Edit tour

Windows Analysis Report
https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg

Overview

General Information

Sample URL:	https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg
Analysis ID:	1393254
Infos:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Creates files inside the system directory

Stores files to the Windows start menu directory

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

chrome.exe (PID: 7084 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2000 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1912,i,6442693838246142779,6774848332666660311,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1772 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Boot Survival

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49735 version: TLS 1.0

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: unknown

HTTPS traffic detected: 23.1.237.91:443 -> 192.168.2.5:49735 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.51.58.94
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	TCP traffic detected without corresponding DNS query: 23.1.237.91
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-117.0.5938.132Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /s/rmorjigupr2feqhfrxe4wg HTTP/1.1Host: mp.weixin.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /t/wx_fed/weui-source/res/2.6.4/weui.min.css HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/error.ls8mpkw1edb65654.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/msg.ls8mpkw179fafd4e.css HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: styleReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/modulepreload-polyfill.ls8mpkw14abee2a4.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/core.ls8mpkw11ee63245.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/ajax.ls8mpkw1dd0db165.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/comm_report.ls8mpkw104d50b30.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/event.ls8mpkw182acd1b6.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/storage.ls8mpkw1595374ad.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/comm_utils.ls8mpkw10a4b2702.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/page_utils.ls8mpkw1dc8bd5f7.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/background_color.ls8mpkw19095a87e.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mmbizappmsg/en_US/htmledition/js/assets/set_article_read.ls8mpkw1669f1337.js HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://mp.weixin.qq.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/wx_fed/assets/res/NTI4MWU5.ico HTTP/1.1Host: res.wx.qq.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://mp.weixin.qq.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /a/wx_fed/assets/res/NTI4MWU5.ico HTTP/1.1Host: res.wx.qq.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com

Source: unknown

DNS traffic detected: queries for: clients2.google.com

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: NID=511=Ef5vPFGw-MZYo5hwe-0ThAVslbxbmvdVZwcHnqVzWHAU14v53MN1VvwvQq8baYfg2-IAtqZBV5NOL5rvj2NWIqrz377UhLdHtOgE-tJaBlUBYJEhuGsQdqni3oTJg0brqv1djdiLJyvTSUhdK-c5JWadCSsULPLzhSx-F-6wOg4

Source: chromecache_77.2.dr	String found in binary or memory: http://qq.com/s?a=b#rd
Source: chromecache_77.2.dr	String found in binary or memory: https://badjs.weixinbridge.com/badjs?id=
Source: chromecache_77.2.dr	String found in binary or memory: https://badjs.weixinbridge.com/report
Source: chromecache_77.2.dr	String found in binary or memory: https://badjs.weixinbridge.com/report?
Source: chromecache_73.2.dr	String found in binary or memory: https://github.com/weui/weui)
Source: chromecache_77.2.dr	String found in binary or memory: https://mp.weixin.qq.com/mmbizappmsg/zh_CN/htmledition/js/scripts/vconsole-3.14.6.js
Source: chromecache_80.2.dr	String found in binary or memory: https://mp.weixin.qq.com/mp/getprofiletransferpage?__biz=

Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703

Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.51.58.94:443 -> 192.168.2.5:49730 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\chrome_BITS_7084_386141534

Jump to behavior

Source: classification engine

Classification label: clean1.win@16/37@22/7

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1912,i,6442693838246142779,6774848332666660311,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1912,i,6442693838246142779,6774848332666660311,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	3 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	4 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	1 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg	0%	Avira URL Cloud	safe
https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg	0%	Virustotal		Browse

Name	IP	Active	Malicious	Reputation
q4h8hyqe.ovslegodl.sched.ovscdns.com	43.152.136.177	true	false	unknown
accounts.google.com	172.253.63.84	true	false	high
jxt2rgi0.ovslegodl.sched.ovscdns.com	43.152.136.177	true	false	unknown
5jc9c2ii.ovslegodl.sched.ovscdns.com	43.152.136.177	true	false	unknown
www.google.com	142.251.32.100	true	false	high
clients.l.google.com	142.250.80.14	true	false	high
wxa.wxs.qq.com.sched.legopic1.tdnsv6.com	211.97.81.60	true	false	unknown
mpv6.weixin.qq.com	203.205.232.110	true	false	high
file.daihuo.qq.com.sched.px-dk.tdnsv6.com	203.205.136.160	true	false	unknown
fp2e7a.wpc.phicdn.net	192.229.211.108	true	false	unknown
m0ocg00i.ovslegodl.sched.ovscdns.com	43.152.136.177	true	false	unknown
windowsupdatebg.s.llnwi.net	69.164.46.0	true	false	unknown
clients2.google.com	unknown	unknown	false	high
mpcdn.weixin.qq.com	unknown	unknown	false	high
mp.weixin.qq.com	unknown	unknown	false	high
mmbiz.qpic.cn	unknown	unknown	false	high
file.daihuo.qq.com	unknown	unknown	false	high
wxa.wxs.qq.com	unknown	unknown	false	high
res.wx.qq.com	unknown	unknown	false	high
mpcdn.qpic.cn	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/modulepreload-polyfill.ls8mpkw14abee2a4.js	false	high
https://res.wx.qq.com/t/wx_fed/weui-source/res/2.6.4/weui.min.css	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/error.ls8mpkw1edb65654.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/background_color.ls8mpkw19095a87e.js	false	high
https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/msg.ls8mpkw179fafd4e.css	false	high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false	high
https://res.wx.qq.com/a/wx_fed/assets/res/NTI4MWU5.ico	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/core.ls8mpkw11ee63245.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/comm_report.ls8mpkw104d50b30.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/set_article_read.ls8mpkw1669f1337.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/page_utils.ls8mpkw1dc8bd5f7.js	false	high
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=117.0.5938.132&lang=en-US&acceptformat=crx3,puff&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26brand%3DONGR%26ping%3Dr%253D-1%2526e%253D1	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/comm_utils.ls8mpkw10a4b2702.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/event.ls8mpkw182acd1b6.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/ajax.ls8mpkw1dd0db165.js	false	high
https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/storage.ls8mpkw1595374ad.js	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://badjs.weixinbridge.com/report?	chromecache_77.2.dr	false	high
http://qq.com/s?a=b#rd	chromecache_77.2.dr	false	high
https://mp.weixin.qq.com/mp/getprofiletransferpage?__biz=	chromecache_80.2.dr	false	high
https://badjs.weixinbridge.com/report	chromecache_77.2.dr	false	high
https://github.com/weui/weui)	chromecache_73.2.dr	false	high
https://badjs.weixinbridge.com/badjs?id=	chromecache_77.2.dr	false	high
https://mp.weixin.qq.com/mmbizappmsg/zh_CN/htmledition/js/scripts/vconsole-3.14.6.js	chromecache_77.2.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
43.152.136.177	q4h8hyqe.ovslegodl.sched.ovscdns.com	Japan	4249	LILLY-ASUS	false
142.250.80.14	clients.l.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.251.32.100	www.google.com	United States	15169	GOOGLEUS	false
172.253.63.84	accounts.google.com	United States	15169	GOOGLEUS	false
203.205.232.110	mpv6.weixin.qq.com	China	132203	TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN	false

