be33880e7f64a3529579edc40da2eb7348a0460ec048d06ad7bf280e93962fae

Analysis

max time kernel
600s
max time network
608s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-fr
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Forum Sina.exe
Size 63.8MB
Sample260827-ve2wbaad95
SHA256 be33880e7f64a3529579edc40da2eb7348a0460ec048d06ad7bf280e93962fae
MD5 99b87d924c29410ebf336016ca6265a8
SHA1 831f47e7c22303fac1e0b112056a4916001c0d5a
SHA512 622aaf3a70d7f66c02f2d3120959e1c0753b54f81cebf259c78cedb9378e92eb45cda8d44915b9b21f5efcbb7eaacc14e01ac3bc519869ae08d34d10cb1f7002
SSDEEP 1572864:bPfnH9OGDy9f6fYXr5ePianz6cacdDuajbO/b9xg5:znH5mJyYiiaecacdDoDjW
TLSH
T11AE72356E2FD00E8D5BBC0B8C6575517EBB1345917309BEB62A48A692F33BE06E3D310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Loads dropped DLL 4 IoCs

pid	Process
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Forum Sina.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 28 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1397331087\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1997841800\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1281170004\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1281170004\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1281170004\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1281170004\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1369467533\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1369467533\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1997841800\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1997841800\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1997841800\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_2025402459\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_2025402459\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1397331087\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1397331087\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1997841800\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1281170004\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_2025402459\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_250667837\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_250667837\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1369467533\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_2025402459\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4888_1836241191\manifest.json	msedgewebview2.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
6008	msedgewebview2.exe
6008	msedgewebview2.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe
4768	Forum Sina.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
816	Process not Found
816	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe
4888	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	Forum Sina.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4888	4768	Forum Sina.exe	88
PID 4888 wrote to memory of 4264	4888	msedgewebview2.exe	89
PID 4888 wrote to memory of 3300	4888	msedgewebview2.exe	90
PID 4888 wrote to memory of 3300	4888	msedgewebview2.exe	90
PID 4888 wrote to memory of 3300	4888	msedgewebview2.exe	90
PID 4888 wrote to memory of 3300	4888	msedgewebview2.exe	90
PID 4888 wrote to memory of 4244	4888	msedgewebview2.exe	91
PID 4888 wrote to memory of 3500	4888	msedgewebview2.exe	92
PID 4888 wrote to memory of 3500	4888	msedgewebview2.exe	92
PID 4888 wrote to memory of 3500	4888	msedgewebview2.exe	92
PID 4888 wrote to memory of 3540	4888	msedgewebview2.exe	93
PID 4888 wrote to memory of 3540	4888	msedgewebview2.exe	93
PID 4888 wrote to memory of 3540	4888	msedgewebview2.exe	93
PID 4888 wrote to memory of 3540	4888	msedgewebview2.exe	93
PID 4888 wrote to memory of 3540	4888	msedgewebview2.exe	93
PID 4888 wrote to memory of 1636	4888	msedgewebview2.exe	94
PID 4888 wrote to memory of 1636	4888	msedgewebview2.exe	94
PID 4888 wrote to memory of 1636	4888	msedgewebview2.exe	94
PID 4888 wrote to memory of 1636	4888	msedgewebview2.exe	94
PID 4888 wrote to memory of 1636	4888	msedgewebview2.exe	94
PID 4888 wrote to memory of 2424	4888	msedgewebview2.exe	95
PID 4888 wrote to memory of 2424	4888	msedgewebview2.exe	95
PID 4888 wrote to memory of 2424	4888	msedgewebview2.exe	95
PID 4888 wrote to memory of 2424	4888	msedgewebview2.exe	95
PID 4888 wrote to memory of 2424	4888	msedgewebview2.exe	95
PID 4888 wrote to memory of 2832	4888	msedgewebview2.exe	96
PID 4888 wrote to memory of 2832	4888	msedgewebview2.exe	96
PID 4888 wrote to memory of 2832	4888	msedgewebview2.exe	96
PID 4888 wrote to memory of 2832	4888	msedgewebview2.exe	96
PID 4888 wrote to memory of 2832	4888	msedgewebview2.exe	96
PID 4888 wrote to memory of 6036	4888	msedgewebview2.exe	100
PID 4888 wrote to memory of 6036	4888	msedgewebview2.exe	100
PID 4888 wrote to memory of 6036	4888	msedgewebview2.exe	100
PID 4888 wrote to memory of 6008	4888	msedgewebview2.exe	101
PID 4888 wrote to memory of 2180	4888	msedgewebview2.exe	102
PID 4888 wrote to memory of 2180	4888	msedgewebview2.exe	102
PID 4888 wrote to memory of 2180	4888	msedgewebview2.exe	102
PID 4888 wrote to memory of 2180	4888	msedgewebview2.exe	102
PID 4888 wrote to memory of 2180	4888	msedgewebview2.exe	102
PID 4888 wrote to memory of 5356	4888	msedgewebview2.exe	103
PID 4888 wrote to memory of 5356	4888	msedgewebview2.exe	103
PID 4888 wrote to memory of 5356	4888	msedgewebview2.exe	103
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 5000	4888	msedgewebview2.exe	104
PID 4888 wrote to memory of 3092	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 3092	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 3092	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 3092	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 3092	4888	msedgewebview2.exe	105
PID 4888 wrote to memory of 5004	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 5004	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 5004	4888	msedgewebview2.exe	106
PID 4888 wrote to memory of 696	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 696	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 696	4888	msedgewebview2.exe	108
PID 4888 wrote to memory of 4936	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 4936	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 4936	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 4936	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 4936	4888	msedgewebview2.exe	109
PID 4888 wrote to memory of 5372	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 5372	4888	msedgewebview2.exe	110
PID 4888 wrote to memory of 5372	4888	msedgewebview2.exe	110

