edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/10/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe
Size 10.3MB
Sample261015-rf6dcaxte1
SHA256 edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd
MD5 2301064bb9b8f9e8dbf967e064ca2551
SHA1 42194bb21d03935a9fec1fd9d54979f5d1654e5f
SHA512 dbf81613cbf8a4dd72f81bf0326d1cb4e302e2aedc1b25e2370233b8ede6808339a90aeb2b456c41577c487edc92abbf589ec54055bd2cbae700136d5c85f24e
SSDEEP 49152:35kKuHt6cY9aQ2cx6EgybDSLu7W8Ly71Z6QE71thgQO2sxleqwrw8MD/U2YhzqjN:3dxpO7tEthgp2qQ2YeHsptE
TLSH
T11DB66C07E89555BAC1AED234C57292A2BA723C489F3167DB3B50F7382F72BC05A79740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

credential_access discovery stealer

Malware Config

Signatures

Uses browser remote debugging 2 TTPs 3 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2776	chrome.exe
5568	chrome.exe
2404	leakless.exe

Executes dropped EXE 12 IoCs

pid	Process
2404	leakless.exe
2776	chrome.exe
4576	chrome.exe
1696	chrome.exe
4316	chrome.exe
5568	chrome.exe
5820	chrome.exe
564	chrome.exe
5440	chrome.exe
3360	chrome.exe
5056	chrome.exe
3368	chrome.exe

Loads dropped DLL 27 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe
1696	chrome.exe
4576	chrome.exe
4576	chrome.exe
1696	chrome.exe
4316	chrome.exe
4316	chrome.exe
4576	chrome.exe
4576	chrome.exe
5568	chrome.exe
5568	chrome.exe
4576	chrome.exe
4576	chrome.exe
4576	chrome.exe
564	chrome.exe
5820	chrome.exe
5820	chrome.exe
564	chrome.exe
5440	chrome.exe
5440	chrome.exe
3360	chrome.exe
5056	chrome.exe
5056	chrome.exe
3360	chrome.exe
3368	chrome.exe
3368	chrome.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1696	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{4C29581B-CB23-438F-A2B5-D092A845103C}	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 2404	776	edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe	91
PID 2404 wrote to memory of 2776	2404	leakless.exe	92
PID 2776 wrote to memory of 4576	2776	chrome.exe	93
PID 2776 wrote to memory of 1696	2776	chrome.exe	94
PID 2776 wrote to memory of 4316	2776	chrome.exe	95
PID 2776 wrote to memory of 5568	2776	chrome.exe	97
PID 2776 wrote to memory of 5820	2776	chrome.exe	99
PID 2776 wrote to memory of 564	2776	chrome.exe	100
PID 2776 wrote to memory of 5440	2776	chrome.exe	101
PID 2776 wrote to memory of 3360	2776	chrome.exe	103
PID 2776 wrote to memory of 5056	2776	chrome.exe	104
PID 2776 wrote to memory of 3368	2776	chrome.exe	105

C:\Users\Admin\AppData\Local\Temp\edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe
"C:\Users\Admin\AppData\Local\Temp\edc313583d681701095e57688069a263ea06fa83f2e6a82c2d8578f8ba1224cd.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:776
- C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
  C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe 62a91d1084367f658ec0d9dcb553b0d8 127.0.0.1:49902 C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --fingerprint-brand=Chrome --fingerprint-platform=windows --fingerprint=1034405928 --force-color-profile=srgb --metrics-recording-only --no-first-run --no-sandbox --no-startup-window --remote-debugging-port=0 --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d
  2⤵
  - Uses browser remote debugging
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
    C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe --disable-background-networking --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-breakpad --disable-client-side-phishing-detection --disable-component-extensions-with-background-pages --disable-default-apps --disable-dev-shm-usage --disable-features=site-per-process,TranslateUI --disable-hang-monitor --disable-ipc-flooding-protection --disable-popup-blocking --disable-prompt-on-repost --disable-renderer-backgrounding --disable-site-isolation-trials --disable-sync --enable-automation --enable-features=NetworkService,NetworkServiceInProcess --fingerprint-brand=Chrome --fingerprint-platform=windows --fingerprint=1034405928 --force-color-profile=srgb --metrics-recording-only --no-first-run --no-sandbox --no-startup-window --remote-debugging-port=0 --use-mock-keychain --user-data-dir=C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d
    3⤵
    - Uses browser remote debugging
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=gpu-process --no-sandbox --disable-breakpad --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1512,i,949831918832976315,10401579807428249405,262144 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4576
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --no-pre-read-main-dll --force-high-res-timeticks=disabled --start-stack-profiler --metrics-shmem-handle=1824,i,15649955700275795101,1911382491344397780,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2056 /prefetch:11
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      System Time Discovery
      PID:1696
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=2204,i,10752928200973592321,14086053658007636003,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2216 /prefetch:13
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4316
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --start-stack-profiler --no-sandbox --disable-background-timer-throttling --disable-breakpad --enable-automation --fingerprint=1034405928 --fingerprint-brand=Chrome --fingerprint-platform=windows --force-color-profile=srgb --remote-debugging-port=0 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3696,i,8534857322609584698,6072655383300420494,2097152 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      Uses browser remote debugging
      Executes dropped EXE
      Loads dropped DLL
      PID:5568
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=4164,i,6065529168382507284,926180154257352875,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=4392 /prefetch:12
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5820
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=4388,i,1130714797365503145,15526388001353115885,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4408 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      PID:564
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,11355309781717146221,7085241822889807721,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=4820 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      PID:5440
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=5088,i,1177553515250668724,14647565031243211019,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=4852 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3360
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,14564708528219158669,4027131009216677477,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=5104 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5056
  - - C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
      "C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d" --force-high-res-timeticks=disabled --metrics-shmem-handle=4848,i,2907618048203998481,8064238828326547078,524288 --field-trial-handle=1908,i,13273282934618482497,973394325274864467,262144 --enable-features=NetworkService,NetworkServiceInProcess --disable-features=TranslateUI,site-per-process --variations-seed-version --pseudonymization-salt-handle=1912,i,16649707460294250739,15537164443011558461,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=5168 /prefetch:14
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

