C9438D46DB72B8914791A7CF57900A9B0F27BE84F3E301
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\Clash Mi\share_plus_plugin.dll
Size 131KB
SHA256 851318b4cc2774b899a5ae030e42479685e420ffb0bb0f0b1b18c93eb07b9455
MD5 c899be5c7a8ba223ba7873a75505859e
SHA1 55ea82c02d569fcbd7b37f7ce8088c7cdfd442ae
SHA512 0ea9d1a0d6d28ade82c22a3aeeef61084cf0560cef65454f26d23ad450b17dd2d14f7db4a02a56077172c7c9a11509a064c89b8f5581745373cf8478da385dc6
SSDEEP 1536:4pNAti4ITRKMG6JtkxhIVCPv50ajBOGZhMfT45AxYMUvRn5k6f/U/0e/5Qe+WP/Y:4pNRqR6wuVCPvCajBOGZhMfT45AtKz
TLSH
T18FD32A2BBA2C40D7D12AA079C9438A45D772F8A74F9187CB27510B9F4E67BD84E3A311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tray_manager_plugin.dll

Path C:\Program Files\Clash Mi\tray_manager_plugin.dll
Size 105KB
SHA256 9691fcaaa860d4e2716c4c53764eca1cf49a9fbea445b1560fd9d3c0084b3135
MD5 069ab1976e2e0dcb9237346320fa3baa
SHA1 ca5754efffc47c82fe936153cc172571d8f2b65a
SHA512 ac474108e75f09d15ee0fda1284eb25b8cb29e6f6ae261135ad32da3abc3c76c631c6567e799d5f60f667b4d534beef155a5c5ab745680c0c1723c1b46b397d0
SSDEEP 1536:y+aiLhJu6wZlo1fV3Uk6Relxh8Cz28k/uovpZJHCDPr0zPR:siF9fV316UhP28k/uovpZJHCDPr2
TLSH
T1C8B33C2BAA5D506BD26AC4BCCD534945DBB2BC8547A1A7CF57800ADB0F27BE40F3E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\Clash Mi\url_launcher_windows_plugin.dll
Size 96KB
SHA256 3c299fe37ff38f13e4482425cd295b2a14c8461df7cb665f34c8942b05ecfb09
MD5 ddb31e1019c4477ff1be6bb747a74fef
SHA1 36479cd35bdb1472d1430fe929e436988bf2a6f8
SHA512 7fc5a6ff5a201dd336a63e1aaeaea7c57066dba3df2499f09abc7f022128ec440d1009c8a15a9765d47314c3e16b062a9919b7950be1b2fe71eb68556982025e
SSDEEP 1536:CGpZitz94mzC4vYxKjWM6KbzyI3q6t9LVPMM8xVpyO2F1:Ckmz94kC4AM63WrheM8xVpyO2F
TLSH
T144A33A3BAB1D50ABD259D4BCCA534941DB72BC854791A7CF17A00ADB0F67BE44E3E202
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\Clash Mi\vcruntime140_1.dll
Size 48KB
SHA256 26e470b29bed3d873e0c328186e53f95e9edbfe0b0fd0cda44743a0b1a04a828
MD5 05052be2c36166ff9646d7d00bb7413f
SHA1 d8d7c4b322d76e3a7b591024c62f15934979fe40
SHA512 0460cc66d06df9a2941607473f3eccfd909f2adab53a3328fadcedd1b194b388eca738c2c6c2e193de33606925fbed1fe39efa160015128e93f5e3a03c62170d
SSDEEP 768:qzzO6ujT3MbR3v0Cz6SKLq83yN+iRxw9zv6JmEpw9zF:3q/o1j3c+iIzv6JmEp4zF
TLSH
T181236B9417784482D4AB99B0C0DBEF577D7CF6964750A28F0BA0D1981F237D0EB3D21A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\Clash Mi\window_manager_plugin.dll
Size 128KB
SHA256 5d9dc0823f5092bcfbbab15db2eca2173e928946d6b80519dbbf7d43d92892c5
MD5 770d061ac480984ec09c1f606cceef33
SHA1 5519418e1358f1d9b4f07e1b46eba835df13db16
SHA512 4965d8bb30fb002909251b5adea233154ff495b5a77def5b7af063166eaa9b84ea4a1c691abff72b8a49389870cc61a2d51d9ba93a9ac30ece58f92b96d9b393
SSDEEP 3072:EOjr9e6oFo76TLaowZGMWvpZJHLT1HfbV7:EOf9e6oI6TLGWvpZJHLT1HfJ
TLSH
T148D35C2BF75910A6D26AD4BCC9534946DBB2B8850B91A7CF07904A9B1F23BF45F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