C:\Users\Admin\AppData\Local\Temp\Forum Sina.exe
"C:\Users\Admin\AppData\Local\Temp\Forum Sina.exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=CalculateNativeWinOcclusion --enable-features=MojoIpcz,WebRTC-H264WithOpenH264FFmpeg,PlatformHEVCEncoderSupport,DesktopCaptureMacV2,WebRtcAllowInputVolumeAdjustment --enable-hardware-overlays --enable-webrtc-srtp-aes-gcm --use-fake-ui-for-media-stream=false --lang=fr-FR --accept-lang=fr-FR --mojo-named-platform-channel-pipe=4768.2004.4296157526840887389 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView /prefetch:4 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0xa4,0x198,0x7fffbe025fd8,0x7fffbe025fe4,0x7fffbe025ff0
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:2 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:3300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2408 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:3 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:3500
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=3352 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:3540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=4032 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=4184 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:2424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=4332 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=832 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:6036
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2156 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=4324 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3548 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=1080 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=5152 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:4936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4492 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:5372
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=828 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /prefetch:8 /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb
    3⤵
    PID:3368
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView" --webview-exe-name="Forum Sina.exe" --webview-exe-version=1.0.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --use-fake-ui-for-media-stream=false --disable-gpu-compositing --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=fr_FR" --mojo-platform-channel-handle=5156 --field-trial-handle=1800,i,17457032261805855673,5987045790272929445,262144 --enable-features=DesktopCaptureMacV2,MojoIpcz,PlatformHEVCEncoderSupport,WebRTC-H264WithOpenH264FFmpeg,WebRtcAllowInputVolumeAdjustment --disable-features=CalculateNativeWinOcclusion --variations-seed-version /pfhostedapp:a78602c64a893258eff9963a986f97f45d8dddbb /prefetch:1
    3⤵
    PID:604