T1556

Privilege Escalation

Defense Evasion

Modify Authentication Process

T1556

Credential Access

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

leakless.exe

Path C:\Users\Admin\AppData\Local\Temp\leakless-amd64-adb80298fa6a3af7ced8b1c9b5f18007\leakless.exe
Size 2.0MB
SHA256 1d11bec16a63d85a386c47fb97914ad13318f7fdcbf399c5a895cf642307f115
MD5 f64c225477245d8cd25625fe4d453f62
SHA1 2dea714253f18838babeacff346f33774d764bd9
SHA512 f272c1239bd251e4995e2ec76538ac98d6ca118ec61054cc36b630f2bbf04b51df0ed85d7141cb74594ea2790df38d3c79624ddfd900a6e3d216db58764cda9e
SSDEEP 49152:7bdVK53nuhrb/TkvO90dL3BmAFd4A64nsfJwdv9oiogf8+WhMCIwYvD1:g3VhY
TLSH
T1E8A52947FC9190A5C0AED23089669292BA307C890F3163D73F50B7B92FB6BD85E79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f2e94da-a147-4cfa-b743-774f5bf5f079.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\7f2e94da-a147-4cfa-b743-774f5bf5f079.tmp
Size 3KB
SHA256 6b58951d19d124ab578fc5a8c8a72684fe99b1fa0819e8887ba8720d7700df23
MD5 76cad39b6ea6da9f61bc056a00c05624
SHA1 7feee7ccbcd6d5290a772faf2be10ccd749a0c64
SHA512 98bbc34aad7d15a79b61de7a784f770a520157249ae14d5948c1b06fc1bf2194656fe7d9e0cd3655f2b3642e4452bd54281b308f506d96a2257c707e7491d3e5
TLSH
T19771F931A168AD7369B7FA0075877F03CDB4216BF4116FA8E1EC5A1D00EB8E81397513
MD5 SHA1 SHA512 TLSH