Private

IP
192.168.2.5

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1393254
Start date and time:	2024-02-16 06:46:36 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 14s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@16/37@22/7
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
TCP Packets have been reduced to 100
Excluded IPs from analysis (whitelisted): 142.251.41.3, 34.104.35.123, 52.165.165.26, 104.117.182.73, 192.229.211.108, 72.21.81.240, 13.85.23.206, 20.3.187.198, 142.251.40.195
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, wu.ec.azureedge.net, clientservices.googleapis.com, ctldl.windowsupdate.com, wu-bg-shim.trafficmanager.net, wu.azureedge.net, fe3cr.delivery.mp.microsoft.com, fe3.delivery.mp.microsoft.com, edgedl.me.gvt1.com, ocsp.digicert.com, ocsp.edge.digicert.com, bg.apr-52dd2-0503.edgecastdns.net, cs11.wpc.v0cdn.net, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, hlb.apr-52dd2-0.edgecastdns.net, update.googleapis.com, glb.sls.prod.dcat.dsp.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 16 04:47:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2677
Entropy (8bit):	3.969530204232574
Encrypted:	false
SSDEEP:	48:8Hbd+T666HMidAKZdA19ehwiZUklqehN5y+3:8Hc/V05y
MD5:	7042A558C01086182A50496C8B605A7E
SHA1:	F96781B461B305CB976A51E51561936104AA38F0
SHA-256:	CD57B1B36C6A66D8D18D781573174ABC8D420C81A4F7DEDA3AB887041FD2FAA3
SHA-512:	349A4D8324BEE012BAD712C962B5D9BADAEDA49AB8337C0371FAD6E7AE5305BB3B3F82EAAD1DA2A7D056C1B9CD21434758153EEE0BB7CF48F3D797711DE5F3F7
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,.....>s..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPX.-...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 16 04:47:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2679
Entropy (8bit):	3.9846699226142714
Encrypted:	false
SSDEEP:	48:8Cd+T666HMidAKZdA1weh/iZUkAQkqehk5y+2:8X/P9Q35y
MD5:	D1E99E03EBEA3644B21EB30EAE8AC168
SHA1:	51582F4D9769128397C8A9D9AECF9908802F4727
SHA-256:	1AA5BE91B93F0E547BE0AB692C13C72E03E0908285FC0C6AAC41BB620A1E76FF
SHA-512:	46E95753B1A8527454CBC590A105025CFF000B1F83458713FC69640757E7A53362A314CDD2DC7C02FA6D65286E1BCF7B74F5D21FCFEC6EEAC848755AB96DDDCA
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......f..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPX.-...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Wed Oct 4 12:54:07 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2693
Entropy (8bit):	3.999328229133787
Encrypted:	false
SSDEEP:	48:8xDd+T66sHMidAKZdA14tseh7sFiZUkmgqeh7sW5y+BX:8xk/Jn45y
MD5:	FE1A636D8FE580B45417CA74D5C5B399
SHA1:	2188C9BD941AA0DD134B17053BDCA6F23D06FA05
SHA-256:	C5236696455F0467850809238A5CC56CC29FB2252434CFDA44F4464E45570D68
SHA-512:	FCA3B8B1508966DC7C481439B3C5BD44D758684D260DBC0E7DB52D1BC06AF1B389A09E53DB6DA15B09464368150F2AB87F197AA9E3E338DBE6C155BC3BDB6038
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......e>....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VDW.n...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 16 04:47:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.9834595649482947
Encrypted:	false
SSDEEP:	48:8Id+T666HMidAKZdA1vehDiZUkwqehA5y+R:8d/se5y
MD5:	382E02AF3DBC8E46BF678F4C5FABA97D
SHA1:	FFD55EBCC5C443F61DD96FADC047C594428773B6
SHA-256:	570DE8FF8098FEBE4FB2E3B40CC1098C7A5CC3BD906DB76CB6C998F92FA3BF12
SHA-512:	AD9C75BB83F8259B7678F89BAEE83C64C9A8A5B797C45DAE6C68C37699B6785697509DE2C65A4BEA78F76740DFC41A7DE0C995FB6873C0743C52223617A47566
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....e.`..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPX.-...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 16 04:47:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2681
Entropy (8bit):	3.973319690120397
Encrypted:	false
SSDEEP:	48:8gd+T666HMidAKZdA1hehBiZUk1W1qeh65y+C:81/c9a5y
MD5:	29FF6CA99D483A1B7C1576CE15973215
SHA1:	B727CE37B6C027553D89B519CA378DA21BCDB69C
SHA-256:	5E4C08DD09984E9E40A3EF6797E61CFBC760615E3D819CA839837606F9AB4313
SHA-512:	255C693A26C709F74FCB01F017ADEEC8EB37F26ACAF4C24A7912E0E1277E2820E7F3C0F4F1C89258743A7C8EF9B47C9164A02B8B5BA7FD1EB6474275A9CD37A2
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,......l..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPX.-...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Feb 16 04:47:27 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2683
Entropy (8bit):	3.985197018892971
Encrypted:	false
SSDEEP:	48:8jd+T666HMidAKZdA1duT+ehOuTbbiZUk5OjqehOuTb45y+yT+:8E/yT/TbxWOvTb45y7T
MD5:	01A6C7EE23C0CCF7D9A9CFAE12DCB835
SHA1:	5C848E129C91D255D0E2FA2BDAE977C7C7BE930B
SHA-256:	533FA3ABF2547BD117A4798BB06A99CF4508F95D23E49916E519A15AC763CC4B
SHA-512:	BFCDFC09989D0111C56AE9348B2D5D9C9CF07726F5240821CDEC578174B12E1787B9443D0C13DB3FF99C32AE263FF83364995A3654BA7EC2C530DD94444DF453
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....u.Y..`..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....DWWn..PROGRA~1..t......O.IPX.-....B...............J......SX.P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.VPX.-....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.VPX.-....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.VPX.-..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VPX.-...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i.............e......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Chrome Cache Entry: 71

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (5665)
Category:	downloaded
Size (bytes):	5666
Entropy (8bit):	5.223113937562309
Encrypted:	false
SSDEEP:	96:cXhJpFlMUhKvjR2HZXoh+qYyRztSqBoh3qBohvpieeRTfmFTmeZtEdsEGpDpbVdv:abpIUmjqZXoh+dStSWoh3WohfEmFieZf
MD5:	58BFCA16D41B93C0CE33B239E9C97645
SHA1:	3E23F6A70F1DA3265C8FAF9DF01AA64F3BC88B45
SHA-256:	9B7B7120A9266BC79597D5678565D0DD3793B4D49684B6924FB6A12EF63B2FAE
SHA-512:	0D53765D61C5BF14BD82DC70A2F0C6803F10E2157E218BCF54ECC6FCA4456204DF446901D2CEAE0FF9D580357159AE35EDD9F00BB36E8FCD23A7E5574F2F444A
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/comm_report.ls8mpkw104d50b30.js
Preview:	import{c as e,U as t,A as o,m as r}from"./ajax.ls8mpkw1dd0db165.js";import{J as n}from"./core.ls8mpkw11ee63245.js";const c=-1!==navigator.userAgent.indexOf("TBS/");let a=[],s=[],p={};function i(e){const o={};return void 0!==window.uin&&(o.uin=window.uin),void 0!==window.key&&(o.key=window.key),void 0!==window.pass_ticket&&(o.pass_ticket=window.pass_ticket),void 0!==window.wxtoken&&(o.wxtoken=window.wxtoken),void 0!==window.devicetype&&(o.devicetype=window.devicetype),void 0!==window.clientversion&&(o.clientversion=window.clientversion),void 0!==window.appmsg_token?o.appmsg_token=window.appmsg_token:e.indexOf("advertisement_report")>-1&&((new Image).src="".concat(location.protocol,"//mp.weixin.qq.com/mp/jsmonitor?idkey=68064_13_1&r=").concat(Math.random())),o.x5=c?"1":"0",o.f="json",t.join(e,o)}function l(e){return e&&"object"==typeof e}function u(e,t){if(l(e)&&l(t))for(const o in t)Object.prototype.hasOwnProperty.call(t,o)&&(e[o]=t[o])}function g(t){const o=[];o.push({content:"[LeaveRe