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6f16da89c6ae54a744e92557520c4c1686e965ed6f4015859de222db947fad32
MD5 b9cd2cb6ccb505740ed0e8e9c947266f
SHA1 72a3907740d5858bb7ff39dd06e2b99389d6c9a2
SHA512 cc9552694b763b35eef831226179145e50ca57a2386ced2f4633e5849b64423d7106849256c6aef7d2bb56776efc9e31ece14c1886c3270123fd3ea576079961
TLSH
T1A9D0045751030740C3317035111347444F04C431344303110117104504441053155700
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 27afa139d76d2f1d97407d208e05d157d22ae77ce882306b3222ac272cfde8d6
MD5 376ad6e88c8274936282143a35dc8c09
SHA1 a8676a56e764651191e533ff8781b6566602c090
SHA512 69e07397bf55ce4a55e746f3eb9fe9d8584a9b382975fce3822fe553e2acba5cf482dffc364a0a5a64767f18ddef936f7ee8d75ca179a9c44884fd07e916dc61
TLSH
T196D0121732030774C13030331103664C0D00C13B50464201542F955E1A080542A16941
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Cache\Cache_Data\f_000001
Size 26KB
SHA256 cbc212c24b0c015ec5a7fd23caa39c2c07187d45817be76713fd32e9c89f5325
MD5 ba3f5b862294e6cb5d9176a2381f9f5d
SHA1 9a8434561c0a5d9205f1254d54ec11fd2cec1c6d
SHA512 84f0fef557fae37418d37ec999b45baca3ba16715e475f9c29565f3d8863b2b9f97db79cd629bdb4033c014f329be6231dd251b48c061da80de0d684fd6a9d94
SSDEEP 384:U4Sn7M5rYMKI0lSt1gNui+X1EIyRc1xfrf1DTvbHHA3NuObX3pGvXStUGZu6vaj:jS7M5rjt1g6KIyRCfjpTjyouX3pQSXvA
TLSH
T1B6C2F198A7E0813A21C0AC0D54ABAF40C47189464D6B2F38A753947279C7F78BFA1B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 4814491598d292a62650a45b563a16b1411f0431fc80985964c1ca73e62fec23
MD5 8e801c00e21b1fbaca35d1e7a659b99d
SHA1 16a17c19b48f52c19f52c8be95e9332a48387338
SHA512 e0e26c91d24cdb2994b2f77192af08e22e61f2782c7c3833b2ba3b01725b2651c6488fe167fee880b18d765c1e3ac91bab05aec8f60a227ebd699977982b5f38
TLSH
T12CD022F051F6CA0AEF202C71268ABC20E2304DF0C402135B6E766E098D031C82C43F24
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 f7ef4aef7f2ea836dcecb21b6e42a2363454f03f5cc587ba2dc9cc54bbdb2dae
MD5 48803295edd06a20caebb9613fde1fee
SHA1 e2ba95f463f9a42236358fda5f6609309fc98af3
SHA512 483e9942e853df1d3305da9ea668e9647d60ddacd848128840f18c5db9347d524466a37e20f77aae40cfc2d3a08d55b2215e196ea9a562723c807a7772cc5e4a
TLSH
T131D08CF091F1F62AEF207D74219B3D20E2314DF0C80623876DA27F0149431D828A7838
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 54876103403adddc11dd75ebfe71f4590f112763890ed8aca2c0f69d6c46a0a3
MD5 3fbd471a480cda546d37a1b77a1bf9df
SHA1 564fb114364a4e6bfc8e1e1e0037fcb39cf829c7
SHA512 38c21441bd61ff42fa5e8f989203342b89d294b3c9e93c424205aa2120d46697efe2144b0c4a7b7cfad4eed21bcab2b546d02fd456ef3cffc4a192a86327a372
TLSH
T130B012F001F0851EDF1407BA12476E51F3301864C201570F3CB80D0489536C55043810
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 b6b8a91104ee2defd6cfc5773f944994f9c60e44e01832be6648fa43388c05f7
MD5 6336028498a5a9704be917c18ee5c45b
SHA1 380520631bba26460041eb962e8dae40fe39ec5a
SHA512 51f2a1d66948b5b271175142335ccbe5c218a0a000eb066d5d18eaea531b3c722fa906a2f1e8f9354dad5cdc436b8fdaaa4f256cad3c29a8fb944b9abab064f4
TLSH
T1CEC09BB355F2C10ADF140975145D6D61B5714D95C501531719741D148A4B1DF55D7824
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 04ed8229f9e3f9a1a2c8de3a8841633c203645ddb2cfc7743530cb7d235042c4
MD5 1853714338449aade81d7ce4639be541
SHA1 0f074d5772390ad02b0ac3b8d665b6a35d561202
SHA512 e679d13f9a8a9919e2ae77f5c7dc1da0dc8f24d78a6909f3ccd4254716fa25b86318390d3dbda5d3863cfa28f18f7ad8490e8a9293b0a3b94d5e86bc51785c6a
TLSH
T181C08CF121F1C509EF340DB4358B7C20A1708DB0C90563076977AF0049431C43CCB414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4661.TMP

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a4661.TMP
Size 48B
SHA256 cfbb5545beb2a7824792e458910653078b11975fc4e47535a6eda1d759bf0f82
MD5 c8f15716f2e4e495b694f08974bfa0c3
SHA1 af3d6ab2e24f8c067315909d9e21316f4bfdc1d1
SHA512 5a813d9655b2b14956b5319395bac401398d1ba091426d4fb7a95e2ff8697270e76bfdbbe1a5d4c4ddd00efdc6e811caa2bef65d49a72c2c652ff38fa64eecbd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 4e17ccf3795b8e1f42e47784f81ca0c6f2fb09de94fcd4e6a8e0c24a08802a2c
MD5 789c86e6eac2eec14b7e8fd50794ba32
SHA1 baf31d10fc56e02fb60f0a701897c5d54d252fbe
SHA512 3fe09a5a97942a69f2ffde94d51ca65745db033b0eae487276827a9555338b62f38ee7066c9ffcdbd872ccc5a7aecdb0939e4f1fe092ac2af15879bc7e5a8316
TLSH
T1073176F2D5F50A9D855243E82A6439279E7E0504532C2AAAC9DDFF8F7BE0270E24150D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 b4ca3a95ef3d8196d967ccfa4a6fb7d09946bb1ceb50cf6ef9ad49481870c0b2
MD5 18ecd28ebc801122a4fa833f45c538bc
SHA1 bbeca8e400ee3feef90f40cede4adf4ce9bab3c3
SHA512 73d34f8f11843092aee261ee26e9cea7743236809ddce97bf7b05a56eb0107a36e308b89108d3117d5fdad75d3b88b42e909f598f253fff1a0010ae4729322d5
TLSH
T1864186F2D5F90A9D895203F826A4292BCF6D0504532C3D99C9EDFF9F6BE0264E24150D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 7ba1df0ca4bfdd0efebba023d5ecf5b9568c47c70b8c3e05f8963f5cf89426e5
MD5 2576ad764329a40955bd2fdc9ae7a920
SHA1 fd06d9137335ca7fc0e966f97e6f5542aee3452f
SHA512 21170ecfe9ffb372404960c9a0ae8bafdcc6bda2456174b65203e6e0f75471a5b6c23db0381cfe7899cdd325ae495e1699dfb808034c060378b9f0e10df2d5a7
TLSH
T13B3188F1E5B60A9D865143F83AA42D279F7D0004536C2AA9CADCFF8FBBF0270E241509
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad487.TMP