Submit Download

4642591e-9325-4547-900d-9dea11dd3722.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\4642591e-9325-4547-900d-9dea11dd3722.tmp
Size 7KB
SHA256 0978451a5f3c80ea276d2b5d61b85d532ce75416831793429c4757f93b9742da
MD5 928647022240a7ef3bdbe519e01554a8
SHA1 6ef05d5990e128cd0d839e408f0f24fffcb146fe
SHA512 d22822a4f15e58ebec9965c1ac2d4860a4048f3812e84d85dc605f5b4b8ef0cf868884fb1177a54f2adfcd5bb4d70f932ad808833605854be7dc88dafda4655f
SSDEEP 96:z6hxkOW7olIRNSuSjHv7ncQWHuFwwa/dxFuX796b+WVoMPktNm+TeYGmMk69j/yc:zkicImv7nc/uVa/3YXcb+WNO/GmtJ14
TLSH
T100F19617AA20BA779CD7D219BB28BB51F6F1503176C10D486BFC893C06B9BDE2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000001
Size 51KB
SHA256 ae06c1afac35e82b5eabfd06c6219e563d62fab29d4e646e2829b3f51dbc6fd6
MD5 dbdf8a7cfd62b7292a9b3d29f4fa9183
SHA1 17e861f42d1d90af0b259dbe525e35fb45b14e30
SHA512 5637b83c5c12210f8311c8671d62e809e3ebab3f3b5e5121151f2bdf25be28d24f1d030e209081d0b3f4baa8b7c2046e1cb16496d6f389488c1be533878ae255
SSDEEP 768:O3cDehNu/D1+OKahvowSPCbhkJACNPWWFDw27Ks5sq+AeiesTmgxjooVL6tQm:O3cDANSUwvHSEyJPPWWyLeyKKglo0WQm
TLSH
T1653302F6DB35B1B887879CA4E54070E70BA5184D771CEC9CB6342D26261A368BD4CECB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000002
Size 61KB
SHA256 08db44295e2f33e450b3fb4676b12b5444b1a226e4267f65873dfdb00a4e1e71
MD5 8c5f973d00e184e12b9ff8b6dc7f3c59
SHA1 6d5d5433cd0442993d0b75898db889f78aa3b15c
SHA512 96a5c56eca643be6ec2d60957bba31a454f9340c8bcc96ff559f909270a6623dd849bd6bef0e694928f03df92d9dbe004417998043fd741371d8b3d66f15b8c5
SSDEEP 1536:sIQlW+/sbgwGvy7ufTvMqNyv+7NXVfsVwZgRu+Pin:oWhbgwGvfbvMqNV7NlfguIo
TLSH
T12953012F5E608F50AF06BEADD0C7BF75DAEE0E12A596512970DC117AC8A581C488C7CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000003
Size 29KB
SHA256 26420ce1c41573c057f8d6b5df665b440e72c02f3072c51249e00214e58df02c
MD5 2b334a227966fbf15df7d13f7a441229
SHA1 2450c6c9bfe530fba20ac8d8cc51c8bf1c2fdf20
SHA512 a5ce958faf25bb6e64693823dddd09d01eae969b912bc84aef8cc63c45ad3e05136618ce6d8ea283d53c76af69a213e14af42101a0fa97d23c48aca1872a36c4
SSDEEP 768:UBaw084UVYSbi5AOirn1SjpH/rJLXHeNnOvfVpz:US8nYCiqOiYR/tLXI6z
TLSH
T16DD2F16448A47C3C75072A1036EC442A1B793AD2BEBF811BDDD5528CDFA7D0AC78927B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000004
Size 77KB
SHA256 e51654666d57c702e17784eaf2a6b4028813e0bde30cb06c7b7099b38ef857e9
MD5 579533fa01e1b865f7c53a2907182ee2
SHA1 d2640a4675280568fd349db2c317b84f3e5712b0
SHA512 48497057476bfca0a563ea349898d4b1ca2410bd26e85b383c5b7105f5ecfd72116c38d9c5c1256dcbcd5e155c847ca3bdaa5cca2aea49758b979aa4861da43c
SSDEEP 1536:YRSVXtdjqtZz1ldzLO8IwRsY2AcSYXGl715oMu0dg/dTWXCo8DL8:YEVXSrhldwnYkSYXGlHoW2No8DI
TLSH
T19C731224EF6AE3B5051E2645CEF1D42F299A27826E7CD0E6A44FA76C3184C14E8CCDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000005
Size 235KB
SHA256 a398eca5e52306f63d0670ec201d85899539718ea166b99dea8a870610fdbf0e
MD5 00732d9fd19f40b29fd8537e2867661a
SHA1 73298cbf9637001c7cf7bbd046d6feecaab16095
SHA512 a0dbe718790e187e6fb7e9bd8ed9bb051cac2b345a0ea17bdb3bf29b5b6f93d90c746a0dc0fc0d5666544df56701d6d1d36bf0f13e00ac2b9bbaa1fcc66d4def
SSDEEP 6144:ECxGasNQHFj1+M5PQ7k0wAM1/ejb2aESEwF2M3VIe:bxNsNQlBDQo0SdejiaESnVH
TLSH
T1AC3423D71984A33B54F6616D203B5D2E3E86FC3E5369E27C78EF4D0530A6CA92901785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000006
Size 66KB
SHA256 3e7442852af2eeb4d1d9f3f060c0e42329c78b1f0d01c8677dcb74d4c62259b6
MD5 29e6b10435ed32f53c807128a84e8f34
SHA1 2fa7ccf7aaf4e3ca079bba2a76ed11d9240fdf70
SHA512 60b60f6d4d79aa7b771af3bb1be0f892929dd96e9b454b1dfcc570d44ea1e71b3b5b7ba2ef16d7354ecf31fb9e61d1e0afefa7f97e557dbc67bc3bdc43fb38e9
SSDEEP 1536:JwmAW1esyusmLJl28JJtUrLwmxT2ClKGIfoq:RA6Tyl8Xc2C87fX
TLSH
T1336302C79D34D6E3EB57326111476B283EA5E1417FCCC33F0CA8D722A9A54D1B2A24A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000007
Size 444KB
SHA256 d5d9f8ccd2b907b01af172b280df5fc6adee61f865719bcb8f2b6e6da3a827e0
MD5 290bada7a5051506151ddaabc745ef3c
SHA1 9d94e2cb85655ad42ba130e43fd8b8ef25c27acd
SHA512 13ba5c5a9ff084239af19451a616f18327fe6aff9d150ad554f11244cd8a1ba1ad1da5bd0839c0fb7cb63a0f74be8665590c6883c0c7379c733d4eab0e9dcd91
SSDEEP 12288:1ZcgUlNRzP3xD1lB9w00+4vz1Z6OSDedkoRDXf:1ZUjP3dd9Wvzb63StXf
TLSH
T140A4235956BCA8B0DCFB3A292D8121A1C3C33C501795F658BF5A0AFF0A27943FA4D257
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000008

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000008
Size 637KB
SHA256 c1e2b4040f0e04942994e2cc820f3c755581bc89397ee34050fcdaaa110c8416
MD5 3c741e24483612072454b7a2f218f6bc
SHA1 b9a544e901413ec7c4d0e46040059eee69c84e2e
SHA512 04d1b2e06fadd3f101e57482be693e973b96f281e4e7c461f35fc0e777ebf251005353611a9a6e41a49105a1fb6a09a3911e95eb3d096657d795f1e0a164a8e9
SSDEEP 12288:f9KIsPO9+8v+81N6ieUzkuqZ1wnsiEw6uhpmzgnyiV3eHwFyItpcJLJDNSp:IQ1J4UsiGgmzgnyiVewF3ncXu
TLSH
T18DD423527C71278B525BD952FD87C437B8922824C7DCF3C052C68B3D87B4A21FA2A95E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000009