Chrome Cache Entry: 72

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1993)
Category:	downloaded
Size (bytes):	1994
Entropy (8bit):	5.293265295781153
Encrypted:	false
SSDEEP:	48:Gsy5x29qbhtCq7sZntJGbgGbtiGbEfLx9FfYFGq1:Gsureq7sZnmyTx9FAFGq1
MD5:	229AFC96C86F32EDAF9D1F46A3CDB631
SHA1:	A82430DB2A707C211C20DDB70898F970C3418C6B
SHA-256:	5D855AE7694C4527A8D916752E6D46A6E9D01B4F36D22CA2750AE547E1BC1D3B
SHA-512:	A2C1FBD404914F4AC817CCF6B2D7ABC6F8BB9D1972171EA0297516BAAAFFA45B6D06A6DFD1D5E3AAD6FF5A04BC44E0515D0A451B0549F7626D6BA498903210A5
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/background_color.ls8mpkw19095a87e.js
Preview:	import{m as o,J as t}from"./core.ls8mpkw11ee63245.js";import{p as a}from"./page_utils.ls8mpkw1dc8bd5f7.js";var e,r;(r=e\|\|(e={}))[r.light=0]="light",r[r.dark=1]="dark";const n=o=>{const t=document.body.appendChild(document.createElement("div"));return t.className="wx-root",t.dataset.weuiTheme=o,window.getComputedStyle(t)},l=n("light"),c=n("dark"),i={light:{},dark:{}},d=(o,t,e)=>{if(!e&&i[t].hasOwnProperty(o))return i[t][o];let r=a.trim(("light"===t?l:c).getPropertyValue(o));return/^#[\da-f]{3}$/i.test(r)&&(r=r.split("").map((o=>"#"===o?o:"".concat(o).concat(o))).join("")),i[t][o]=r,r},s={get:(o,t,a)=>"light"===t\|\|"dark"===t?d(o,t,a):[d(o,"light",a),d(o,"dark",a)]},u=s.get("--weui-BG-2"),k=o.gtVersion("7.0.12",!0),m={nav:[],top:[],bottom:[]},p=({matches:o})=>{var a,e,r;const n=o?1:0;t.invoke("setNavigationBarColor",{color:null===(a=m.nav)\|\|void 0===a?void 0:a[n]},(o=>{"function"==typeof m.callback&&m.callback(o)})),t.invoke("setBounceBackground",{backgroundColor:null===(e=m.top)\|\|void 0=

Chrome Cache Entry: 73

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65420)
Category:	downloaded
Size (bytes):	152063
Entropy (8bit):	5.489481833635334
Encrypted:	false
SSDEEP:	1536:PY93S3DpdcxVLQS7Yyb3IOIItVPA4sKiakOBNy6YXYMcqCOHMOH87s2p3pYJWTIB:uhb3IOIyHM
MD5:	4E30F812030C6DD3DFEC9DF9C3FB9AAD
SHA1:	645CD30C06667423FACBA18A0F213F5291BEB9DB
SHA-256:	0F279C8C8F647861D509CB76A7586A4912062BED4E3861D774CFD79C596852DA
SHA-512:	4F82297C666DEE59B475EA78F144268DA300BA288F62915B1D0CB8538C3DC4A348E7CBF2709361456334264D8EACEDCA642EA459036DF97C13AC4D9378AA36CF
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/t/wx_fed/weui-source/res/2.6.4/weui.min.css
Preview:	/!. WeUI v2.6.4 (https://github.com/weui/weui). * Copyright 2023 Tencent, Inc.. * Licensed under the MIT license. */.wx-root,body,page{--weui-BTN-HEIGHT:48;--weui-BTN-HEIGHT-MEDIUM:40;--weui-BTN-HEIGHT-SMALL:32}.wx-root,body{--weui-BTN-ACTIVE-MASK:rgba(0,0,0,.1)}.wx-root[data-weui-theme=dark],body[data-weui-theme=dark]{--weui-BTN-ACTIVE-MASK:hsla(0,0%,100%,.1)}@media (prefers-color-scheme:dark){.wx-root:not([data-weui-theme=light]),body:not([data-weui-theme=light]){--weui-BTN-ACTIVE-MASK:hsla(0,0%,100%,.1)}}.wx-root,body{--weui-BTN-DEFAULT-ACTIVE-BG:#e6e6e6}.wx-root[data-weui-theme=dark],body[data-weui-theme=dark]{--weui-BTN-DEFAULT-ACTIVE-BG:hsla(0,0%,100%,.126)}@media (prefers-color-scheme:dark){.wx-root:not([data-weui-theme=light]),body:not([data-weui-theme=light]){--weui-BTN-DEFAULT-ACTIVE-BG:hsla(0,0%,100%,.126)}}.wx-root,body{--weui-DIALOG-LINE-COLOR:rgba(0,0,0,.1)}.wx-root[data-weui-theme=dark],body[data-weui-theme=dark]{--weui-DIALOG-LINE-COLOR:hsla(0,0%,100%,.1)}@media (pre

Chrome Cache Entry: 74

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (1393)
Category:	downloaded
Size (bytes):	1394
Entropy (8bit):	5.38079470431926
Encrypted:	false
SSDEEP:	24:xv99YWRsyul1YyLinBlwiBXLXvbSuq+HohTCFSDohCTO1YLkRRY2gujUFmRx+yno:xkWRsNnYy2TDBXLzHoh1DohCeYLkRgaC
MD5:	5629C8E3C94724D1E10E012AB9857062
SHA1:	EB8859E167965BC7042E4AAFCCCB16D8B3301245
SHA-256:	A2D47143D625733DE98E103C3FF43784B84B4CFDC879D05BD710444BD2092363
SHA-512:	3E2209F00CE93A92713A2C4B1E364F87748F14D69A3C143F05C2489E59B17F25EFF4163730D9279B35CF328496B9F2A263CAE8F04B5D03461596A44A6D2F9E62
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/set_article_read.ls8mpkw1669f1337.js
Preview:	import{J as e}from"./core.ls8mpkw11ee63245.js";import{D as o}from"./event.ls8mpkw182acd1b6.js";import{u as t}from"./comm_utils.ls8mpkw10a4b2702.js";const n=[];let r;r\|\|(r={}),r[r.kRead=1]="kRead",r[r.kLike=2]="kLike",r[r.kSeen=3]="kSeen",r[r.kShare=4]="kShare",r[r.kFavorite=5]="kFavorite",r[r.kComment=6]="kComment",r[r.kReward=7]="kReward",r[r.kSubscibe=8]="kSubscibe",r[r.kRead20Percent=9]="kRead20Percent",r[r.kReadOver=10]="kReadOver";const s=(o,t=1)=>{if("169"!==window.source)return;const r=n.indexOf(o);-1===r&&1===t?n.push(o):r>-1&&0===t&&n.splice(r,1),console.log("[reportRecommend] params: ".concat(JSON.stringify(n))),e.invoke("handleMPPageAction",{action:"reportRecommend",reportData:JSON.stringify({action:n})},(e=>{console.log("[reportRecommend] res: ".concat(JSON.stringify(e)))}))},a=o=>{e.invoke("handleMPPageAction",{action:"syncReadState",state:o},(e=>{console.log("[set artile read]",o?"read":"unread",e)}))},c=()=>{if(-1===[0,10,8].indexOf(1*window.item_show_type))return;const

Chrome Cache Entry: 75

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (945)
Category:	downloaded
Size (bytes):	946
Entropy (8bit):	5.279003636434029
Encrypted:	false
SSDEEP:	24:bX9UXQMvNCBxmovQB4pWTIzfkcVgLYJiT1eY:bX9abvNyxmooBYWTIEYJiZ9
MD5:	F7FB472ACFED4CA3511183D4FD417467
SHA1:	8445B37DA1B4A7F07B2020EB47239BB62C20A5B4
SHA-256:	DD622774BDBF2143C7F8BCD44D082EC08C8DC95D1B0BA99081F58B8B1B4D6549
SHA-512:	DD2407CFC17A828DFB4301B6DF8F34F17B6F5B13DFF6905EB6DC8784EF6234226EDA09492C279543FE26A0499D6A41BD9D7D4644252010196A98D3972849502F
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/error.ls8mpkw1edb65654.js
Preview:	function o(){import.meta.url,import("_").catch((()=>1))}import"./modulepreload-polyfill.ls8mpkw14abee2a4.js";/* empty css */import{J as i}from"./core.ls8mpkw11ee63245.js";import{B as m}from"./background_color.ls8mpkw19095a87e.js";import{s as r}from"./set_article_read.ls8mpkw1669f1337.js";import"./page_utils.ls8mpkw1dc8bd5f7.js";import"./ajax.ls8mpkw1dd0db165.js";import"./comm_report.ls8mpkw104d50b30.js";import"./event.ls8mpkw182acd1b6.js";import"./comm_utils.ls8mpkw10a4b2702.js";import"./storage.ls8mpkw1595374ad.js";m.set(),r(1),window.is_rumor&&!window.norumor&&window.biz&&window.mid?document.referrer&&-1!==document.referrer.indexOf("mp.weixin.qq.com/mp/rumor")\|\|(location.href=location.protocol+"//mp.weixin.qq.com/mp/rumor?action=info&__biz="+window.biz+"&mid="+window.mid+"&idx="+window.idx+"&sn="+window.sn+"#wechat_redirect"):(i.invoke("hideToolbar"),i.invoke("hideOptionMenu"));export{o as __vite_legacy_guard};.