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\Network Persistent State~RFe5ad487.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 a0c95b982afd5b056cd937437056570a39b03e8e418bad492c631116f451e2e3
MD5 9d88e48eb0f4241222ca8a0d82c8d0ce
SHA1 21e971086160af179a534b6d44febe7536fc1269
SHA512 43c8352c7c5df0fd425544ca4a675722e88d5fcbb647f18e36fbb43b04041e8cfeb169cdf6ff38f74bf4e56e866c02880276007c09ca8bdc0b642909fffc52d7
TLSH
T173E0C036813FD42F147805761844FD800D3BE430454055E4CAE386BC709417FA503013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 351B
SHA256 a3c1ee6a34caf96d15ae955b1133ef5a9df44cd372044ef350fd1fa47cfbbc6d
MD5 88b91c315f31a64e6e68c50bc98e1aa7
SHA1 f3238991cb85d95215dc40fe3f5b715fff36b2c1
SHA512 2e467ab267ccbbb1acdc8ace783a4bd12296d8663f00fc0eea5ebebe36a76484d5b7e9a575a424b4dae14d67516a13a8888f2a2da5c8e8a11d6a45857ee159ef
TLSH
T1EDE02072663EAC7A18781A352944BD011E3AE435028164FCD977456C508497F5623012
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 649189ffa7fabaa43ab4f24676c38128939bf465ea4cadfc3525c8e00afbf056
MD5 e3f854e2fab4e7461dd08aeee3ca58e5
SHA1 08d1f9a51b2f77728f52c5e9083516a3197549c3
SHA512 7f3c71afefbfb0ac553fbe447c5fb9808ee45593e89fa9a1a31d488b5747b0e147e10084e9913ca8d6f568eae4dcda3e0c86ae93b962ba24f89a8e4ae60a26ed
TLSH
T13BE0C032C13FE47F28384D361D44FD401E3BA034454458F4C6D286BD705447F2503027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 2757601822f5fb47f306324d20c0fbbbf4a7e684f613d81ebdd35d921447ec49
MD5 0dcf0f58d0956859ea486f43e076f09f
SHA1 a346da22f5cb1aa33c6feb0f0b4075f63275fab2
SHA512 406b65bad26f2a99f73b8c3d2d054f449b5d69c76cc71eb3323ac03cf0031b816757aac28d1b1b79124b704f802a9d084c717a548634a605283c3240f96bc7c0
TLSH
T1E6E07DF6917EE83E30BC1D772880FD459E37F936024168F8D6A6437C9084ABB5A07152
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 d93cceb7a6ad9400b2fd0ee2a9e2c1fb734449434546c84abe7e3d5e7760fe44
MD5 29b90d9c7c78cc77d7192b1d36254b1a
SHA1 e05cb770482b3b7f374e00373a67fdab67a2c117
SHA512 b4b043e27485170de704954f6fdb2a1fa961ea98f3199e11cd4de8ce083469d47fbe2dda8590e99aa3283d5d4ccdf746c865fcb2850111eb07c218b3eb711c55
TLSH
T115E0C072827FD47A102845312E50FD405E35E535014160ECD5D745AD501887F5B03223
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 222c89f3fc51f887d528904f2efb0ad8a43cba8e2c81b4eda9181959042c0efa
MD5 f00991e4046884a0474b65c068769fcb
SHA1 8659d228f89550be7ad971b4566197b7dc4c57b1
SHA512 5033b9328d98afe0c70ca414b4793f97c489c69d4b0e7134b997c72da0f315cb9986157365df40eb4dcc09b3db34511536f32b49026fa28b470a461bdc8745ba
TLSH
T195E0C073917FE87A20A805312F40FD001E35F431024160ECD9E3426C50188BB0643232
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 7ac3c0e39920bf9b05e4ad13d04eb597bfbe172bb86d0f25ee8165eb198c9933
MD5 89d249bee8cb33ce5e801a1c98771d1e
SHA1 dd60213f99ae33856012ade0cff8d86c965401f2
SHA512 1d6dcbdf3908bf41e3dcbcf85dcbd30f322ccd779b3b3548b6a8177c49affea90320d5dce8bd6ca272511e55b0761b723ee15c44b6a6a0ae0e276cf019df00fe
TLSH
T1D4E0C037813FD4AB106849312940FD401F76B535014154ECDAF241BC602CD7F1603133
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 24ab6fd5dce038af6c8050fc17050f0f91380582de5f027e7b4e42368c1e1a26
MD5 535ebb90ca8809809c81476676d62137
SHA1 94adfbc10d4ed9a15fa9e3fd8aa75f687744a432
SHA512 88fd5c2772d964991df7b8f00234b8d52eb4207de4175867041324790598852ca22dde29224d6e14dce28cbcaa3bf2866d9adbf61e13621b749a7108d3babaf2
TLSH
T16DE02062913E942E507815371C84FE215F35B535418154E4D691927C50445BB5507132
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a1dca.TMP