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000009
Size 16KB
SHA256 66ded80be7a92e18d841e2c91ed75612a9d0e32911eae2c46b25425dfb0593c2
MD5 46e66d258ff6ceb7394c5ed8bbdbffa3
SHA1 ae87cac275efd85b431e3f5d1aba754b4762bf40
SHA512 1c3a263e83b7251b23b24874f00ba105aa737d63487afffb8124e9ba99e603b7e98bb3fefe8693c21992cf6ab0b853c59ff84b01d04f21bb091c2d2c2e6e4a3a
SSDEEP 384:c8mAKOfVARjoJvrRRPI6xXuTU8OlVBdksfeanxJCNhblZz0J:cv2JvlRj3bVrpxOhZCJ
TLSH
T1F072D0F97B3FC1211852D5A2CA48F3E882A562160617F8DCA4538702FA4DE16FDEC4B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000a

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_00000a
Size 45KB
SHA256 a39568840d4ce27c4f53484327bf82d199ef9fe40f93bd48cfffec799758e411
MD5 21ebbb643b4f268e6d9159c3959e0eef
SHA1 94107b5b1c4e8a749a11845223aae81ff7a7bcc8
SHA512 67401b923de3a727dc41afb638a1b604afc278cf3eeeafd417bb9d796cff3c7f6bd43d62aa2fec7219a985c5288da4e3cd2980a260be7b5034c0104c821dbd38
SSDEEP 768:fUkQUnyiVe5d7X7VLH+YNNq/ufBuF1FaMi/uqTknm/1cI4wHxJoYA9OdTe5bT4x+:fUkqiudXVLHVNBBe+Mi/uykg1cIjRSYK
TLSH
T17C230185C5BAFF7874CBC3321927C16F1E979C2921697FA8B425C4810D470CCBDA6BA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_00000b
Size 110KB
SHA256 af9acc56197cad2b1a96212063c4193b1ba710c47739d6a3aed66eb99eb6275a
MD5 6297284718c976a94cb043e57a8d49d6
SHA1 549958b4b8d2328f2a79beef5217a913eb2d7128
SHA512 0797de61ad930eaedee3e6b32b99fd1db4f1a3697bfcd7d18aa89b825eadb77ccfbab11c0925f7c380f0df9cdf68fcac78764e2e8b136bd50612d100219a26ff
SSDEEP 3072:9DIYDiWII4xSEVqDkQLh1SdNUsFkcXUv48:dfDibcEVqDNjSdKAkv5
TLSH
T1EAB312211D63F8E7AEA0835D5486D3FEC54ADF25A2C8A95CBB6CB4BD85E033135B25C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_00000c
Size 85KB
SHA256 cdd96c788e55a12e6ca44a17c6c7aab8182df9d128ffbc3a6623fa68e79276ff
MD5 0a2f7f1b0820c3e5044711e813c62a9f
SHA1 a0e89b9b613ff8d31df57cc0f8da37b6a0c6dcae
SHA512 d03aff13a14e9d96ac60fc994544c0ea16956791092f5882096c0f7db02250683df58811543f1c1884bf4ac2f4c357023f43e43632377e9796dca284321e6b45
SSDEEP 1536:BS1Y+Rw/DyjZZixZmcKl5eXV+zjRLE00g9d4jx96YXk5B6YmR:WRw/Dyj4q8SN00d4dAhcXR
TLSH
T1E383027A776BEFB00280619A540F835BB28DA24CB9F0723D526CA0F59E49D81D1369CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00000e

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_00000e
Size 207KB
SHA256 274f7698328a06c4ef7bbddfa71959722b53319707a1a6408c22ff71de284c0c
MD5 30ff53a4eb74f5d8f4da548535b2c890
SHA1 90b5931e853e1425a11028d52d0b1ab4898a718e
SHA512 fd7f8c56e96719f9d4eb0afc766638b1b33056c5c828030115a1a56cdf475a69bf6dbf0abccaa12e2013da19ea70c18482c6cc68a4e6d7b3c8c0eb17e0ffbd9d
SSDEEP 3072:BqgDjglgG3jOFrGpUnkBDUeoEqt+M+g7pSQ5q6CdQAuiQrUI/y6Xlgx0O66wN6rE:7iqZm6sUeqsukQMdQzeI1lkBT9S17
TLSH
T1B824230D5C68931A50973AFB1E3087686FD72FE457D197300EDE4C6A27DEB70AA0446E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000010

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000010
Size 77KB
SHA256 4092172e3e427a6029a44ad1e50ec56f2a7618f3e931cd531ded5ec677600d0c
MD5 19628af42dcaf3a1096864c49dd6b45d
SHA1 5cdddd03c78e44d29da6aedf7f2e4aabad194c61
SHA512 fad2e6b9f52323c15b1057a3d1b5494608fb40a10729feb6303969f4cbf4c10f264fb2e85877ef6968928b09bcf90b457ea77750dd287b2e4f7f6408a4d7eee6
SSDEEP 1536:Up3kd9IVyw/HQSeGzFTZ9NLJPFQ4yOJlZb0i6wGfirKI5U3JA6Nu3f:D9ATeyNZ9iC3Zb0i0AKOU3JvY3f
TLSH
T1B77312051C55E6FAA605478A005BA4C34B5E289CC7EF6F59A387F94FC0A15D8C9BF332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000011