Chrome Cache Entry: 76

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (55613), with NEL line terminators
Category:	downloaded
Size (bytes):	102920
Entropy (8bit):	5.7141956103165175
Encrypted:	false
SSDEEP:	1536:nmfFI3GgOCI0y/w6rFgxFBkU1AaP7y+ohn:nm+CTY6r6xgUyo7dohn
MD5:	42192E33698E5E4A5A0B4B2F9EF4F97A
SHA1:	211EEB63484074C048B2FFE9E062E3DCD1583574
SHA-256:	F952832D12FE914C9810B6C9B29B705ACACD5A07F71C4D6D58E216E6A0740A55
SHA-512:	33C93986E8BAB8EAE5305A36AF3423A552A73AC994BEC23C0A0363E25D97C4464E76855CFAA871405A41F64A59C516A0A3ED5E4E8E3E8B56FDF063C458489E38
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/ajax.ls8mpkw1dd0db165.js
Preview:	import{m as mmVersion,i as invoke,J as JSAPI}from"./core.ls8mpkw11ee63245.js";var commonjsGlobal="undefined"!=typeof globalThis?globalThis:"undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof self?self:{};function getDefaultExportFromCjs(e){return e&&e.__esModule&&Object.prototype.hasOwnProperty.call(e,"default")?e.default:e}var index_umd_min={exports:{}};"undefined"!=typeof self&&self,index_umd_min.exports=function(e){var t={};function n(o){if(t[o])return t[o].exports;var r=t[o]={i:o,l:!1,exports:{}};return e[o].call(r.exports,r,r.exports,n),r.l=!0,r.exports}return n.m=e,n.c=t,n.d=function(e,t,o){n.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:o})},n.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},n.t=function(e,t){if(1&t&&(e=n(e)),8&t)return e;if(4&t&&"object"==typeof e&&e&&e.__esModule)return e;var o=Object.create(null

Chrome Cache Entry: 77

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (456)
Category:	downloaded
Size (bytes):	26427
Entropy (8bit):	4.944053353827035
Encrypted:	false
SSDEEP:	768:gPnJZH/i0K3QxnN31TQxRHa3Vp4ghGIVfq7o7ss:gPnJZP7TSHa3Vp4ghGIVfqkN
MD5:	649590745D9B3B74F96D2F8062BC5DFE
SHA1:	F838AFDEAD32705C6D1AF821846F359A6447D621
SHA-256:	BB793EAF3728F366ECFCB683580A49982224ECB3462333C4DD3B659F55D934ED
SHA-512:	1F2971080ADAD81BFB9A7CB9DDB25386908394F6D39FFD8E29417A0FD52574293E12EFF7E174D8D98A41425246468669FEDA513C78039A62B0B04B772A135FD5
Malicious:	false
Reputation:	low
URL:	https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg
Preview:	<!DOCTYPE html>.<html class="">. <head>. <meta name="wechat-enable-text-zoom-em" content="true">.<meta http-equiv="Content-Type" content="text/html; charset=utf-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<meta name="color-scheme" content="light dark">.<meta name="viewport" content="width=device-width,initial-scale=1.0,maximum-scale=1.0,user-scalable=0,viewport-fit=cover">.<link rel="shortcut icon" type="image/x-icon" href="//res.wx.qq.com/a/wx_fed/assets/res/NTI4MWU5.ico" reportloaderror>.<link rel="mask-icon" href="//res.wx.qq.com/a/wx_fed/assets/res/MjliNWVm.svg" color="#4C4C4C" reportloaderror>.<link rel="apple-touch-icon-precomposed" href="//res.wx.qq.com/a/wx_fed/assets/res/OTE0YTAw.png" reportloaderror>.<meta name="apple-mobile-web-app-capable" content="yes">.<meta name="apple-mobile-web-app-status-bar-style" content="black">.<meta name="format-detection" content="telephone=no">.<meta name="referrer" content="origin-when-cross-origin">.<meta name="referrer" con

Chrome Cache Entry: 78

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.720123455680749
Encrypted:	false
SSDEEP:	12:6v/7io5W7AFNuQrqZLJVG8Uc3gd3/Ohk0DZyhViJFo5iJIO+2z1xon4C6l0hq4Zt:xqNuQrCVG9cAgky88JD+wf/0gT+l
MD5:	5281E972EC463897022F56464011B5ED
SHA1:	2A719C124449E0C31A0166CEA7867BB1A44780BD
SHA-256:	A62D7D84BD02B1718106D294D1F2C8387F9967239696C1E8B446201B63F34DC7
SHA-512:	D5FC5821A1BA50F444665B01D3004EBD7546AE6B6A696C80CA4601C1ECDAED6632342381711055E65B86703D103BB38ABD3A591FB21254ED4C934F0E41968B40
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR... ... .....szz.....IDATX..Ah.g.....Yk.J.1..Y.V.G/=.E.....^.."..T<....)..y.". ..]....J...DDdSc3..e).B.l.\|.......F..{....{..a...z.........F..l....kUA.T.tSY........n([..k,2;..^Z....N:..~.By..xm..7f....{-p+....hx!...k..s...f#....t.g...............M......=..f>.y."P.,../..Z;........\|T.pK.g._..Kz.D).Q.....Z.....c.........m.t...].~e.Sf.P..of...o..M.#.S...R..7..Ca`.xb......@..7L\J.b..M8wn........^f.\|9Z.,...[....=..8.\..a....(N....L.Fp.8U,.x%o..p..Q.#.J..1cg.b.d..i.TK...F.#.....p ..f.H.5(...$.q..[.C.$.:6."f.8.[oK@.u.q^....,..}.B?......\..... .._.OV...t...6\|...h..vIG..!...N..p......~..L......p.`4(...j.7....\g...i8.._..\|).7.g.;..N......o..v.{.......m..}?....{_....'TA.j.....L.!.O.qyv....*..X..>l.{.:._.?sg......}u.w..W.MDD.j..j..o..g.iq.q.....e..e\|.....t.."...r......IEND.B`.