windows_single_instance_plugin.dll

Path C:\Program Files\Clash Mi\windows_single_instance_plugin.dll
Size 82KB
SHA256 a99f49008a1029c7dd20a81c9e367b3f1197c72e608b6221cf16ed1b30bf5551
MD5 631b2a4804efa389d6d3992a69efb52f
SHA1 84cc2ceecf3a28bfbfda2e312d906109476e08fb
SHA512 8b5e765474d13e63ac6f3bd1ef22f55fb6f961eb6406df77522e2348ffaae34d74b37166167dac37758174f4cbd9692d86924fc457b661ab3d211aee94de4477
SSDEEP 1536:h+cw5g6wyxxLEkABkBSdMsZzisXy5vAq1DMEyr/:h+15g6hpAlvXGvAq1DMEyr/
TLSH
T167832A2BEA1950ABD259C8BCCE934905DB71B8954BD1A7CF57500EDA0F67BE80F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cl2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-Q9B81.tmp\cl2.tmp
Size 3.6MB
SHA256 ea399c6ff365895aaacbdf755fb4682b9665196ef6834d5afe9a5ad26210b5d7
MD5 29dd5346eca71d2d22f6e8e6a06140ce
SHA1 f62c76da7b257647278bdcdc01e432401bacf01e
SHA512 bc243f55a819f9a5b12ca2689c9d537b79bd5d34ded0ea3a85c0f5569351bea59ddd89dc3dd5592d8660df8b9fa5702b6ae12f750734e7e27a0f12413421d594
SSDEEP 49152:y6RlZSDcbZsSNFZnpZv4sxNhdaodRl4FHKBCb333mCoA:y6RHzbv4sxNhnrl5B+333mS
TLSH
T154067D13F385603ED05B1A3A79379695983F7E2079128C579BEC3E8C8F752812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3860-297-0x000001AF8AC60000-0x000001AF8AC61000-memory.dmp

Download

memory/3860-328-0x000001AF8D6E0000-0x000001AF8D714000-memory.dmp

Download

memory/3860-298-0x000001AF8D770000-0x000001AF8E245000-memory.dmp

Download

memory/3860-301-0x000001AF8AC70000-0x000001AF8AC71000-memory.dmp

Download

memory/3860-299-0x000001AF8D770000-0x000001AF8E245000-memory.dmp

Download

memory/3860-300-0x000001AF8D770000-0x000001AF8E245000-memory.dmp

Download

memory/4160-12-0x0000000000D10000-0x00000000010BE000-memory.dmp

Download

memory/4160-149-0x0000000000D10000-0x00000000010BE000-memory.dmp

Download

memory/4160-9-0x0000000000D10000-0x00000000010BE000-memory.dmp

Download

memory/4160-10-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download

memory/4160-6-0x0000000002E60000-0x0000000002E61000-memory.dmp

Download

memory/4160-289-0x0000000000D10000-0x00000000010BE000-memory.dmp

Download

memory/5980-0-0x0000000000B50000-0x0000000000C5C000-memory.dmp

Download

memory/5980-8-0x0000000000B50000-0x0000000000C5C000-memory.dmp

Download

memory/5980-290-0x0000000000B50000-0x0000000000C5C000-memory.dmp

Download