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000011
Size 50KB
SHA256 2ecef988b5bd3ddea878eb636c3449ef64ca22840667322fca1ee9a822f14f70
MD5 c4bfa8c3d392a7011ac8e4ec6388b787
SHA1 ef9af05ab6041355cf032c7b2a25b8457c527694
SHA512 cef0da04b3064191bf7cc9e1853cbc60bc0aef4402ecda335df65db4a031c9bb527d71bd08b7e8d39722b334e384a5418cb16464ccabbecfa80ddc9f67843bba
SSDEEP 1536:igHCgTPoL2TzqCntPlkiZRC3ZYtolaBVgGzd:iPTMHlMYClKyGh
TLSH
T13B330178BFA99D9728832CA20C181F449D368A0E605AB7F0814D3B1915C7FE9E61E698
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000012

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000012
Size 123KB
SHA256 616f4194a06c7c99f4c5d984f224ae07af5958759e5a5e923eb19f51c891f124
MD5 151689ca76c361b313a7e2ea0dc17302
SHA1 1f71eda333cde525040f0b3147e6c1a57a1d931b
SHA512 46eb8b0fbe7db0cca1147f7e7839222d19d282f02cfb87d9dbf9c9ab98607fcf920e872e8943f7db516e79956613ea266259703ff0016f451c1b6dc36ef01137
SSDEEP 3072:D6NkOmhOcMHVCxuCSw8ACMtuPAubfpFCkm:D6jmJQCxO3Mt8fp0T
TLSH
T11DC31375B72DD8C96240AADCD274C46D8927238DFCDBD07E99881AD806670CFE153B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000013

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000013
Size 17KB
SHA256 2e80cf2ab2374f74f6c6a731997504e014063e1dc351c711fcf6c958a0659d83
MD5 39abe1cb1977f42cd73c67df20c2e658
SHA1 bdbaf5a26fffb7904b171746d5cbf9fb69528362
SHA512 cb5476de720e58a55569421324799684c474cc0772c3b15c2b29b32c54b64d22ac4d1b17e37e41b52cb1588b7035f5b421ae5f67d5f7679e23b12003577e13e9
SSDEEP 384:xti7jIhjjVRGlQ2XuUQYv9U6VMUOERsoW1Op8aTeSGKiL5dNTx+x:YYul5uUQI9JVIERy108kWJ9S
TLSH
T10D82E0D27C06F5AF8B963C2CDEC36074D9AA5A1EB7C087B75E651338419D4CAECD04A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000034