Chrome Cache Entry: 79

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (6446)
Category:	downloaded
Size (bytes):	6467
Entropy (8bit):	5.488787477780053
Encrypted:	false
SSDEEP:	192:V9qIspQAsHCX7DLQJ+yQRgeBenjlu1BIXhegelv3YWg:V9qIspQ9HCXbQJ+yQRgeBenj9RegeNe
MD5:	40423FEC05F2E9DD2C766E6512FCB9F3
SHA1:	00F3AE1E2600E51DAFB7F8CB2CD365B828608336
SHA-256:	B1E5A9060317D4AE97AD92FD3978DBD09C2D369ACB9DCAC6989DEAD5967CB903
SHA-512:	47F7886760C08819EEE10DB047A0C67E714859E721BB3BB03D6E4E3C0E12BA4DEA33490645926416F784C03A3ECEBBD273A10B0ACF75465BF6B0EF6018B0220E
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/core.ls8mpkw11ee63245.js
Preview:	const e=navigator.userAgent,t=/(iPhone\|iPad\|iPod\|iOS)/i.test(e),n=/Windows\sPhone/i.test(e),o=/(Android)/i.test(e),i=/MicroMessenger\/([\d\.]+)/i.test(e),r=/mac\sos/i.test(e)&&!t,c=/windows\snt/i.test(e)&&!n,s=/MPAPP\/([\d\.]+)/i.test(e),a=/iPad/i.test(e),d=/WindowsWechat/i.test(e),p=/MacWechat/i.test(e)\|\|/wechat.mac os/i.test(e),w=i&&window.WeixinPrefecherJSBridge,l=/SAAASDK/i.test(e),f=o&&/miniprogram/.test(e.toLowerCase())\|\|"miniprogram"==window.__wxjs_environment,u=/wxwork/i.test(e);function g(){const t=e.match(/MicroMessenger\/([\d\.]+)/i);return!(!t\|\|!t[1])&&t[1]}function m(){const t=e.match(/MacWechat\/([\d\.]+)/i);return!(!t\|\|!t[1])&&t[1]}function h(){const t=e.match(/wxwork\/([\d\.]+)/i);return!(!t\|\|!t[1])&&t[1]}function W(){let e=[2,4,5];const t=navigator.userAgent.match(/MPAPP\/(\d+(\.\d+))/);return t&&(e=t[1].split(".").map((e=>Number(e)))),e.join(".")}function b(e){return Number(Number("0x"+e).toString(10))}function _(){const t=e.match(/MicroMessenger\/[\d\.]+$0x(.+?)$

Chrome Cache Entry: 80

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Unicode text, UTF-8 text, with very long lines (14449)
Category:	downloaded
Size (bytes):	14514
Entropy (8bit):	5.4150272974626485
Encrypted:	false
SSDEEP:	384:RDpQjAf5wTpPKnm1trh8NT/qlnP2gI7DZTwYKeuH4HBJqVNLRg:RNm05wTpPImHrh89/onPSKew4HBJgLRg
MD5:	F1919C9443447E8F6A9278440BFC3085
SHA1:	7E7A6C16B3B774FA225D9F06CC7300F5815030F6
SHA-256:	78BFA5B0121825D52AEC922F7763A4C5EFBF5E56318DD5BE4BFCB7C6B8C176A8
SHA-512:	9A83B34B7C80337EDFA15ACDA419CF9A4C764F91ED7D30D409AE3A93A87D957CA4B1F39C3039249B6F6F391D4A0642415799284AE12E37CD131EB1D50B528EFC
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/page_utils.ls8mpkw1dc8bd5f7.js
Preview:	import{w as e,U as t}from"./ajax.ls8mpkw1dd0db165.js";import{w as n}from"./comm_report.ls8mpkw104d50b30.js";import{m as o,J as i,i as r}from"./core.ls8mpkw11ee63245.js";import{D as a}from"./event.ls8mpkw182acd1b6.js";import{u as c}from"./comm_utils.ls8mpkw10a4b2702.js";function s(e,t,n,a){let c;if(0==e.indexOf("/")&&(c=function(e){const t=document.createElement("a");return t.href=e,{source:e,protocol:t.protocol.replace(":",""),host:t.hostname,port:t.port,query:t.search,params:function(){const e={},n=t.search.replace(/^\?/,"").split("&");let o,i=n.length,r=0;for(;r<i;r++)n[r]&&(o=n[r].split("="),e[o[0]]=o[1]);return e}(),file:(t.pathname.match(/([^\/?#]+)$/i)\|\|[,""])[1],hash:t.hash.replace("#",""),path:t.pathname.replace(/^([^\/])/,"/$1"),relative:(t.href.match(/tps?:\/\/[^\/]+(.+)/)\|\|[,""])[1],segments:t.pathname.replace(/^\//,"").split("/")}}(location.href),e=c.protocol+"://"+c.host+e,console.log("openUrlWithExtraWebview with relative path:",e)),e=e.replace(/(#[^#]*)+/,(function(e,t,n

Chrome Cache Entry: 81

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	827
Entropy (8bit):	7.720123455680749
Encrypted:	false
SSDEEP:	12:6v/7io5W7AFNuQrqZLJVG8Uc3gd3/Ohk0DZyhViJFo5iJIO+2z1xon4C6l0hq4Zt:xqNuQrCVG9cAgky88JD+wf/0gT+l
MD5:	5281E972EC463897022F56464011B5ED
SHA1:	2A719C124449E0C31A0166CEA7867BB1A44780BD
SHA-256:	A62D7D84BD02B1718106D294D1F2C8387F9967239696C1E8B446201B63F34DC7
SHA-512:	D5FC5821A1BA50F444665B01D3004EBD7546AE6B6A696C80CA4601C1ECDAED6632342381711055E65B86703D103BB38ABD3A591FB21254ED4C934F0E41968B40
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/a/wx_fed/assets/res/NTI4MWU5.ico
Preview:	.PNG........IHDR... ... .....szz.....IDATX..Ah.g.....Yk.J.1..Y.V.G/=.E.....^.."..T<....)..y.". ..]....J...DDdSc3..e).B.l.\|.......F..{....{..a...z.........F..l....kUA.T.tSY........n([..k,2;..^Z....N:..~.By..xm..7f....{-p+....hx!...k..s...f#....t.g...............M......=..f>.y."P.,../..Z;........\|T.pK.g._..Kz.D).Q.....Z.....c.........m.t...].~e.Sf.P..of...o..M.#.S...R..7..Ca`.xb......@..7L\J.b..M8wn........^f.\|9Z.,...[....=..8.\..a....(N....L.Fp.8U,.x%o..p..Q.#.J..1cg.b.d..i.TK...F.#.....p ..f.H.5(...$.q..[.C.$.:6."f.8.[oK@.u.q^....,..}.B?......\..... .._.OV...t...6\|...h..vIG..!...N..p......~..L......p.`4(...j.7....\g...i8.._..\|).7.g.;..N......o..v.{.......m..}?....{_....'TA.j.....L.!.O.qyv....*..X..>l.{.:._.?sg......}u.w..W.MDD.j..j..o..g.iq.q.....e..e\|.....t.."...r......IEND.B`.

Chrome Cache Entry: 82

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Java source, ASCII text, with very long lines (6012)
Category:	downloaded
Size (bytes):	6013
Entropy (8bit):	5.367171578496696
Encrypted:	false
SSDEEP:	96:2FcFLR2LYPqP8mnbsjqQ5m9d3u1GoFhEu1Fgm+VP3LOgBPQ+gLCVdUoh4t2q2q4B:2FcFLR2LYPqP8m53GGoFhEGFgm+p7O1I
MD5:	1EC9DCF228477B31430560B2849C17E4
SHA1:	568B8751582F5783AE1FD5755FAACD989C558AE7
SHA-256:	85CCEED9582ADEFA9EF29AEB1E50E48B87C8E7DF4438AB9DDAD1972382A80D5D
SHA-512:	4CC470AE74F7CC1C2E4A522094D74D6AAAB101F4AB51B76B641B6155016CCBC45DF7AE87F07DCE4D5B5C3D2A80C5C5D0E23D9777A39004D3182395C8F9501F90
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/comm_utils.ls8mpkw10a4b2702.js
Preview:	import{U as e,j as t,$ as n,c as o}from"./ajax.ls8mpkw1dd0db165.js";import{J as i,m as r}from"./core.ls8mpkw11ee63245.js";import{L as s}from"./storage.ls8mpkw1595374ad.js";import{D as a}from"./event.ls8mpkw182acd1b6.js";try{void 0===parent.window.hasListenMpPageAction&&(parent.window.hasListenMpPageAction=!1),void 0===parent.window.hasListenStateChange&&(parent.window.hasListenStateChange=!1)}catch(y){}const c=[],g=[],l=new s("history4secondopen"),p="from";let d=!1,h={status:"loading"};const w=[];function f(){return"1"===e.getQuery("isNativePage")\|\|"2"===e.getQuery("isNativePage")}function u(e,t=50){let n;return function(...o){const i=this;n\|\|(n=setTimeout((()=>{n=null,e.apply(i,o)}),t))}}function m(e,t){return!(t.right<e.left\|\|t.left>e.right\|\|t.bottom<e.top\|\|t.top>e.bottom)}const _={isNativePage:f,isNewNativePage:()=>"2"===e.getQuery("isNativePage"),isOldNativePage:()=>"1"===e.getQuery("isNativePage"),__useWcSlPlayer:!1,isWcSlPage:()=>_.__useWcSlPlayer,getPlayerType:()=>_.isWcSlPage()