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Network\TransportSecurity~RFe5a1dca.TMP
Size 355B
SHA256 a21dda08394be3fa455f9780cc2c26bdecc578b4e70992f4f95977062ed399a1
MD5 3c6f5a8a2f86e533da4b17a1b96019c2
SHA1 b691086b676e050e50d8167562c6c1aec6d1811c
SHA512 fd9934e8cfee059633e719aee521d62f6248ed54aa6dbb764886ba01566ced7ddcfdf881b058d552363e55db3eb634595fc707e34184ab709782d0a575a91463
TLSH
T15CE0C072803EE43E207918752880FD458D37B53A014099F4C651627CA054ABB1503123
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 d14277bdfcdcf13089c2c92a586035286c06b4b489fa71cd0b30dab2239f7e27
MD5 9b19f74bd41a234a0c6b8492b81bac7d
SHA1 6de27e7b64be100ce8832644e648190915b874ba
SHA512 0ce8d6565654e32f1f167b94d01bceda4e293b6a7c9cc87bae418e01a7702460c2ff52355bbfee744620a844f14770a114e8c71c7b184c78b67d160411ce7cc9
SSDEEP 96:stGXdOOG2b9HkDmv5h16ZMcWps7/x+6Mhmuec8cO11eje6K+gBz728XM3WC7K:st6nRvkWpsV+FHO1Qje/fGTK
TLSH
T1B7D1C7026E286DBB4CC7E219FB29BA17D2F5A47274911D58EBF8862C04D76DC7307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 23f9c17b238c878c5a2dc6916399e01459a88d75899fc5c968cb753f95b2d337
MD5 a51dc84d8002ffb3be39cc5067fa7158
SHA1 921b697fc505febc9aa462815a03858933fa0f2e
SHA512 970b23e7605e613a4dcb1de58cd0870a5d61613fc9c50a1bffc3362cd3305c2bb2c90bf78c0a7c8a4e83b5cc0f931cbee56555b86f6c70992acf1c1b05c06a23
SSDEEP 96:stGXdOv2b9HkDav5h16ZMcZgZbs7/x+6Mhmuec8cO11eje6K+gOb728XM3WC7K:st6xdvkKtsV+FHO1Qje2GTK
TLSH
T1E6D1B6026E2869BB4CC7E218FB29BA17D2F5A06274D51D58EBF8852C04D76DD7307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 45a8fbbc0fa2a09a51b05cf75c4b76a80b31bf606ec584de974f23a0fc3afa62
MD5 ee43237db90073bf9a2ef75c319ff689
SHA1 f91fc11fd312adde4db63b4dc5a38c7f459bb321
SHA512 6c54951395597c44e8593da6ab28ae97442bf5a5935d322a2ce9a93cd79db9e2fdcb9871088be9d09b6957a0232316f1a26e4496e2e9f304f6c6199267bb14b2
SSDEEP 96:stGXdOOG2b9HkDav5h16ZMcm+s7/x+6Mhmuec8cO11eje6K+gBz728XM3WC7K:st6nVvkm+sV+FHO1Qje/fGTK
TLSH
T19BD1B7026E286DBB4CC7E119FB29BA17E2F5A07264D11D58EBF8862C04D76DD7317807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 b48d22dc1e3efaade693b1d32fc5d9d063f82f481cf5f3eb407927e178888e42
MD5 023cfe24797d1dc08a95338a0f2d903f
SHA1 8643025236b4c64aac43f14cec7cd9ce00f07cdf
SHA512 d160c16d38f60a01fe6c5f91f6df30ec34337770ba48b79c4e87b00a5369677040fe922a47d37af850146188eebb7c3d985808cd05f99b6607b11402a32f5c91
SSDEEP 96:stGXdOOG2b9HkDev5h16ZMcbUs7/x+6Mhmuec8cO11eje6K+gBz728XM3WC7K:st6nnvkbUsV+FHO1Qje/fGTK
TLSH
T108D1B7025E286DBB4CC7E118FB29BA17D3F5A07264951D58EBF8862C04D76DD7317807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 afed852ebf2af3b123070313d7d287b556b0ffac4a3271eace3baa1e4fe16053
MD5 23622e5d7a9f99dc4432b2847a3a8399
SHA1 abaea2ece46c78ad47ee90f65a16e8e4c56520ec
SHA512 9be1092412ad2b7f1a0b4f529ab33a8071e512bd47808a0015004fb4c85ec0578412c4623b6b5ca12bcdf88489fadc4f7b420f45549a9a0287fc5102ca3e6d94
SSDEEP 96:stGXdOOG2b9HkDav5h16ZMcZgZbs7/x+6Mhmuec8cO11eje6K+gBz728XM3WC7K:st6ndvkKtsV+FHO1Qje/fGTK
TLSH
T14BD1C7025E286DBB4CC7E218FB29BA17D3F5A47264951D58EBF8862C04D76DD7307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences
Size 6KB
SHA256 a59eb5e5cb35bf617a677e69118b547a3b62c057b531752f049a4b4fbcea7c0d
MD5 b4978d38b51f19248881aa5a1ecc9f44
SHA1 406f8fa59ea1f5e2b3489397230600f5365b5c66
SHA512 425fbd2e8e3d87a0a58a3193153c6ecb7ebffc739e160f00e349146ca11c31814dfedda25be6d08247e7fb9e592f4d38d2a5e1cdbbcba378d098a02f946bd972
SSDEEP 96:stGXdOOG2b9HkDzv5h16ZMcw9wps7/x+6Mhmuec8cO11eje6K+gBz728XM3WC7K:st6nSvkuQsV+FHO1Qje/fGTK
TLSH
T1ABD1B7025E286DBB4CC7E119FB29BA17D2F5A07264D11D58EBF8862C04D76DD7317807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a1de9.TMP

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Preferences~RFe5a1de9.TMP
Size 5KB
SHA256 52b3f6d41eaef56ef22c55c9410a436d919011f03a8840365b4ced8b204524dc
MD5 f10a353888d0b25020d64f075cff9680
SHA1 ac2a2cb2d1cc0eb113d98e53ee3213164889eb9a
SHA512 3d758ab1a8e9804e4cba88840caf0af71b524f950e42914c0ca45004bbd91f14f559ef0b3c0be87d8e5902554df70ef5cd07ed1e0ae7a7b1ebab8d5bb21cc678
SSDEEP 96:rGXdOv2b9Hkxdv616ZMczVps7/x+6Mhmuec8cO11eje6K+gOb728XM3WC7K:r6xSvNzVpsV+FHO1Qje2GTK
TLSH
T145C1C6026E2869BB4CC7E118F729BA17D3F5A46274D52D58E7F8862C08DB6CD731B807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Default\WebStorage\1\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Local State
Size 2KB
SHA256 d0c32fee56cf331c59ac4f732370c5750e046529bea30afa3805d89303ff4952
MD5 64d4c95763082f9991bdf138a8592910
SHA1 499229ddf7ae78ede0b67f536f8871842c91ec64
SHA512 0be173a7677119589b143a54d00426e1da8010f67159976e07689545a2e12f2a5f81defa21a39cb605cd292305c8be20a3d2d782c4c998ab41c2fee91f94ed7b
TLSH
T13051953368259B36C5F34A08FD4B3E379979A1A2AB662F109AED0B1C41D715C2346C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 de1d77150da08cf72c37db9bbed1c835324cacc97a4ca917937fcc987e7fa7f8
MD5 f6d2f8c057ad0c1f0e282707a0661239
SHA1 0ccef5e68ab8c20d09dff2f8830ea9afeb1601a4
SHA512 366db5b9fbe0a95431b462352f7a1c1652d70751d7976e0fb877042f0cf191ae3c06624c205a0e2b0d097700d0121453de3994ed46214d2639140ee7f802222a
TLSH
T13D6177336935DA378DF39A04F88A3B27A6A5A163E5953F54D6EC0F1C41D728C2341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Local State
Size 3KB
SHA256 701299e2c3eecad3f2063923e9b52f4d4273c0d76a651eb7500aee6587f3f12c
MD5 0f4e1e24a9161909537844a7a88c14cd
SHA1 79ac052e8948b47810e574ed07738953167eaf16
SHA512 734f82f768be97ed3b9548776195507fc85b4258bd2e8e0b8dbb0ea531019f979cfbc1328ee619a7f2aa85d982db36ca4a7658d1f85bae07fcb5566068345cf9
TLSH
T1A77194236835AA278DF39A08F94A3F17A665A023E59A6F94CAEC0F1C41D728D1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Local State
Size 15KB
SHA256 f5ac55fb9cfc8f6060f5d0e31ba1adb3a56259bc888b69fdc193e325600bf5fc
MD5 57763d0dbe9397680057ce387b2a4533
SHA1 338675e4942b032b2219793152cdfe67efbe4727
SHA512 ff464f32969fc9b6897c61d631b2fee7b2648229394bc13f93381bbfb325f923f2c0198467f2bf5f4e8529ea2b653391df28454b3a542b0181155000710026c0
SSDEEP 384:7+aQikB+z/xvxjg/qhEb3NBS7DYd9M1d0AG9zq:a/UxvxjgC+bUDO6TrGFq
TLSH
T17A72BF1B5539BE2295F3EA05B94E1B5FCAB8A8B291C26EB44DBD6F0D02C739C1301C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59bf3f.TMP

Path C:\Users\Admin\AppData\Local\SinaForum\WebView2Data\EBWebView\Local State~RFe59bf3f.TMP
Size 1KB
SHA256 97962a860adcf4e53a8d9b4200cfde4da568741aec47fce02ab9405b7731d319
MD5 f1f43d98a028d0ebce58cfa123f7d2fc
SHA1 5d65e10881e4cf614dfc5ac6b2ca5b5aae25a170
SHA512 687ee37f9fb63e1981374b757be88d5b7c87d736e053207883de2b835ebab5dd4790f9a35bf419fee46e965e876398f5926af0a125bbb27dc24566c76affa86d
TLSH
T16321627394365B72CCD21B0AB40B7E2B6D60A0A783264F0466EE8F2D52E214D651AC73
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forum Sina\K-d51TRKa8vb\D3DCompiler_47_cor3.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forum Sina\K-d51TRKa8vb\PresentationNative_cor3.dll
Size 1.2MB
SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
TLSH
T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forum Sina\K-d51TRKa8vb\WebView2Loader.dll
Size 161KB
SHA256 9468470d6a4d11179ec179183d130465a380e0dedfdbe1fc2ab404c86c45a85e
MD5 61f430f292f85b18b57f06ea6d3d8b82
SHA1 03e31a690fa32364fea5ce73498f234adc544cd0
SHA512 73dfd28a27c10984abb382b7d868b3812aa8d0c89435a45b5b242fa82cc7890b91b2e89bc86cdee039b721befaaf0d14506b6c9c86ecbce6ba6d97824eb22dfb
SSDEEP 3072:dX1/Z3TlTRTFOYfThTNTvDbS2bT4wdovPEKdIMsb1Z5AalipTkYEtJ5+POFEv:dDTlTRTFOYfThTNTvDhvZkPEKdI7pUEQ
TLSH
T12CF36C5772E5007BE16B8274C9A34A11E777B4510B60ABEF03A4477A1F237D4AE3EB60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Forum Sina\K-d51TRKa8vb\wpfgfx_cor3.dll
Size 1.9MB
SHA256 5a3e8766965f76a7cc0a3ba15db615ea009d4414b4cf4290c1cb59b211b8f68d
MD5 a3de08b2853c72b4923558e1794f5272
SHA1 358225bd1a2884e79e1688af4df3b53b65cb3d06
SHA512 fd67ec2068a4cbe8e05ceac4e94a90649d2e0dd09171cd0a3ebd651a8aefe008bb1ab819fb489f5a3278b2ff083f5973b2ec91fd41639891ba57061c4bfa0ddd
SSDEEP 49152:zJBarecoR28GPaM6YqVim/oBiEyBhocmue:LnlkRwiIoBi1BOh
TLSH
T1D5955A46B6AC40E9C07AD33CDAD7961BF27174152761A3CF23A0479E6F27BD00A7A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3300-401-0x00000256D0A20000-0x00000256D0A22000-memory.dmp

Download

memory/3300-399-0x00000256D09C0000-0x00000256D09C5000-memory.dmp

Download

memory/3300-400-0x00000256D0A10000-0x00000256D0A11000-memory.dmp

Download

memory/3300-398-0x00000256D0A10000-0x00000256D0A13000-memory.dmp

Download

memory/3300-173-0x00007FFFDF310000-0x00007FFFDF311000-memory.dmp

Download

memory/3300-396-0x00000256D0A00000-0x00000256D0A02000-memory.dmp

Download

memory/3300-403-0x00000256D0A30000-0x00000256D0A33000-memory.dmp

Download

memory/3300-404-0x00000256D0A10000-0x00000256D0A16000-memory.dmp

Download

memory/3300-395-0x00000256D09C0000-0x00000256D09C1000-memory.dmp

Download

memory/3300-393-0x00000256D09C0000-0x00000256D09C1000-memory.dmp

Download

memory/3300-394-0x00000256D09F0000-0x00000256D09F2000-memory.dmp

Download

memory/3540-231-0x00007FFFDF310000-0x00007FFFDF311000-memory.dmp

Download

memory/4768-35-0x00000238824E0000-0x0000023882560000-memory.dmp

Download

memory/4768-122-0x0000023889ED0000-0x0000023889F20000-memory.dmp

Download

memory/4768-345-0x000002388F8F0000-0x000002388F910000-memory.dmp

Download

memory/4768-349-0x000002388FE50000-0x000002388FE80000-memory.dmp

Download

memory/4768-338-0x000002388F7A0000-0x000002388F7C0000-memory.dmp

Download

memory/4768-333-0x000002388FDC0000-0x000002388FE50000-memory.dmp

Download

memory/4768-329-0x000002388FC50000-0x000002388FDC0000-memory.dmp

Download

memory/4768-267-0x000002388F3D0000-0x000002388F410000-memory.dmp

Download

memory/4768-263-0x000002388F5F0000-0x000002388F7A0000-memory.dmp

Download

memory/4768-275-0x0000023890610000-0x00000238906C0000-memory.dmp

Download

memory/4768-279-0x00000238909B0000-0x0000023890BB0000-memory.dmp

Download

memory/4768-271-0x000002388F850000-0x000002388F8C0000-memory.dmp

Download

memory/4768-143-0x0000023889F90000-0x0000023889FA0000-memory.dmp

Download

memory/4768-135-0x000002388A020000-0x000002388A090000-memory.dmp

Download

memory/4768-139-0x000002388C530000-0x000002388C540000-memory.dmp

Download

memory/4768-15-0x00000238820D0000-0x0000023882300000-memory.dmp

Download

memory/4768-11-0x00000238834E0000-0x0000023884440000-memory.dmp

Download

memory/4768-7-0x0000023881210000-0x0000023881EA0000-memory.dmp

Download

memory/4768-39-0x0000023880490000-0x00000238804B0000-memory.dmp

Download

memory/4768-43-0x0000023880560000-0x0000023880570000-memory.dmp

Download

memory/4768-47-0x0000023884850000-0x0000023884870000-memory.dmp

Download

memory/4768-51-0x00000238848B0000-0x00000238848D0000-memory.dmp

Download

memory/4768-56-0x00000238848F0000-0x0000023884910000-memory.dmp

Download

memory/4768-59-0x00000238877C0000-0x0000023887800000-memory.dmp

Download

memory/4768-19-0x0000023884440000-0x00000238845A0000-memory.dmp

Download

memory/4768-27-0x0000023882460000-0x00000238824A0000-memory.dmp

Download

memory/4768-23-0x0000023880510000-0x0000023880560000-memory.dmp

Download

memory/4768-31-0x0000023885150000-0x0000023885980000-memory.dmp

Download

memory/4768-71-0x0000023887820000-0x0000023887840000-memory.dmp

Download

memory/4768-67-0x0000023887870000-0x00000238878A0000-memory.dmp

Download

memory/4768-82-0x00000238878C0000-0x0000023887910000-memory.dmp

Download

memory/4768-79-0x0000023887A50000-0x0000023887B60000-memory.dmp

Download

memory/4768-63-0x0000023887750000-0x0000023887770000-memory.dmp

Download

memory/4768-98-0x0000023887C20000-0x0000023887C30000-memory.dmp

Download

memory/4768-102-0x0000023887DD0000-0x0000023887E00000-memory.dmp

Download

memory/4768-110-0x0000023887D80000-0x0000023887DA0000-memory.dmp

Download

memory/4768-118-0x0000023889D40000-0x0000023889D60000-memory.dmp

Download

memory/4768-341-0x000002388F9C0000-0x000002388F9F0000-memory.dmp

Download

memory/4768-126-0x0000023889F20000-0x0000023889F40000-memory.dmp

Download

memory/4768-106-0x0000023889C80000-0x0000023889D40000-memory.dmp

Download

memory/4768-114-0x0000023889DC0000-0x0000023889E10000-memory.dmp

Download

memory/4768-94-0x0000023887CF0000-0x0000023887D80000-memory.dmp

Download

memory/4768-90-0x0000023887BC0000-0x0000023887BF0000-memory.dmp

Download

memory/4768-86-0x00000238886E0000-0x0000023888E80000-memory.dmp

Download

memory/6008-509-0x000001BB2F3A0000-0x000001BB2F3A1000-memory.dmp

Download

memory/6008-508-0x000001BB2F3A0000-0x000001BB2F3A1000-memory.dmp

Download

memory/6008-510-0x000001BB2F3A0000-0x000001BB2F3A1000-memory.dmp

Download

memory/6008-504-0x000001BB2F3A0000-0x000001BB2F3A1000-memory.dmp

Download

memory/6008-502-0x000001BB2F3A0000-0x000001BB2F3A1000-memory.dmp

Download

memory/6036-496-0x0000029696F10000-0x0000029696F3A000-memory.dmp

Download

memory/6036-481-0x0000029696F40000-0x0000029696F41000-memory.dmp

Download

memory/6036-480-0x00007FFFDFAC0000-0x00007FFFDFAC1000-memory.dmp

Download