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Cache\Cache_Data\f_000034
Size 40KB
SHA256 70a159582e7d3ce5f3374945687be85da9b9e596bf4b0e6ae884884a0afdd456
MD5 9ce530fa019118d0276fb7a904394f9b
SHA1 7a21d89e17f384110e008dc28f473f294ac9fb87
SHA512 f14c697d90b9086fc33e03ef09140bd1f4e52da58d2d51ae412aae07b29c4408eb3b35399e10d3ee2a3cd797ee42eb24c852d7ebdb2ce70a45f77b11fe51471f
SSDEEP 768:xLqLmGfS9cGyFYqSQwBaoFZ+lKG3PtbicdOcybkRdkvdorXPNwhvSUd:xxZfu1K1OlKRcLIYdSdCAa2
TLSH
T1EF13F182A4643C9C03CD79143EAD3EEB875AC4686086128EBED4F1251DD3F6C7623885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 e652389dca570feeb3a49756036dfe82e039999493962bf65e517ca459477f84
MD5 1d3f4f7b3cbbaefd6a5d4e0baaa040c3
SHA1 002ae076d5b171afacd545c1a00906a2bc2b51b7
SHA512 35f9f168884cd2e7bc66f3b5a6b4ce2544a1a184ca32d8d5546356275b8c329404ba37ad3d7fa0c98bb15801f99c500e63750a88471068a35fc2a6379475667b
TLSH
T1EA21936CC8C71991DBF3363435AEAC00E7BC2149B52A2F8E108174B0F84BBD329DA0E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ae24f2819d57bb16f586ceaf16938c2156c115b875c224cd8098c195fc01fc10
MD5 1734798d0ded011f9bed1ff64552facc
SHA1 e6abdf7ae931d848899fbe4980f46e0031e43d15
SHA512 938b7df6d4455629180012e213e82494aca9e327038f0f1cc61a2133a91cde191e89a001ab94c186a91eda5366ccb2c46952102eb2153f2343586051981a78c9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\DawnGraphiteCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\DawnGraphiteCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e2b50804-7161-4cb1-9613-3fdc4b042cf7.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Network\e2b50804-7161-4cb1-9613-3fdc4b042cf7.tmp
Size 2KB
SHA256 a38157bef0ddd0b3ec5b45ca81d29ba1b370dbe295bc9febd157ebc6576e4b18
MD5 1ccfa3db814b9cbac54c9fbb7997108e
SHA1 74054d6051aa9eb7ef4af441755bf4b2227cfc85
SHA512 195748915ffc78fe11d4cfac47fb32ae07c4f1615170e64e085cb0d78fad61c919433429fafa93ce32cdbf96a7c07233da1da4644750fce9f9490d8b91ffcfd5
TLSH
T161415EB246B68D5E8E115DF1FF08BD1B8EAD022C471C7DAF86D92F139793426E10154B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Preferences
Size 6KB
SHA256 769d82251acc378a4133ecf7df985acb13de38d911c28eda5920c64034b4bd7e
MD5 01878caf111239e34d049c93b4a86138
SHA1 b17895b674bea11cc5807a9e8efda4dd88394281
SHA512 2a3a588210173576710c4e361d23e3f8be4a97db9f5f9e1ede941625f370065726dd0bd7a65bc264b72dceff117134633545b66915b63704d3e1750db7cc03d6
SSDEEP 96:z6hYkOW7olIRNSuSjHv7n5dQWHuFwAxBuX796b+WVoMPktNm+TeYzb109j/i869L:zhicImv7nj/u5cXcb+WNO/zbLB1J
TLSH
T17CD18516AE34BA779CD7D219BB347B52F6F2403136850D4967FC493C09A9BDE220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Service Worker\ScriptCache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 538432ce246f97279e65f01c2d46b81ccd2cc15b1997487183c97038228c2692
MD5 423b16cfb61eea09b8cf0181003ddd7b
SHA1 5438325c9bedfb040aed2a4c323305c49fda45d0
SHA512 5a5e126f5941415fe351cd9cc32d1710744fd423c6a2f9b9431e29e8dfdcc76aeb6c91295793b822aaa2554adf4ecb949a5e2532c071a37612a927c256b4ff03
TLSH
T16DA0022501C00113C15913B165891586A3509935D242A60142E0028E8CD01B84D11150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 38bd81ed58125c68be29d440926d1bd196012650121cabc8c80cddd6095c21f9
MD5 997e5952d7fb9973912c5f700899aafa
SHA1 46a94e4f1469c8aef5d3b91858506b530dfcf0ca
SHA512 422580bf99d37d2633c76fd16af139637073672c23678ab5c909a084ee2b707e1eb12d533f5b28335f0fd55526c2e785c41af4be04ecd91eef650aa96c9032b7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b91e915b-1a4c-455c-9141-57360b7f69e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\b91e915b-1a4c-455c-9141-57360b7f69e9.tmp
Size 7KB
SHA256 10bae6ea245455fcb6b149af19ecdcf7d0e5d1ffe06789f7ce41549ac5e66093
MD5 896a7708a4ff02a92d3b4ff0c40916c6
SHA1 804ce3380327f0d2507cb8a733a9e5474d54c1e2
SHA512 56297e9334a1781cd73b8b35a33a7250626c49cf76daae918b67684f18a38a6897a12e53612acb9a1c3e73e18bf7d5cd82aa2f86027a7b110060427041fc3b84
SSDEEP 96:z6hxkOW7olIRNSuSjHv7ncQWUuFwwa/dxFuX796b+WVoMPktNm+TeYGmMk69j/GA:zkicImv7ncsuVa/3YXcb+WNO/GmV914
TLSH
T197F1C617A920BA779CD7D219BB28BB52F5F1503176910D8D6BFC893C06B9BDE2203907
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbc4f467-e197-46fb-9caf-a337624353d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Default\dbc4f467-e197-46fb-9caf-a337624353d1.tmp
Size 7KB
SHA256 4b8072271b06b06b6810e2bca4ea48ce666b3817a80cae5cea8740391313bfab
MD5 c08bab8582787939f144a1a62038ba25
SHA1 4081e8fa5064b3a92d0818caa480b20564a7d90b
SHA512 39fdcde3edcb71b1e0756ad12ee67fa61c2ca9fb596402cdfaab1021f3446d3a89610a9aebf857aec909fcab5d80d95177cc6baf0ca53226ccac8208de9584bb
SSDEEP 96:z6hxkOW7olIRNSuSjHv7nudQWHuFwwa/dxFuX796b+WVoMPktNm+TeYGmMk69j/4:zkicImv7nQ/uVa/3YXcb+WNO/GmkB1m
TLSH
T133E19617AA34BA779CD7C219BA28BB52E5F1503176C50D4D6BFC893C05B9BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\Local State
Size 940B
SHA256 256243dd2a536b90b8073f0ca88b22b6f6983bd06f61c0889e4f2e76fa621413
MD5 c761fba9937f09fe3ffefb88b3f1e167
SHA1 0df02659e3d186310e08a282e8c7c288590e153a
SHA512 f80d8efaffd2676ee305ca34cd0449f3b57bec81782c77a925dc52e0ba95d9dc4af43f93555be66403bbe812bc4c79eafd842aad7717c51da5abd488e514d18e
TLSH
T1FF11887264E86BA0BD94597861473B030E30423A9459455C61DD4332027BDB4331AC36
MD5 SHA1 SHA512 TLSH

Submit Download

33c846c2-3040-40f4-aa57-633275246b72.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\extensions_crx_cache\33c846c2-3040-40f4-aa57-633275246b72.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

feab91bc-764c-4ab5-ba4a-ef0ad280a8b4.tmp

Path C:\Users\Admin\AppData\Local\Temp\rod\user-data\577bb2ebf4cac95d\feab91bc-764c-4ab5-ba4a-ef0ad280a8b4.tmp
Size 3KB
SHA256 59f599893a97523d917a11f6bdd9e8822e0e25c3241fbb4dbfb4b7092353c474
MD5 e2cd3b01efc7fa54fd791f1abc8a2131
SHA1 087311be166937774c75ed92ddb92df76f527af1
SHA512 17712a2afa6c9bd8c6b8b2c95ca45c31ddeab75bfc087d4c366eab120ed2dbad192948b17cac293b341ffca72e1affbe8e14d590c076c457c1b6d7503636d6ac
TLSH
T13371E831A068AD7369B7FA0175877F03CEB0256BF0116FA8E1EC4A1D00EB9E81397613
MD5 SHA1 SHA512 TLSH