Chrome Cache Entry: 83

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3703)
Category:	downloaded
Size (bytes):	3704
Entropy (8bit):	5.135547836392783
Encrypted:	false
SSDEEP:	96:YxhB9A+wjhBrbrXZZrEsZbrJysxZ3wxyFDxs5X0YBZi:gBJgv4KskZgIm5X0wi
MD5:	929EB4B30C9C5810BEBE3638BD573569
SHA1:	2798CB163052E2554B59940C82B66682B98B932C
SHA-256:	EE368004FC6A492D72CE76B456062BDBB99845DF643CD9AC4A071AD6DFB04138
SHA-512:	58F035B12446137C8599389859E379431B904B895D83C2B482AAD1FD0F79AC360E5BB640F3C3047B02B21C12199A10D39CEDA2F09CB75321A245B251B00C55A4
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/event.ls8mpkw182acd1b6.js
Preview:	const t=navigator.userAgent,e={x:0,y:0,isPc:/(WindowsNT)\|(Windows NT)\|(Macintosh)/i.test(navigator.userAgent),isWp:/Windows\sPhone/i.test(t),tsTime:-1},n=["webkit","moz","ms","o"];let i;function o(){return!e.isPc&&!e.isWp}function c(t,n,c,a){o()?(n.tap_handler=function(t){if(-1==e.tsTime\|\|+new Date-e.tsTime>200\|\|i&&(new Date).getTime()-i<200)return;const o=t.changedTouches[0];return Math.abs(e.y-o.clientY)<=5&&Math.abs(e.x-o.clientX)<=5?n.call(this,t):void 0},r(t,"touchend",a,n.tap_handler,c)):r(t,"click",a,n,c)}function a(t,n,i,o,c){const a=this;let u;if(e.isPc\|\|e.isWp){let e,i,l,s=!1;r(t,"mousedown",o,(function(t){l=!1,s=!0,e=t.clientX,i=t.clientY,u=setTimeout((function(){l=!0,u=void 0,n.call(this,t)}),500),t.preventDefault()})),r(t,"mousemove",o,(function(t){s&&u&&(Math.abs(i-t.clientY)>5\|\|Math.abs(e-t.clientX)>5)&&(clearTimeout(u),u=void 0,"function"==typeof c&&c.call(a,t))})),r(t,"mouseup",o,(function(){s=!1,clearTimeout(u)})),r(t,"click",o,(function(){if(l)return!1}))}else r(t,"t

Chrome Cache Entry: 84

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (3331)
Category:	downloaded
Size (bytes):	3332
Entropy (8bit):	5.144619886080275
Encrypted:	false
SSDEEP:	96:xxbprnD5TdNnqW1pqDZHRUsYZ6crhwUXNK5:xxlvNn/W9e5EGhZC
MD5:	0397723DBB921F24130AED23A308118E
SHA1:	D25B0D1172C3275C2C26CABE30B965265F4A227A
SHA-256:	7854CA98A28BB2FBAF83D6E06BE4FBE7CB0A972C2D61EB7258FD470EF8B7EBBC
SHA-512:	B2AEC2ECE274E410D6E118ABCC5E693CE4BD643A5646B7A86201412C4D75406B565C69506F3FA36DF9D5A6663AB3F2151BF06658008C1CB083946F6C929E8731
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/storage.ls8mpkw1595374ad.js
Preview:	const t="__WXLS__",e=window.localStorage\|\|{getItem:function(){},setItem:function(){},removeItem:function(){},key:function(){},clear:function(){var t,e;null===(e=null===(t=window.localStorage)\|\|void 0===t?void 0:t.clear)\|\|void 0===e\|\|e.call(t)},length:0},o={noeviction:t=>t,"allkeys-random"(t,e){let o=Object.keys(t),n=0;for(;n<e;){const e=o.length,i=o[Math.floor(Math.random()*e)];n+=JSON.stringify(t[i]).length,delete t[i],o=Object.keys(t)}return t},"volatile-ttl"(t,e){let o=Object.keys(t);o=o.sort((function(e,o){const n=t[e],i=t[o];return n.exp<i.exp?-1:n.exp>i.exp?1:0}));let n=0;for(let i=0;i<o.length&&!(n>=e);i++){const e=o[i];n+=JSON.stringify(t[e]).length,delete t[e]}return t},"clear-all":()=>(e.clear(),{})};class n{constructor(t,e,n){if(this.logger=()=>{},!t)throw"require function name.";this.evictionPolicy="noeviction",this.key=t,"function"==typeof n&&(this.logger=(t,e)=>n(function(t){return"[WXLS] ".concat(t)}(t),e)),e&&-1!==Object.keys(o).indexOf(e)&&(this.evictionPolicy=e),this.

Chrome Cache Entry: 85

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (705)
Category:	downloaded
Size (bytes):	706
Entropy (8bit):	4.873931878978379
Encrypted:	false
SSDEEP:	12:cpCujoTugWOL+yjbn2qxBIfdXIb6IINvBKADzW5DWp2ZdGegK6:cYujRmb2M4XIb6GLy2bGtK6
MD5:	FA927DEC66F8A061E63A5E214FECF274
SHA1:	338BD186758F640E8D08F4D73AF84E6283D7B874
SHA-256:	C6821B8D020E68B9EC43626B8DCF96A9AD27D71061C132266BCAD0283F71AC8E
SHA-512:	C2C6AF88C4D18352B926903ED89E3FB3833341B17ADAFC762865FE8FAF36AA4E24DAD38D0A5979DF649B2DFA18920064155371FD496711799693B30AEA983135
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/modulepreload-polyfill.ls8mpkw14abee2a4.js
Preview:	!function(){const e=document.createElement("link").relList;if(!(e&&e.supports&&e.supports("modulepreload"))){for(const e of document.querySelectorAll('link[rel="modulepreload"]'))r(e);new MutationObserver((e=>{for(const o of e)if("childList"===o.type)for(const e of o.addedNodes)"LINK"===e.tagName&&"modulepreload"===e.rel&&r(e)})).observe(document,{childList:!0,subtree:!0})}function r(e){if(e.ep)return;e.ep=!0;const r=function(e){const r={};return e.integrity&&(r.integrity=e.integrity),e.referrerPolicy&&(r.referrerPolicy=e.referrerPolicy),"use-credentials"===e.crossOrigin?r.credentials="include":"anonymous"===e.crossOrigin?r.credentials="omit":r.credentials="same-origin",r}(e);fetch(e.href,r)}}();.

Chrome Cache Entry: 86

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (13662)
Category:	downloaded
Size (bytes):	13663
Entropy (8bit):	5.57613477996758
Encrypted:	false
SSDEEP:	384:DjeL2DH2FEa2FEn2y2FEU2FE+dUdpd6do:i2DH2FEa2FEn2y2FEU2FE+dUdpd6do
MD5:	6F4BB087974EE1A4CEAF26291BEF65B5
SHA1:	FF0F5D09F02CA22206EAD9C5B2C0DF34EB18EB85
SHA-256:	79FAFD4EF943BCA3646B4FCF41CEC9FB517AE4D35A30ABB6A71A1F77DC1855DF
SHA-512:	3B25A47D455AD6FFE282B9B46F1D802B302B5D4840824F1B0FEFA676F2390D3A604B32AA83F70527246C622E631FCFF5A53FE48E73E2389A7458C14A129955BF
Malicious:	false
Reputation:	low
URL:	https://res.wx.qq.com/mmbizappmsg/en_US/htmledition/js/assets/msg.ls8mpkw179fafd4e.css
Preview:	body .weui-media-box_thumb-after .weui-media-box__thumb{margin-right:0}body .weui-media-box_thumb-after .weui-media-box__ft{margin-left:16px;width:60px;height:60px;line-height:60px;text-align:center}body .weui-media-box_profile{padding:12px 0}body .weui-media-box_profile:before{display:none}body .weui-media-box_profile .weui-media-box__hd{width:48px;height:48px;border-radius:50%;overflow:hidden}body .weui-block-label{display:block;word-wrap:break-word;-webkit-hyphens:auto;-ms-hyphens:auto;hyphens:auto;font-size:15px;color:rgba(0,0,0,.9);line-height:1.4;margin-bottom:12px}body .weui-form .weui-cell__ft a{color:rgba(0,0,0,.3)}body .weui-form .weui-agree{display:-ms-flexbox;display:flex;text-align:justify;-ms-flex-pack:center;justify-content:center;word-wrap:break-word;-webkit-hyphens:auto;-ms-hyphens:auto;hyphens:auto}body .weui-form .weui-agree__checkbox{-ms-flex-negative:0;flex-shrink:0;margin-top:0}body .weui-form .weui-agree__text{min-width:0}body .weui-btn_default-white{background:#

Total Packets: 72
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2024 06:47:22.678589106 CET	49674	443	192.168.2.5	23.1.237.91
Feb 16, 2024 06:47:22.678659916 CET	49675	443	192.168.2.5	23.1.237.91
Feb 16, 2024 06:47:22.772197962 CET	49673	443	192.168.2.5	23.1.237.91
Feb 16, 2024 06:47:26.447554111 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.447577953 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.447789907 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.447923899 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.447932959 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.450593948 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.450614929 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.450683117 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.450865984 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.450881958 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.647341013 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.647630930 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.647644043 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.649075031 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.649144888 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.651171923 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.651236057 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.651508093 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.651516914 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.653172016 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.653384924 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.653392076 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.654004097 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.654076099 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.654686928 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.654745102 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.655631065 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.655688047 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.656094074 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.656100988 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.780900002 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.840518951 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.840589046 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.840596914 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.840847969 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.840902090 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.841394901 CET	49706	443	192.168.2.5	142.250.80.14
Feb 16, 2024 06:47:26.841403961 CET	443	49706	142.250.80.14	192.168.2.5
Feb 16, 2024 06:47:26.872705936 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.872771978 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.872781038 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.872855902 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:26.872898102 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.873657942 CET	49705	443	192.168.2.5	172.253.63.84
Feb 16, 2024 06:47:26.873671055 CET	443	49705	172.253.63.84	192.168.2.5
Feb 16, 2024 06:47:27.708537102 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.708587885 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:27.708655119 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.709038019 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.709084034 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:27.709197044 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.709331989 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.709352016 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:27.709526062 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:27.709546089 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.648972034 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.649246931 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.649271011 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.650943041 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.651046038 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.652158022 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.652250051 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.652409077 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.652417898 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.658018112 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.659750938 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.659785032 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.661245108 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.661322117 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.661715984 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.661799908 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.704246998 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.704250097 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:28.704260111 CET	443	49709	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:28.751373053 CET	49709	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.643956900 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.643982887 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.643990993 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644018888 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644042015 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.644076109 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644093037 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.644093990 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644108057 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644145012 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644164085 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.644174099 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.644220114 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.644249916 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.646887064 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.646950960 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.647003889 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.647777081 CET	49710	443	192.168.2.5	203.205.232.110
Feb 16, 2024 06:47:29.647794008 CET	443	49710	203.205.232.110	192.168.2.5
Feb 16, 2024 06:47:29.802313089 CET	49713	443	192.168.2.5	43.152.136.177
Feb 16, 2024 06:47:29.802360058 CET	443	49713	43.152.136.177	192.168.2.5
Feb 16, 2024 06:47:29.802424908 CET	49713	443	192.168.2.5	43.152.136.177

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 16, 2024 06:47:26.356512070 CET	60292	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:26.356753111 CET	58245	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:26.357191086 CET	62241	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:26.357520103 CET	60500	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:26.437700987 CET	53	55000	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:26.446099043 CET	53	62241	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:26.446396112 CET	53	58245	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:26.447060108 CET	53	60500	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:26.449914932 CET	53	60292	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:27.003773928 CET	53	64989	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:27.617933035 CET	63842	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:27.619255066 CET	58523	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:27.706404924 CET	53	63842	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:27.707875967 CET	53	58523	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.712074995 CET	55175	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.712997913 CET	60465	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.735833883 CET	65087	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.736828089 CET	65502	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.739234924 CET	58968	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.740282059 CET	55996	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.800826073 CET	53	55175	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.801387072 CET	53	60465	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.807383060 CET	54074	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.807549000 CET	60309	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.824729919 CET	53	65087	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.824995041 CET	53	65502	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.832755089 CET	49762	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.833143950 CET	54615	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.895924091 CET	53	60309	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.896231890 CET	53	54074	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.897238970 CET	53	58968	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:29.899549961 CET	64208	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:29.899619102 CET	57011	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:30.059288025 CET	53	55996	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.136003017 CET	53	54615	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.207050085 CET	53	57011	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.465214968 CET	53	64208	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.575485945 CET	53	49762	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.668884993 CET	50984	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:30.669476032 CET	56837	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:30.756532907 CET	53	50984	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:30.757487059 CET	53	56837	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:31.369288921 CET	63102	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:31.369556904 CET	58935	53	192.168.2.5	1.1.1.1
Feb 16, 2024 06:47:31.459281921 CET	53	58935	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:31.525743961 CET	53	63102	1.1.1.1	192.168.2.5
Feb 16, 2024 06:47:44.477077961 CET	53	64597	1.1.1.1	192.168.2.5
Feb 16, 2024 06:48:03.354604006 CET	53	60651	1.1.1.1	192.168.2.5
Feb 16, 2024 06:48:26.035933018 CET	53	63504	1.1.1.1	192.168.2.5
Feb 16, 2024 06:48:26.189501047 CET	53	53839	1.1.1.1	192.168.2.5
Feb 16, 2024 06:48:54.868531942 CET	53	57883	1.1.1.1	192.168.2.5