Submit Download

D3DCompiler_47.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\D3DCompiler_47.dll
Size 4.5MB
SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
MD5 19e527a35241c171d37dc1e6c530053c
SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
TLSH
T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome.exe
Size 4.0MB
SHA256 1867319e56bcabbc4681d8575c002106ce7b61b5290dc5eb34a37676805f6915
MD5 e337c65c03cade0d2e8df7c729c7d4f3
SHA1 5e123c70d63ea78e206bae0d3f20e86d734a8ea7
SHA512 1117af0e959b1381ee8e6096feb8c09575fe8b4a935d20029bff2285ff11f6b8bf57cc6529ab6287843c364af8bbfb4d2b260e35f3eca87f31cf9ac1f0da0dd3
SSDEEP 49152:8tNZGJo7iA/L5lA+7utTrqxkIGiu8uDw6N9fMKN2wJB6F9KIycFiRWpDgT1UDltG:YV/Ctr8Pu0DDSfYuU
TLSH
T19A165A43F19650ECC059C17887179632FA61BC494735BAEF0AD0BB222E76FE06A3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_100_percent.pak

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome_100_percent.pak
Size 709KB
SHA256 9b626898671f99b9f73c0f3293af77afdd6d784a3775b47e28663f8c10d1e3f5
MD5 3c1c5639b4b1475e5c167bae44139a2b
SHA1 26c6fc70c64c064bcd5ea931a9bf2775dfbdb037
SHA512 3c62994f65e0d36c5e80329637e5e150f4cef6355d384baaca053896ac1e74dfec00f90eb2f3a3a7f6472322423dc808fb4e41cf487620b09b98bfe22d170bd9
SSDEEP 12288:KI3H1fJwhjzgsz5B0GDJQrnKs8SNP+QSs8ilSTe+gnPzmY+WYJblIt6kjKQCrC:t3VBE7zEEmPL8bTe+gnPzmY+Jbc6kGQt
TLSH
T14AF412E77374AC7DEE9B1277826505B0FC375A680B82020A179FF8796916B48D8C93D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_200_percent.pak

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome_200_percent.pak
Size 1.2MB
SHA256 e3e2917813dce81d94c1f39236c058104f9f334d918d1c74c7a3e10b634fde5b
MD5 167dd9826a3a1ea82763b849935487e7
SHA1 1c9f6566e84d7fb2de39928be585677c5fe0a076
SHA512 b0d0e20efa1b3ac799fc4a8b1c4d824271223c7e25a8271bcd7446c977e892e6c35739cc0fc70d7b576945d5d71aa445bd45fb604bdf9955fd01416e7254b118
SSDEEP 24576:VH3zB09p2zLmmibkFR8+mZi5r8BWhQume1RvQt9e+FIQwuSXAkpbaUGQ74:d3y23mNbkFRJmQ58khQRa1QPbF8uSXAx
TLSH
T1514512D7A370DC7DDD530BB7929B40F4FD7A106B0AB2140A0627BD7A39257889AC6783
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_elf.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\chrome_elf.dll
Size 2.5MB
SHA256 5944a7ac365a5af918774dac0da5426b76da7d26c1516b94226e9746800b62c5
MD5 c33a0546a855369dbad4a41f947753eb
SHA1 6590afb0bf437363f8fa0cdaf3ded20e1b3f41ed
SHA512 241d03877e59892799d051b0ec72e5ad1c3375437fa54465403943d2f40ccd4ad1ec41fb45274efe7429af5dd6f739354d9b62d262363c61ca1e75e3d1c1f037
SSDEEP 49152:MUONYOgYST19Psl8fAfKA0mNGNuGpdOM:MU2YhED
TLSH
T120C55B53F29611ECC06EC178871B9632BA61BC494B31AAEF0790B7651E76FE06B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxcompiler.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\dxcompiler.dll
Size 23.2MB
SHA256 27c4350322166b9860f9f086cdec5773535c0f7ad3a43e21ca5f8b6bedd31d7b
MD5 6aa3704825385cf341371d83118a1b17
SHA1 9c4668db934d2a506e4948afa3fe46817800e784
SHA512 d05fdeb59c3cbd5f2064f1d7ad644dbb02e993057517be54b5735cfdc5441531b6eda19da17ec9846dea42a35dcc22fb55426b4a274115abc202d6c55bd46181
SSDEEP 196608:RVOLOxMyiZ51n3gsqJQz7KMMtEz+rrr4jOLK:RILAMyiZ51Q2Wbrr/
TLSH
T134372A122647D09DC059C879C3278B269A2834E72F67B9EFC4F491252F79EF85B39234
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxil.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\dxil.dll
Size 1.4MB
SHA256 77e039c905030a641e53658a008b74e90635a5ea9b6b79eabd0f2003bdfca59a
MD5 c9a7241ce83437d54a82522aa0b54575
SHA1 acff69399c4f17c4f20f70560fb89a9163d2b486
SHA512 8ad8c77a2368e363ad16cc1f9b3a0e4ac15634722340bdebb0e4957e7e117faaf36db2d6e08cb49127849b64844a75ebdd7e19b3f8b7e1f4412fb0066dce1ad5
SSDEEP 24576:YcuJxAR7BBPp6UMPzbOXh9/duHdFnXIqpfya8PNCdbyKE5vl5eZiE1/0Wy4r8H/2:YsHMPzbOxBduHdSCde8ZF1/0Wy4oV6bX
TLSH
T109656D6B66A800B9D4BFD174CA438E1BE7B2B45503B0EB8F16F402A61F577B15A3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\icudtl.dat
Size 10.4MB
SHA256 bd8c145abdf3f8383276ce01dfa4ae48709bef9fef1c0711eb7c3fab4f6eb7c2
MD5 0a7cbe8e902379fc03c5c6c7c08c7d3b
SHA1 18ff020331534d21f24d922d4da3c253668e44d8
SHA512 88b94c5d350c2022aa27481e3a5c6bc74dd13ed1f2157dec4219d9b847469f7191f6fdc7305f3d27533c69f146324da8fdefbd8acbd2081965e74e8926d1e9c9
SSDEEP 98304:1/cBQYOo+ddly1/rQqQC1HiXUxO/RJk3IWhlYntjndPj89o:1/cBhORok2HiXUxO/RJk3IWhlYntjdOo
TLSH
T180B62903A2FB4EC2F9FB9FB098F552779567BD49AE32805951042F3B1C333908665B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libegl.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\libegl.dll
Size 508KB
SHA256 57fd8432869f30a8394a603ce3fb1c508dc41ebf16eb44a1ee3ae5b0cffba9bb
MD5 d990e3acb6e6f52f1a383f014d40c155
SHA1 4a583f7c4b6446de8f12b6e39d9ac9c8c6f99641
SHA512 9e481fe32c4f869939615697e167edb0e9bc8bae84d4c6818f1f832620b803f2169085f92132d4b772467b07c09bec96d513155a807727417961bb4f9a548c79
SSDEEP 6144:O75dXWx+v7ul2v1ForoHHDTdNv6uxAcCloDBfAOa2IckRugMSrVD4c:EFForoHHDPvqcCMfAOa2Ic2ugMm1
TLSH
T1D6B49E15B3A987B9D47BD0348A134A42F77178910B617AEF02E092793F77BE41A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libglesv2.dll