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Feb 16, 2024 06:47:30.059472084 CET	192.168.2.5	1.1.1.1	c1e4	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 16, 2024 06:47:26.356512070 CET	192.168.2.5	1.1.1.1	0x4c5c	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:26.356753111 CET	192.168.2.5	1.1.1.1	0x4cc8	Standard query (0)	clients2.google.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:26.357191086 CET	192.168.2.5	1.1.1.1	0xe1f3	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:26.357520103 CET	192.168.2.5	1.1.1.1	0xed0b	Standard query (0)	accounts.google.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:27.617933035 CET	192.168.2.5	1.1.1.1	0x4a4e	Standard query (0)	mp.weixin.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:27.619255066 CET	192.168.2.5	1.1.1.1	0xe858	Standard query (0)	mp.weixin.qq.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.712074995 CET	192.168.2.5	1.1.1.1	0x265	Standard query (0)	res.wx.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.712997913 CET	192.168.2.5	1.1.1.1	0xd0b	Standard query (0)	res.wx.qq.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.735833883 CET	192.168.2.5	1.1.1.1	0x2d85	Standard query (0)	mmbiz.qpic.cn	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.736828089 CET	192.168.2.5	1.1.1.1	0x2b43	Standard query (0)	mmbiz.qpic.cn	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.739234924 CET	192.168.2.5	1.1.1.1	0xa3d1	Standard query (0)	mpcdn.qpic.cn	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.740282059 CET	192.168.2.5	1.1.1.1	0xc5df	Standard query (0)	mpcdn.qpic.cn	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.807383060 CET	192.168.2.5	1.1.1.1	0x8b3a	Standard query (0)	wxa.wxs.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.807549000 CET	192.168.2.5	1.1.1.1	0xdb34	Standard query (0)	wxa.wxs.qq.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.832755089 CET	192.168.2.5	1.1.1.1	0xaa28	Standard query (0)	file.daihuo.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.833143950 CET	192.168.2.5	1.1.1.1	0x5eff	Standard query (0)	file.daihuo.qq.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:29.899549961 CET	192.168.2.5	1.1.1.1	0xc6c0	Standard query (0)	mpcdn.weixin.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.899619102 CET	192.168.2.5	1.1.1.1	0x84cb	Standard query (0)	mpcdn.weixin.qq.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:30.668884993 CET	192.168.2.5	1.1.1.1	0x7f72	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.669476032 CET	192.168.2.5	1.1.1.1	0xd617	Standard query (0)	www.google.com	65	IN (0x0001)	false
Feb 16, 2024 06:47:31.369288921 CET	192.168.2.5	1.1.1.1	0x6455	Standard query (0)	res.wx.qq.com	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:31.369556904 CET	192.168.2.5	1.1.1.1	0xcb10	Standard query (0)	res.wx.qq.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 16, 2024 06:47:26.446099043 CET	1.1.1.1	192.168.2.5	0xe1f3	No error (0)	accounts.google.com		172.253.63.84	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:26.446396112 CET	1.1.1.1	192.168.2.5	0x4cc8	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:26.449914932 CET	1.1.1.1	192.168.2.5	0x4c5c	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:26.449914932 CET	1.1.1.1	192.168.2.5	0x4c5c	No error (0)	clients.l.google.com		142.250.80.14	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:27.706404924 CET	1.1.1.1	192.168.2.5	0x4a4e	No error (0)	mp.weixin.qq.com	mpv6.weixin.qq.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:27.706404924 CET	1.1.1.1	192.168.2.5	0x4a4e	No error (0)	mpv6.weixin.qq.com		203.205.232.110	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:27.706404924 CET	1.1.1.1	192.168.2.5	0x4a4e	No error (0)	mpv6.weixin.qq.com		203.205.239.154	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.800826073 CET	1.1.1.1	192.168.2.5	0x265	No error (0)	res.wx.qq.com	reswx.tc.qq.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.800826073 CET	1.1.1.1	192.168.2.5	0x265	No error (0)	reswx.tc.qq.com	jxt2rgi0.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.800826073 CET	1.1.1.1	192.168.2.5	0x265	No error (0)	jxt2rgi0.ovslegodl.sched.ovscdns.com		43.152.136.177	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.824729919 CET	1.1.1.1	192.168.2.5	0x2d85	No error (0)	mmbiz.qpic.cn	mmbiz.qpic.cn.cdn.dnsv1.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.824729919 CET	1.1.1.1	192.168.2.5	0x2d85	No error (0)	mmbiz.qpic.cn.cdn.dnsv1.com	m0ocg00i.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.824729919 CET	1.1.1.1	192.168.2.5	0x2d85	No error (0)	m0ocg00i.ovslegodl.sched.ovscdns.com		43.152.136.177	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com	wxa.wxs.qq.com.cloud.tc.qq.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.cloud.tc.qq.com	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		211.97.81.60	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		61.54.91.204	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		61.54.7.110	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		123.12.235.98	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		123.12.235.102	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		116.153.4.97	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		58.144.195.233	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		115.56.90.216	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		58.144.195.239	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		58.144.195.218	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		211.97.81.216	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		116.140.45.59	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		58.144.195.158	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		61.54.94.215	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.896231890 CET	1.1.1.1	192.168.2.5	0x8b3a	No error (0)	wxa.wxs.qq.com.sched.legopic1.tdnsv6.com		61.54.7.109	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:29.897238970 CET	1.1.1.1	192.168.2.5	0xa3d1	No error (0)	mpcdn.qpic.cn	mpcdn.qpic.cn.cdn.dnsv1.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.897238970 CET	1.1.1.1	192.168.2.5	0xa3d1	No error (0)	mpcdn.qpic.cn.cdn.dnsv1.com.cn	5jc9c2ii.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:29.897238970 CET	1.1.1.1	192.168.2.5	0xa3d1	No error (0)	5jc9c2ii.ovslegodl.sched.ovscdns.com		43.152.136.177	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.465214968 CET	1.1.1.1	192.168.2.5	0xc6c0	No error (0)	mpcdn.weixin.qq.com	mpcdn.weixin.qq.com.cdn.dnsv1.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:30.465214968 CET	1.1.1.1	192.168.2.5	0xc6c0	No error (0)	mpcdn.weixin.qq.com.cdn.dnsv1.com.cn	q4h8hyqe.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:30.465214968 CET	1.1.1.1	192.168.2.5	0xc6c0	No error (0)	q4h8hyqe.ovslegodl.sched.ovscdns.com		43.152.136.177	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.575485945 CET	1.1.1.1	192.168.2.5	0xaa28	No error (0)	file.daihuo.qq.com	file.daihuo.qq.com.cloud.tc.qq.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:30.575485945 CET	1.1.1.1	192.168.2.5	0xaa28	No error (0)	file.daihuo.qq.com.cloud.tc.qq.com	file.daihuo.qq.com.sched.px-dk.tdnsv6.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:30.575485945 CET	1.1.1.1	192.168.2.5	0xaa28	No error (0)	file.daihuo.qq.com.sched.px-dk.tdnsv6.com		203.205.136.160	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.575485945 CET	1.1.1.1	192.168.2.5	0xaa28	No error (0)	file.daihuo.qq.com.sched.px-dk.tdnsv6.com		43.152.15.45	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.575485945 CET	1.1.1.1	192.168.2.5	0xaa28	No error (0)	file.daihuo.qq.com.sched.px-dk.tdnsv6.com		203.205.136.84	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.756532907 CET	1.1.1.1	192.168.2.5	0x7f72	No error (0)	www.google.com		142.251.32.100	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:30.757487059 CET	1.1.1.1	192.168.2.5	0xd617	No error (0)	www.google.com			65	IN (0x0001)	false
Feb 16, 2024 06:47:31.525743961 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	res.wx.qq.com	reswx.tc.qq.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:31.525743961 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	reswx.tc.qq.com	jxt2rgi0.ovslegodl.sched.ovscdns.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:31.525743961 CET	1.1.1.1	192.168.2.5	0x6455	No error (0)	jxt2rgi0.ovslegodl.sched.ovscdns.com		43.152.136.177	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:47:43.649532080 CET	1.1.1.1	192.168.2.5	0x9d4f	No error (0)	fp2e7a.wpc.2be4.phicdn.net	fp2e7a.wpc.phicdn.net		CNAME (Canonical name)	IN (0x0001)	false
Feb 16, 2024 06:47:43.649532080 CET	1.1.1.1	192.168.2.5	0x9d4f	No error (0)	fp2e7a.wpc.phicdn.net		192.229.211.108	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:48:18.434454918 CET	1.1.1.1	192.168.2.5	0x5bc5	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.0	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:48:38.889087915 CET	1.1.1.1	192.168.2.5	0x21c7	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.128	A (IP address)	IN (0x0001)	false
Feb 16, 2024 06:48:38.889087915 CET	1.1.1.1	192.168.2.5	0x21c7	No error (0)	windowsupdatebg.s.llnwi.net		69.164.46.0	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

mp.weixin.qq.com

https:

res.wx.qq.com

www.bing.com

fs.microsoft.com

Target ID:	0
Start time:	06:47:23
Start date:	16/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	06:47:24
Start date:	16/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1912,i,6442693838246142779,6774848332666660311,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	06:47:26
Start date:	16/02/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg
Imagebase:	0x7ff715980000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Disassembly

⊘No disassembly

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

Windows Analysis Report
https://mp.weixin.qq.com/s/rmorjigupr2feqhfrxe4wg