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\libglesv2.dll
Size 8.2MB
SHA256 931b12815614a3b0111aaded211ae416aa0634894821d55bc9155f91ab86359f
MD5 0eb2f27790dd5ce33805a2e2e7602819
SHA1 e75bb28c07b3927181b0c5411564980fbb2d032d
SHA512 188edccdeb43ca1591a1df9e4ccc98cece6d56cdd6332b1307ac459e9411e1485cc6445442348ed815f242898d66a961887b2caa1de17ed02c1e7b73091423b1
SSDEEP 49152:s+mTHlS+DANLZ9yylWLRAfwwfQ2eTcQh6f9d8TdDqMpXI/L1Xed4LGA6t4GNg/3R:neVk3M1gQLggW1X5LGhi/diMqzpd8g1
TLSH
T158864A03F29290EDC459D2789757A223F6307C49032876DF1B94A7262F76FE0AB7A714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

en-US.pak

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\locales\en-US.pak
Size 485KB
SHA256 808bcd63d48cce2cf8189755edc42cdbf783195fad9fb77f42fe42c05c9413c9
MD5 6a91376d5e2fb4634eeed2413f1b3587
SHA1 059b0ba64ce3a0e81d02b5e150889be9f520bfd0
SHA512 049df0c7d3dac3fdfc317874d6b29ed8ccf2a251cf496f3668c70f8b1ae5ed6fce8e6260076ec248c5a5396a2c56f2d03b561a0bebe0fbc3d8d8cc98034ff912
SSDEEP 6144:LLiuv2O730JW8/HfI6Oh7oV90Mf9u1gc/faYf8RcbZ/gPw/:LLd30pHfITMQ1gc8w/
TLSH
T182B44C1FF744126A0A9352A27F0995B2FF32D06CA35112563CBD802C3377B66927B7E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

resources.pak

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\resources.pak
Size 14.1MB
SHA256 07375cd779de0a635f956f5187238fbaef9e472c6052f5665649c312ffc3d1fa
MD5 f1118d0681a61f21146dcc51c952aedb
SHA1 3ab9255a2293e856abfa22b65808cd935494a00a
SHA512 720db4745985349071bcf67ede8858dfe51e731c706735b6eddc2091224fce08b4891e547411d892c8aa00d6d98ed775a218e859bf459e5c164eeda858b9929f
SSDEEP 393216:Fw5mNcxSDQInPwRhBnZ1olOcWekrGbLCE:FVqS3noRhBZ1oEekGbLCE
TLSH
T164E60246B3A8C76BCE37037A425AA37F3B3594063F47A32B2464D3291C577FA4D88958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

v8_context_snapshot.bin

Path C:\Users\Admin\AppData\Local\xiaohongshu-mcp\browser\148.0.7778.215\browser\v8_context_snapshot.bin
Size 704KB
SHA256 6df7b486c558bb7540338b549ab55037563662f26b88ed2ca3d4d6809f58c5ac
MD5 aee258b2013a60c910c8d2d1146b8ef6
SHA1 2abb3ad181b3988b9c735e711615c26139228405
SHA512 e476ee926c359c4ff4e3d27321a0d8956204846ee7d6066fe0f0f7ca5d88c712f0bfbba25c0118b8bfd90d588499da015de747c63cdb6213c1a031fba00a61e3
SSDEEP 6144:2RrQKTL5XGt+HFWawonPxIa03OnvN2NdgY5aQXd94fJdpdEfSEHKZGU4iPWlaa:7YL5X4oZaIvN2NdbeHdE/NURWYa
TLSH
T116E4B771F706CE26C8A5767DCDDB9B0A3A30B2DD8EC6EB077022537CB4B86544D1A249
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads